Insurance data storage method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an insurance data storage method and device, electronic equipment and a storage medium, and belongs to the technical field of financial science and technology. The method comprises the steps of obtaining original insurance data, performing data fragmentation on the original insurance data to obtain fragmented insurance data and a target fragmentation identifier of the fragmented insurance data, encrypting the fragmented insurance data according to a preset original key to obtain encrypted insurance data, performing Hash calculation on the encrypted insurance data, and obtaining the target fragmentation identifier of the fragmented insurance data. And obtaining the hash value of the encrypted insurance data, determining the target partition of the preset storage database according to the hash value, and storing the encrypted insurance data and the target fragment identifier to the target partition, so that the security of insurance data storage can be improved.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to an insurance data storage method and device, an electronic device and a storage medium. Background Art

[0002] In the insurance industry, the normal operation of insurance business requires the support of insurance data such as policies, claims records, customer information, etc. The traditional method directly stores insurance data in the database. When the database is attacked from the outside, the insurance data is at risk of data leakage, resulting in low security of insurance data storage. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to provide an insurance data storage method and device, an electronic device and a storage medium, aiming to improve the security of insurance data storage.

[0004] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes an insurance data storage method, the method comprising:

[0005] Obtaining original insurance data;

[0006] Slicing the original insurance data to obtain sliced ​​insurance data and target slice identifiers of the sliced ​​insurance data;

[0007] Encrypting the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data;

[0008] Performing hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

[0009] Determine a target partition of a preset storage database according to the hash value;

[0010] The encrypted insurance data and the target shard identifier are stored in the target partition.

[0011] In some embodiments, the preset storage database is deployed with a smart contract. After storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes:

[0012] Obtain access object information and access data information;

[0013] Performing object permission verification on the access object information through the smart contract to obtain authorized object information;

[0014] Filtering a reference partition from the preset storage database according to the authorization object information and the access data information, determining a reference shard identifier according to the reference partition and the access data information, and extracting target encrypted data from the reference partition according to the reference shard identifier;

[0015] Target access data is determined according to the target encryption data.

[0016] In some embodiments, determining target access data according to the target encrypted data includes:

[0017] Obtaining a reference key for the target encrypted data;

[0018] Storing the reference key and the reference slice identifier in a preset key management database;

[0019] Obtain the reference key from the preset key management database through the smart contract to obtain the target key;

[0020] Decrypting the target encrypted data according to the target key to obtain target slice data;

[0021] According to the reference slice identifier, the target slice data is integrated to obtain the target access data.

[0022] In some embodiments, after storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes:

[0023] Obtaining the storage duration of the encrypted insurance data in the target partition to obtain a reference storage duration;

[0024] Acquire the data type of the encrypted insurance data;

[0025] Determining a benchmark storage duration of the encrypted insurance data according to the data type;

[0026] Determine a data operation according to the reference storage duration, the data type and the benchmark storage duration; wherein the data operation includes a data deletion operation or a data migration operation;

[0027] The data operation is performed on the encrypted insurance data stored in the target partition.

[0028] In some embodiments, determining the data operation according to the reference storage duration, the data type, and the benchmark storage duration includes:

[0029] comparing the reference storage duration with the benchmark storage duration;

[0030] If the reference storage duration is greater than the benchmark storage duration, obtaining the data importance level of the encrypted insurance data according to the data type;

[0031] If the data importance level is less than a preset level threshold, determining that the data operation is the data deletion operation;

[0032] If the data importance level is greater than or equal to the preset level threshold, the data operation is determined to be the data migration operation.

[0033] In some embodiments, after storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes:

[0034] Obtain shared data information;

[0035] Filtering candidate partitions from the preset storage database according to the shared data information, determining candidate shard identifiers according to the candidate partitions and the shared data information, and extracting candidate encrypted data from the candidate partitions according to the candidate shard identifiers;

[0036] Performing data integration on the candidate encrypted data according to the candidate shard identifiers to obtain target shared data;

[0037] The target shared data is shared with the target shared object through a preset encrypted transmission protocol.

[0038] In some embodiments, after sharing the target shared data with the target shared object through a preset encrypted transmission protocol, the insurance data storage method further includes:

[0039] Receiving data integrity check information fed back by the target sharing object for integrity check of the target sharing data; the data integrity check information is used to indicate that the target sharing data is complete or the target sharing data is incomplete;

[0040] The data access permission of the target sharing object to the target shared data is removed from a preset permission list according to the data integrity verification information.

