Method and system for closed-loop circulation of data in trusted data space

Abstract

The embodiment of the invention discloses a data closed-loop circulation method and system in a trusted data space, and the method comprises the steps: a data user sends an original data use request to a data provider; the data provider loads corresponding original data according to the original data use request, encrypts the original data to obtain ciphertext data, and sends the ciphertext data to a data user; the data user obtains derivative data after using the ciphertext data, and when a derivative data request is received, the derivative data corresponding to the derivative data request is sent to the requester making the derivative data request. And the data utilization rate is improved on the premise of ensuring data security.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing, and in particular to a method and system for closed-loop data circulation in a trusted data space. Background Art

[0002] A trusted data space is a data space used for data circulation, which includes data providers and data demanders. At present, data spaces are more concerned with the security of data transmission and use during the entire process of data use, but ignore the closed-loop problem of data in the entire process.

[0003] There is currently no effective solution to the above problems in the prior art. Summary of the invention

[0004] To solve the above problems, the present invention provides a method and system for closed-loop data circulation in a trusted data space. By obtaining the original data of the data sender, derived data is obtained, and the derived data is sent back to the data sender, so that all data form a data closed loop in the trusted data space, so as to solve the problem that data transmission in the trusted space cannot form a closed loop.

[0005] To achieve the above-mentioned objectives, the present invention provides a method for closed-loop data circulation in a trusted data space, comprising: a data user sends a request for use of original data to a data provider; the data provider loads the corresponding original data according to the original data use request, encrypts the original data to obtain ciphertext data, and sends the ciphertext data to the data user; the data user obtains derivative data after using the ciphertext data, and when receiving a derivative data request, sends the derivative data corresponding to the derivative data request to the requester who made the derivative data request.

[0006] Further optionally, the encrypting the original data to obtain ciphertext data and sending the ciphertext data to the data user includes: generating a corresponding data contract based on the original data; wherein the data contract includes a basic contract of the original data and a derivative data contract; encrypting the original data using a public key in a key pair to obtain the ciphertext data; and sending the ciphertext data, the data contract and the public key in the key pair to the data user.

[0007] Further optionally, the derivative data is obtained after using the ciphertext data, including: when a data acquisition request sent by a user of the data user is received, loading the target ciphertext data and the target data contract in the local database; judging whether the target ciphertext data complies with the corresponding target data contract, if so, decrypting the target ciphertext data using a private key corresponding to the public key sent by the data provider and sending it to the user, generating and storing derivative data corresponding to the target ciphertext data; otherwise, no subsequent processing is performed.

[0008] Further optionally, the derivative data contract includes: whether derivative data can be generated; the number of times the derivative data can be generated; whether the derivative data can be transmitted back to the users of the remaining data space other than the existing two parties; and the APP that can generate the derivative data.

[0009] Further optionally, it also includes: regularly cleaning and processing the derivative data according to business needs to obtain data processing results; and storing the data processing results in a local database.

[0010] On the other hand, the present invention also provides a data closed-loop circulation system in a trusted data space, comprising: a request sending module, used by a data user to send an original data usage request to a data provider; a data encryption module, used by the data provider to load the corresponding original data according to the original data usage request, encrypt the original data to obtain ciphertext data, and send the ciphertext data to the data user; a derived data transmission module, used by the data user to obtain derived data after using the ciphertext data, and when a derived data request is received, the derived data corresponding to the derived data request is sent to the requester who made the derived data request.

[0011] Further optionally, the data encryption module includes: a data contract generation submodule, used to generate a corresponding data contract based on the original data; wherein the data contract includes a basic contract and a derivative data contract of the original data; an encryption submodule, used to encrypt the original data using a public key in a key pair to obtain the ciphertext data; and a data transmission submodule, used to send the ciphertext data, the data contract and the public key in the key pair to the data user.

[0012] Further optionally, the derivative data transmission module includes: a data loading sub-module, used to load the target ciphertext data and the target data contract in the local database when receiving a data acquisition request sent by a user of the data user; a judgment sub-module, used to judge whether the target ciphertext data complies with the corresponding target data contract. If so, the target ciphertext data is decrypted by a private key corresponding to the public key sent by the data provider and sent to the user, and derivative data corresponding to the target ciphertext data is generated and stored; otherwise, no subsequent processing is performed.