[0041] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application provides an insurance data storage device, the device comprising:

[0042] An acquisition module, used to acquire original insurance data;

[0043] A sharding module, used for sharding the original insurance data to obtain sharded insurance data and a target sharding identifier of the sharded insurance data;

[0044] An encryption module, used for encrypting the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data;

[0045] A hash calculation module, used to perform hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

[0046] A determination module, used to determine a target partition of a preset storage database according to the hash value;

[0047] A storage module is used to store the encrypted insurance data and the target shard identifier in the target partition.

[0048] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0049] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0050] The insurance data storage method, insurance data storage device, electronic device and computer-readable storage medium proposed in the embodiment of the present application support the normal operation of the insurance business by acquiring the original insurance data to store the original insurance data in the database. With the increase of the amount of insurance data, the storage of the full amount of insurance data by a single node will reduce the processing performance of the insurance system. In order to improve the processing performance of the insurance system, the original insurance data is sharded, and the full amount of original insurance data is divided into data fragments to obtain the sharded insurance data and the target sharding identifier of the sharded insurance data, so that the sharded insurance data can be stored in different nodes in a dispersed manner, so that the sharded insurance data can be processed in parallel, and the storage efficiency and processing efficiency of the database are optimized. Insurance data involves important information such as personal information data and investment financial data. In order to ensure the security of the sharded insurance data, the sharded insurance data is encrypted according to the preset original key to obtain encrypted insurance data. In order to determine the storage location of the encrypted insurance data in the database, the encrypted insurance data is hashed to obtain the hash value of the encrypted insurance data, and the target partition of the preset storage database is determined according to the hash value. The target partition is determined by the hash value, so that the encrypted insurance data can be evenly distributed in each partition of the database, which improves the space utilization of the database. The encrypted insurance data and the target shard identifier are stored in the target partition. By dispersing and storing the encrypted data fragments in different partitions of the database, both the storage efficiency of the database and the data security of the insurance data are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 is a flowchart of the insurance data storage method provided by an embodiment of the present application;

[0052] Figure 2 is another flow chart of the insurance data storage method provided by an embodiment of the present application;

[0053] Figure 3 yes Figure 2 Flow chart of step S240 in FIG.

[0054] Figure 4 is another flow chart of the insurance data storage method provided by an embodiment of the present application;

[0055] Figure 5 yes Figure 4 Flowchart of step S440 in FIG.

[0056] Figure 6 is another flow chart of the insurance data storage method provided by an embodiment of the present application;

[0057] Figure 7 is another flow chart of the insurance data storage method provided by an embodiment of the present application;

[0058] Figure 8 It is a schematic diagram of the structure of the insurance data storage device provided in an embodiment of the present application;

[0059] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0061] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0063] In the insurance industry, the normal operation of insurance business requires the support of insurance data such as policies, claims records, customer information, etc. The traditional method directly stores insurance data in the database. When the database is attacked from the outside, the insurance data is at risk of data leakage, resulting in low security of insurance data storage.

[0064] Based on this, the embodiments of the present application provide an insurance data storage method, an insurance data storage device, an electronic device and a computer-readable storage medium, aiming to improve the security of insurance data storage.

[0065] The insurance data storage method, insurance data storage device, electronic device and computer-readable storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the insurance data storage method in the embodiments of the present application is described.

[0066] The insurance data storage method provided in the embodiment of the present application relates to the field of financial technology technology. The insurance data storage method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the insurance data storage method, etc., but is not limited to the above forms.

[0067] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0068] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0069] Figure 1 This is an optional flowchart of the insurance data storage method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps S110 to S160.

[0070] Step S110, obtaining original insurance data;

[0071] Step S120, sharding the original insurance data to obtain sharded insurance data and target shard identifiers of the sharded insurance data;

[0072] Step S130, encrypting the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data;

[0073] Step S140, performing hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

[0074] Step S150, determining a target partition of a preset storage database according to the hash value;

[0075] Step S160, storing the encrypted insurance data and the target shard identifier in the target partition.

[0076] Steps S110 to S160 shown in the embodiment of the present application, by sharding the insurance data and storing the encrypted data fragments in different partitions of the database, not only improve the storage efficiency of the database, but also enhance the data security of the insurance data.

[0077] In step S110 of some embodiments, the insurance company collects insurance data through various channels such as the insurance company's internal business system, third-party data providers, and public data platforms. The collected insurance data often has some errors or omissions. In order to ensure the quality and availability of the insurance data, the insurance data can be cleaned and organized according to a unified format and standard to obtain the original insurance data. The original insurance data is a collection of data related to the insurance business. The original insurance data includes customer information, policy details, claims records, health information, and financial information. Customer information includes name, ID number, contact information, address, etc. Policy details include policy number, insurance type, insurance period, insurance amount, etc. Claims records include claim case number, claim amount, claim date, claim status, etc. Health information includes physical examination reports, medical records, health status, etc. Financial information includes payment records, bills, refund records, etc.

[0078] In step S120 of some embodiments, as the business scope of the insurance business expands, such as the introduction of new insurance products and the increase in the number of customers, the amount of insurance data will increase. If a large amount of insurance data is stored on a single node, the storage efficiency of the database will be low. In addition, insurance data may involve sensitive information such as customer information, insurance records, and claims records. In order to ensure the data security of insurance data and optimize the storage efficiency of the database, a data sharding algorithm is called to shard the original insurance data, divide the original insurance data into data fragments, obtain sharded insurance data, and generate a target sharding identifier for the sharded insurance data. The sharded insurance data is a data fragment of the original insurance data, and the target sharding identifier is a unique identifier of the data fragment, which is used to distinguish different data fragments.

[0079] Data sharding algorithms include horizontal data sharding algorithms and vertical data sharding algorithms. The original insurance data is stored in the database in the form of a table, which consists of multiple rows and multiple columns. The row represents a data record, and the column represents the attribute of the data record. Taking the customer information table as an example, the information of a specific customer entity is a data record, and the name, age, gender, etc. are all attributes of the data record. In the case where the amount of original insurance data is large or the data access frequency is high, the horizontal data sharding algorithm can be used to divide the original insurance data into multiple data fragments based on rows. Each data fragment contains data records of different rows, and the data structure of each row is the same. In the case where the original insurance data contains a large number of columns, especially when some columns are frequently queried, the vertical data sharding algorithm can be used to divide the original insurance data into multiple data fragments based on columns. Each data fragment contains data of different columns, and each data fragment includes at least one attribute. For example, in a customer information table, name, age, gender, and telephone number are different attributes. In vertical sharding, the name and age may be placed in one data fragment, and the telephone number and email address may be placed in another data fragment.

[0080] In step S130 of some embodiments, in order to ensure the security of the data fragments, an original key is generated by an encryption algorithm, and the encryption algorithm may be Advanced Encryption Standard (AES), an asymmetric encryption algorithm, etc. If the AES encryption algorithm is used, the original key is a key, and the same key can be used to encrypt and decrypt data. If an asymmetric encryption algorithm is used, the original key includes a public key and a private key, the public key is used to encrypt data, and the private key is used to decrypt data. The fragmented insurance data can be encrypted according to the original key or the public key in the original key to obtain encrypted insurance data.

[0081] In step S140 of some embodiments, a hash function is obtained, and the hash function may be a message digest algorithm (MD5), a secure hash algorithm (SHA), etc. The encrypted insurance data may be data of any data type, such as character data, date data, and numeric data. In order to quickly locate the storage location of the encrypted insurance data in the preset storage database, a hash calculation is performed on the encrypted insurance data according to the hash function to convert the insurance data of any data type into an output in a unified format to obtain an initial value. The preset storage database is a local database of the insurance company, and the storage space of the preset storage database is divided into a plurality of sub-intervals of equal size to obtain a plurality of partitions. Each partition is an independent storage unit, and the partition may be a physical partition or a logical partition. The number of partitions of the partition is obtained, and the number of partitions is used as the modulus of the hash function. The initial value is modulo-operated according to the modulus of the hash function to obtain the hash value of the encrypted insurance data.

[0082] In step S150 of some embodiments, the partition has a partition identifier, and a partition whose partition identifier is equal to the hash value is selected from the preset storage database as the target partition. For example, the preset storage database has 10 partitions, and partition identifiers from 1 to 10 are set for the partitions. The hash value of the encrypted insurance data is 3, and the partition with the partition identifier 3 is selected as the target partition.

[0083] In step S160 of some embodiments, in order to distinguish different encrypted insurance data, the encrypted insurance data and the target sharding identifier are stored together in the target partition, so that each encrypted insurance data obtained by the horizontal data sharding algorithm can be distributed in different partitions, so that each encrypted insurance data can be stored and processed in parallel, thereby improving the storage efficiency and processing efficiency of the encrypted insurance data. At the same time, the encrypted insurance data with a lower access frequency and the encrypted insurance data with a higher access frequency obtained by the vertical data sharding algorithm can be stored in different partitions, thereby improving the access speed of the data. By storing the sharded data fragments in different partitions, the uniformity of data distribution is ensured and the efficiency of data query is improved.

[0084] Furthermore, to ensure the integrity of the encrypted insurance data, the initial value obtained by hashing the encrypted insurance data through a hash function can be used as a verification hash value, and the verification hash value and the target shard identifier can be stored in another database different from the preset storage database. By storing the encrypted insurance data and the verification hash value separately, the encrypted insurance data can be hash-verified subsequently using the verification hash value.

[0085] Insurance data involves sensitive information such as customer information, health status, and financial status. In order to ensure data security and privacy protection, access control of insurance data is required after the insurance data is stored in a preset storage database. The embodiment of the present application designs a smart contract and deploys the smart contract in a preset storage database. The conditions, permissions, and operation logic for data access are clearly defined in the smart contract, including who can access which data and when they can access it, to manage the access rights and operation rules of insurance data. When requesting access to specific insurance data, the smart contract automatically verifies the identity and permissions of the requester. Only after the permission verification is passed can the corresponding data fragment be decrypted and accessed. Through the smart contract access control mechanism, data leakage and illegal access are effectively prevented, and sensitive information is protected.

[0086] See also Figure 2 In some embodiments, after step S160, the insurance data storage method may further include but is not limited to steps S210 to S240:

[0087] Step S210, obtaining access object information and access data information;

[0088] Step S220, performing object permission verification on the access object information through the smart contract to obtain the authorized object information;

[0089] Step S230, filtering out a reference partition from a preset storage database according to the authorization object information and the access data information, determining a reference shard identifier according to the reference partition and the access data information, and extracting target encrypted data from the reference partition according to the reference shard identifier;

[0090] Step S240, determining target access data according to the target encrypted data.

[0091] In step S210 of some embodiments, when accessing insurance data, the user can initiate a data access request to a preset storage database through an application on a terminal device. The preset storage database extracts access object information and access data information from the data access request, wherein the access object information is the identity information of the data requester, such as a user account, user name, etc., and the access data information is the data resource type requested by the data requester and the data operation type on the data resource type. The data resource type may be a claims record, financial status, etc., and the data operation type may be a read operation, a write operation, a delete operation, etc.

[0092] In step S220 of some embodiments, in order to prevent unauthorized users from accessing data resources and reduce the risk of network attacks on the preset storage database, the embodiments of the present application authenticate the access object information to ensure that only users who have passed the authentication can interact with the smart contract, and the access object information that has passed the authentication is used as the verification object information. The authentication method can be decentralized authentication, zero-knowledge proof, and adaptive multi-factor authentication. In the insurance industry, insurance data plays a vital role in the normal operation of the business. In order to ensure the security of data access, the resource access process is more fine-grained through smart contracts. Rules and permissions are defined in smart contracts to clarify user roles, role permissions, data managed by role permissions, and the access period allowed for data, so that users with access rights can access specific data resources. Specifically, the user role of the verification object information is determined through a smart contract, the role authority is determined according to the user role, the role authority is compared with the data operation type in the access data information, and if the data operation type meets the role authority, the data resource type in the access data information is compared with the data managed by the role authority. If the data resource type is the same as the data managed by the role authority, it is determined whether the current access time is within the access period allowed for the data. If the judgment result is yes, the verification object information is used as the authorization object information to provide data access services to the user during the business period. If the data operation type does not meet the role authority, the data resource type is different from the data managed by the role authority, or the current access time is not within the access period, the access of the user to whom the access object information belongs is denied.

[0093] In step S230 of some embodiments, after the preset storage database stores the encrypted insurance data, a metadata table is maintained, which records the data resource type of the data fragment, the partition of the data fragment, and the shard identifier of the data fragment. After the smart contract obtains the authorization object information, that is, after the permission verification is passed, the partition of the data resource type in the access data information is retrieved from the preset storage database according to the metadata table to obtain the reference partition. There are multiple data fragments stored in the reference partition. In order to obtain the data fragment related to the access data information, the shard identifier is filtered out from the metadata table according to the reference partition and the data resource type in the access data information to obtain the reference shard identifier. The shard identifier is stored in the partition together with the data fragment, and the target encrypted data can be extracted from the reference partition according to the reference shard identifier.

[0094] In step S240 of some embodiments, the insurance data to which the data resource type belongs consists of one or more data fragments. The number of reference fragment identifiers is obtained. If the number is 1, it means that the access data information only involves the access of one data fragment, and the target encrypted data is decrypted to obtain the target access data. The fragment identifier of the data fragment can represent the position of the data fragment in the insurance data. If the number is greater than 1, it means that the access data information involves the access of multiple data fragments, and the target encrypted data is decrypted to obtain the target fragment data, and the target fragment data is spliced ​​in sequence according to the order of the reference fragment identifiers to obtain the complete target access data.

[0095] In the above steps S210 to S240, by performing permission verification on the access object information, only authorized users can access specific data fragments, thereby ensuring the security of insurance data.

[0096] See also Figure 3 In some embodiments, step S240 may include but is not limited to steps S310 to S350:

[0097] Step S310, obtaining a reference key of target encrypted data;

[0098] Step S320, storing the reference key and the reference slice identifier in a preset key management database;

[0099] Step S330, obtaining a reference key from a preset key management database through a smart contract to obtain a target key;

[0100] Step S340, decrypting the target encrypted data according to the target key to obtain the target slice data;

[0101] Step S350: integrating the target shard data according to the reference shard identifier to obtain target access data.

[0102] In step S310 of some embodiments, target encrypted data is obtained by encrypting a data fragment with a key, and a key for generating the target encrypted data is obtained to obtain a reference key.

[0103] In step S320 of some embodiments, the preset key management database is a system or service for securely storing and managing keys, such as a key management service (KMS) or a hardware security module (HSM). Each data fragment corresponds to a key. In order to ensure the security of the key and facilitate centralized management of the keys of each data fragment, the reference key and the reference fragment identifier are stored together in the preset key management database.

[0104] In step S330 of some embodiments, after the permission verification is passed, the smart contract obtains the reference key from the preset key management database according to the reference shard identifier to obtain the target key.

[0105] In step S340 of some embodiments, the target encrypted data is decrypted according to the target key, and the target encrypted data is restored from ciphertext to plaintext, so that the data fragments are readable and usable, thereby obtaining the target shard data.

[0106] In step S350 of some embodiments, the target shard data are spliced ​​in the order of the reference shard identifiers to obtain target access data, so that the user can perform read and write operations on the target access data according to the data operation type.

[0107] In the above steps S310 to S350, the key is stored in a preset key management database, which can ensure the security of the key. For any data fragment, without the correct key, even if the encrypted data is obtained, its content cannot be interpreted, which enhances the security of insurance data. By splicing the various data fragments, the integrity of the data is guaranteed.

[0108] See also Figure 4 In some embodiments, after step S160, the insurance data storage method may further include but is not limited to steps S410 to S450:

[0109] Step S410, obtaining the storage duration of the encrypted insurance data in the target partition to obtain a reference storage duration;

[0110] Step S420, obtaining the data type of the encrypted insurance data;

[0111] Step S430, determining a reference storage time for the encrypted insurance data according to the data type;

[0112] Step S440, determining a data operation according to the reference storage duration, the data type and the benchmark storage duration; wherein the data operation includes a data deletion operation or a data migration operation;

[0113] Step S450, performing data operations on the encrypted insurance data stored in the target partition.

[0114] In step S410 of some embodiments, retaining expired insurance data in the local database will consume too much storage resources. The embodiment of the present application uses smart contracts to automatically manage the entire life cycle of insurance data from creation to destruction to manage and optimize local storage resources. In order to determine whether the encrypted insurance data is expired data, the storage duration of the encrypted insurance data in the target partition is obtained to obtain a reference storage duration.

[0115] In step S420 of some embodiments, the data type of the encrypted insurance data is obtained, and the data type may be customer information, policy details, claim records, etc.

[0116] In step S430 of some embodiments, the data retention period is defined in the smart contract, and different data types have different data retention periods. For example, customer information involves sensitive information such as name, ID number, contact information, etc., which needs to be retained for a long time, and the data retention period is 10 years. The claim record contains the claim case number, claim amount, etc., and there is still a need for reference several years after the claim is completed. The data retention period is 5 years. Determine the data retention period of encrypted insurance data according to the data type to obtain the benchmark storage period.

[0117] In step S440 of some embodiments, it is determined whether the encrypted insurance data is expired data based on the reference storage duration and the benchmark storage duration. If the encrypted insurance data is expired data, the data operation is determined based on the data type, and the data operation includes a data deletion operation or a data migration operation. The data deletion operation is used to delete the encrypted insurance data from the preset storage database, and the data migration operation is used to migrate the encrypted insurance data from the preset storage database to the long-term storage database. The long-term storage database can be a low-cost storage device or a cloud archiving service. If the encrypted insurance data is non-expired data, no processing is performed on the encrypted insurance data.

[0118] In step S450 of some embodiments, in order to reduce the storage burden of the local database, a data deletion operation or a data migration operation is performed on the encrypted insurance data stored in the target partition to prevent the expired data from being improperly retained. For example, after an insurance contract expires, the smart contract will automatically trigger the data migration or data deletion process to ensure that the data is not improperly retained.

[0119] When deleting encrypted insurance data, to ensure that the encrypted insurance data is completely deleted and cannot be recovered, cryptographic erasure technology or a multi-verification mechanism can be used. Cryptographic erasure technology makes data inaccessible by deleting or rewriting the key, rather than directly erasing the data itself. The multi-verification mechanism uses blockchain technology to record the status of data deletion and verify the authenticity of the data deletion operation on multiple nodes. During the data migration process, the encrypted insurance data is divided into multiple small fragments, and the small fragments are stored on different storage nodes using distributed storage technology to improve data security and reliability.

[0120] Through the above steps S410 to S450, the life cycle of insurance data can be automatically managed, and expired insurance data can be deleted or migrated, thereby optimizing the storage resources of the local database and improving the space utilization and data access efficiency of the local storage space.

[0121] See also Figure 5 In some embodiments, step S440 may include but is not limited to steps S510 to S540:

[0122] Step S510, comparing the reference storage duration with the benchmark storage duration;

[0123] Step S520, if the reference storage duration is greater than the benchmark storage duration, obtaining the data importance level of the encrypted insurance data according to the data type;

[0124] Step S530, if the data importance level is less than a preset level threshold, determining that the data operation is a data deletion operation;

[0125] Step S540: If the data importance level is greater than or equal to the preset level threshold, the data operation is determined to be a data migration operation.

[0126] In step S510 of some embodiments, in order to determine whether the encrypted insurance data is expired data, the reference storage duration and the benchmark storage duration are compared.

[0127] In step S520 of some embodiments, the data importance level is used to evaluate the importance of the encrypted insurance data. The higher the data importance level, the more important the encrypted insurance data is. The data importance level is a positive number. For example, the data importance level of customer information is 3, and the data importance level of temporary logs is 1. The importance of customer information is higher than that of temporary logs. If the reference storage duration is greater than the benchmark storage duration, it means that the encrypted insurance data is expired data. In order to determine the data operation of the encrypted insurance data, the data importance level of the encrypted insurance data is obtained according to the data type.

[0128] In step S530 of some embodiments, the preset level threshold is greater than the minimum data importance level and less than the maximum data importance level, and can be set according to actual conditions, for example, 2. If the data importance level is less than the preset level threshold, it means that the encrypted insurance data is not important, and the data operation is determined to be a data deletion operation.

[0129] In step S540 of some embodiments, if the data importance level is greater than or equal to a preset level threshold, it means that the encrypted insurance data is insurance data of relatively high importance, and the data operation is determined to be a data migration operation.

[0130] The above steps S510 to S540 determine the data operation on expired insurance data according to the importance of the data, thereby avoiding the occupation of storage resources by unimportant data, allowing limited storage resources to store more important data and supporting the normal operation of the insurance business.

[0131] In order to achieve data sharing and cross-institutional collaboration among different insurance companies, a cross-institutional data sharing mechanism is established through smart contracts under the premise of ensuring data privacy, allowing data to be securely exchanged and verified between different insurance companies, providing a safe and efficient way for insurance data exchange, promoting collaborative operations and efficiency improvement in the insurance industry, and is of great significance for building a safer, more efficient and collaborative insurance system. For example, an insurance company can share a claim report with other insurance companies through a smart contract to verify whether there is a duplicate claim.

[0132] See also Figure 6 In some embodiments, after step S160, the insurance data storage method may further include but is not limited to steps S610 to S640:

[0133] Step S610, obtaining shared data information;

[0134] Step S620, screening out candidate partitions from a preset storage database according to the shared data information, determining candidate shard identifiers according to the candidate partitions and the shared data information, and extracting candidate encrypted data from the candidate partitions according to the candidate shard identifiers;

[0135] Step S630, integrating the candidate encrypted data according to the candidate shard identifiers to obtain target shared data;

[0136] Step S640: Share the target shared data with the target shared object through a preset encrypted transmission protocol.

[0137] In step S610 of some embodiments, a smart contract that allows data sharing is designed, and the smart contract includes data transmission rules, encryption standards, and data access rights. Data transmission rules are used to constrain data exchange and processing processes, such as trigger conditions for data transmission, data formats, etc. Encryption standards are data encryption methods, such as hash functions, public key encryption, digital signatures, etc. Data access rights are used to control user operation rights on data, such as read rights, write rights, etc. When an insurance company initiates a data sharing request, the smart contract verifies the validity of the data sharing request and extracts shared data information from the data sharing request. The shared data information includes the data resource type of the insurance data to be shared and the data sharing object. The insurance company is the data sender, and the data sharing object is the data receiver.

[0138] In step S620 of some embodiments, required data is extracted from a local database according to the shared data information and sent to the data sharing object. Specifically, referring to step S230, the partition of the data resource type in the shared data information is retrieved from the preset storage database according to the metadata table to obtain a candidate partition. According to the candidate partition and the data resource type in the shared data information, a shard identifier is screened from the metadata table to obtain a candidate shard identifier, and candidate encrypted data is extracted from the candidate partition according to the candidate shard identifier. The candidate encrypted data is a data segment associated with the candidate shard identifier.

[0139] In step S630 of some embodiments, referring to step S240, if the number of candidate shard identifiers is 1, the candidate encrypted data is used as the target shared data. If the number of candidate shard identifiers is greater than 1, the candidate encrypted data is concatenated in the order of the candidate shard identifiers to obtain the target shared data.

[0140] In step S640 of some embodiments, after obtaining the target shared data, the smart contract triggers the transmission process of the target shared data according to the data transmission rules, encapsulates the target shared data into a data packet, and uses the private key of the data sender to sign the data packet to ensure the integrity and source authenticity of the data. In order to ensure the security of insurance data during transmission, an encryption transmission protocol such as Transport Layer Security (TLS) and Secure Sockets Layer (SSL) is obtained according to the encryption standard, and the data packet containing the data signature and the target shared data is encrypted according to the encryption transmission protocol, and the data sharing object in the shared data information is used as the target sharing object, and the encrypted data packet is shared with the target sharing object.

[0141] In the above steps S610 to S640, a data sharing channel can be established through smart contracts to facilitate cross-institutional collaboration of insurance data. In addition, the insurance data will be encrypted during the data transmission process to ensure the security and privacy of the data.

[0142] See also Figure 7 In some embodiments, after step S640, the insurance data storage method may further include but is not limited to steps S710 to S720:

[0143] Step S710, receiving data integrity check information fed back by the target sharing object after checking the integrity of the target sharing data; the data integrity check information is used to indicate that the target sharing data is complete or incomplete;

[0144] Step S720: remove the data access permission of the target sharing object to the target shared data from the preset permission list according to the data integrity verification information.

[0145] In step S710 of some embodiments, the target shared object receives the target shared data, and uses the smart contract to decrypt the target shared data to obtain the decrypted shared data. The target shared object verifies the digital signature of the decrypted shared data according to the public key of the data sender to perform integrity check on the decrypted shared data. If the digital signature verification passes, the data integrity check information is determined to be that the target shared data is complete; if the digital signature verification fails, the data integrity check information is determined to be that the target shared data is incomplete.

[0146] In step S720 of some embodiments, the objects that have the right to access specific data are recorded in the permission list. If the data integrity check information shows that the target shared data is complete, indicating that the data sharing purpose has been achieved, the smart contract deletes the data access rights of the target shared object to the target shared data from the permission list associated with the target shared data, ensuring that the target shared data is no longer used without authorization. If the data integrity check information shows that the target shared data is incomplete, the target shared data will not be shared.

[0147] To prevent data loss or damage, the target sharing object may temporarily create a data copy as a backup. After the data sharing is completed, the smart contract will command the target sharing object to delete all temporarily stored data copies to prevent data leakage and abuse.

[0148] Smart contracts cannot directly access the local storage system of the target shared object, and it is a challenge to ensure that the target shared object deletes all copies of the data. In order to improve the trust of data deletion, after the target shared object deletes the target shared data, a proof can be generated and recorded on the blockchain. The smart contract can verify this proof and ensure that it is consistent with the hash value of the original data, thereby proving that the data has been deleted. Multi-party computing technology can also be used to allow multiple trusted third parties to participate in the data deletion process. Each third party holds the key to a portion of the data copy. When the data needs to be deleted, all parties collaborate to complete the key destruction, thereby ensuring that the data copy cannot be recovered. Cryptographic erasure technology can also be used to ensure that the data copy is completely deleted, and the erasure process is verified by smart contracts. For example, the target shared object can provide physical or logical evidence of an erased hard disk or storage medium to prove that the data has been irreversibly erased.

[0149] Through the above steps S710 to S720, once the data exchange is completed, the smart contract automatically terminates the shared channel, so that the insurance data is only exchanged within the authorized time period.

[0150] See also Figure 8 The embodiment of the present application also provides an insurance data storage device, which can implement the above insurance data storage method, and the device includes:

[0151] An acquisition module 810 is used to acquire original insurance data;

[0152] The sharding module 820 is used to perform data sharding on the original insurance data to obtain sharded insurance data and target sharding identifiers of the sharded insurance data;

[0153] The encryption module 830 is used to encrypt the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data;

[0154] A hash calculation module 840, used to perform hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

[0155] A determination module 850, configured to determine a target partition of a preset storage database according to a hash value;

[0156] The storage module 860 is used to store the encrypted insurance data and the target shard identifier into the target partition.

[0157] The specific implementation of the insurance data storage device is basically the same as the specific implementation of the above-mentioned insurance data storage method, and will not be repeated here.

[0158] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned insurance data storage method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0159] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0160] The processor 910 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0161] The memory 920 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 920 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 920, and the processor 910 calls and executes the insurance data storage method of the embodiment of this application;

[0162] Input / output interface 930, used to implement information input and output;

[0163] Communication interface 940, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0164] bus 950 , which transmits information between the various components of the device (e.g., processor 910 , memory 920 , input / output interface 930 , and communication interface 940 );

[0165] The processor 910 , the memory 920 , the input / output interface 930 , and the communication interface 940 are connected to each other in communication within the device via a bus 950 .

[0166] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned insurance data storage method is implemented.

[0167] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0168] The insurance data storage method, insurance data storage device, electronic device and computer storage medium provided in the embodiments of the present application, by fragmenting the insurance data and storing the encrypted data fragments in different partitions of the database, not only improves the storage efficiency of the database, but also enhances the data security of the insurance data.

[0169] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0170] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0171] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0172] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0173] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0174] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0175] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0176] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0177] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0178] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0179] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for storing insurance data, characterized in that: The method comprises: Obtaining raw insurance data; Slicing the original insurance data to obtain sliced ​​insurance data and target slice identifiers of the sliced ​​insurance data; Encrypting the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data; Performing hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data; Determine a target partition of a preset storage database according to the hash value; The encrypted insurance data and the target shard identifier are stored in the target partition.

2. The method according to claim 1, characterized in that The preset storage database is deployed with a smart contract. After storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes: Obtain access object information and access data information; Performing object permission verification on the access object information through the smart contract to obtain authorized object information; Filtering a reference partition from the preset storage database according to the authorization object information and the access data information, determining a reference shard identifier according to the reference partition and the access data information, and extracting target encrypted data from the reference partition according to the reference shard identifier; Target access data is determined according to the target encryption data.

3. The method according to claim 2, characterized in that The determining target access data according to the target encrypted data comprises: Obtaining a reference key for the target encrypted data; Storing the reference key and the reference slice identifier in a preset key management database; Obtain the reference key from the preset key management database through the smart contract to obtain the target key; Decrypting the target encrypted data according to the target key to obtain target slice data; According to the reference slice identifier, the target slice data is integrated to obtain the target access data.

4. The method according to claim 2, characterized in that: After storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes: Obtaining the storage duration of the encrypted insurance data in the target partition to obtain a reference storage duration; Acquire the data type of the encrypted insurance data; Determining a benchmark storage duration of the encrypted insurance data according to the data type; Determine a data operation according to the reference storage duration, the data type and the benchmark storage duration; wherein the data operation includes a data deletion operation or a data migration operation; The data operation is performed on the encrypted insurance data stored in the target partition.

5. The method according to claim 4, characterized in that The determining of the data operation according to the reference storage duration, the data type and the benchmark storage duration includes: comparing the reference storage duration with the benchmark storage duration; If the reference storage duration is greater than the benchmark storage duration, obtaining the data importance level of the encrypted insurance data according to the data type; If the data importance level is less than a preset level threshold, determining that the data operation is the data deletion operation; If the data importance level is greater than or equal to the preset level threshold, the data operation is determined to be the data migration operation.

6. The method according to any one of claims 1 to 5, characterized in that: After storing the encrypted insurance data and the target shard identifier in the target partition, the insurance data storage method further includes: Obtain shared data information; Filtering candidate partitions from the preset storage database according to the shared data information, determining candidate shard identifiers according to the candidate partitions and the shared data information, and extracting candidate encrypted data from the candidate partitions according to the candidate shard identifiers; Performing data integration on the candidate encrypted data according to the candidate shard identifiers to obtain target shared data; The target shared data is shared with the target shared object through a preset encrypted transmission protocol.

7. The method according to claim 6, characterized in that After the target shared data is shared with the target shared object through the preset encryption transmission protocol, the insurance data storage method further includes: Receiving data integrity check information fed back by the target sharing object for integrity check of the target sharing data; the data integrity check information is used to indicate that the target sharing data is complete or the target sharing data is incomplete; The data access permission of the target sharing object to the target shared data is removed from a preset permission list according to the data integrity verification information.

8. An insurance data storage device, characterized in that: The device comprises: An acquisition module, used to acquire original insurance data; A sharding module, used for sharding the original insurance data to obtain sharded insurance data and a target sharding identifier of the sharded insurance data; An encryption module, used for encrypting the sliced ​​insurance data according to a preset original key to obtain encrypted insurance data; A hash calculation module, used to perform hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data; A determination module, used to determine a target partition of a preset storage database according to the hash value; A storage module is used to store the encrypted insurance data and the target shard identifier in the target partition.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images