[0013] Further optionally, the derivative data contract includes: whether derivative data can be generated; the number of times derivative data can be generated; whether derivative data can be transmitted back to users of the remaining trusted data space other than the existing two parties; and an APP that can generate derivative data.

[0014] Further optionally, the system also includes: a data sorting module, which is used to regularly clean and process the derivative data according to business needs to obtain data processing results; and a data storage module, which is used to store the data processing results in a local database.

[0015] The above technical solution has the following beneficial effects: by re-empowering the derivative data, the utilization rate of the data is improved, and these derivative data can be transmitted back to the data providers and other data requesters, providing more business expansion opportunities for each derivative data generator; limiting the authority of the derivative data and improving the security of data use; and improving data quality by regularly cleaning and processing the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 is a flow chart of a method for closed-loop data circulation in a trusted data space provided by an embodiment of the present invention;

[0018] Figure 2 is a flow chart of the original data encryption transmission method provided by an embodiment of the present invention;

[0019] Figure 3 is a flow chart of a method for generating derivative data provided by an embodiment of the present invention;

[0020] Figure 4 is a flow chart of a derivative data arrangement method provided by an embodiment of the present invention;

[0021] Figure 5 It is a structural schematic diagram of a data closed-loop circulation system in a trusted data space provided by an embodiment of the present invention;

[0022] Figure 6 is a structural diagram of a data encryption module provided by an embodiment of the present invention;

[0023] Figure 7 is a schematic diagram of the structure of a derivative data transmission module provided by an embodiment of the present invention;

[0024] Figure 8 It is a schematic diagram of the structure of a module for collating derived data provided by an embodiment of the present invention.

[0025] Figure numerals: 100 - request sending module; 200 - data encryption module; 2001 - data contract generation submodule; 2002 - encryption submodule; 2003 - data transmission submodule; 300 - derived data transmission module; 3001 - data loading submodule; 3002 - judgment submodule; 400 - data sorting module; 500 - data storage module. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] In order to solve the problem that the trusted space data cannot be circulated in a closed loop in the prior art, an embodiment of the present invention provides a method for closed-loop circulation of data in a trusted data space. Figure 1 is a flow chart of a closed-loop data circulation method in a trusted data space provided by an embodiment of the present invention. Figure 1 As shown, the method includes:

[0028] S1. The data user sends an original data usage request to the data provider;

[0029] The data user sends a raw data use request to the data provider based on its business needs, clearly indicating that it wants to use specific data. For example, if a medical institution requests the medical records of some patients from the hospital management system, it needs to send a corresponding medical record data use request to the hospital management system. In this embodiment, both the data user and the data provider are in a trusted execution environment (TEE).

[0030] S2. The data provider loads the corresponding original data according to the original data use request, encrypts the original data to obtain ciphertext data, and sends the ciphertext data to the data user;

[0031] After receiving the request to use the original data, the data provider first verifies the legality and validity of the request, and then loads the original data corresponding to the request after verification.

[0032] In order to ensure the security of data during transmission, the data provider encrypts the loaded original data to generate ciphertext data. The ciphertext data ensures that the data will not be stolen or tampered with by a third party during network transmission. The encrypted ciphertext data is sent to the data user through a secure communication channel.

[0033] S3. The data user obtains derivative data after using the encrypted data. When receiving a derivative data request, the derivative data corresponding to the derivative data request is sent to the requester who made the derivative data request.

[0034] After receiving the encrypted data, the data user stores it in a local database for use by users in need. When the user needs to use the data, the data user can decrypt the encrypted data and send it to the user. At the same time, the data user will generate corresponding derivative data when using the original data. Derivative data is useful information derived from the original data, usually used to support further analysis, decision-making or other business needs. For example, when a bank uses different data service providers and queries the information of some users, it will form multiple information, and this multiple information can be used to empower new businesses and data providers. For example, when a bank uses the data of a data service provider for modeling, the derivative data of the modeling results or the derivative data of the modeling process can be used as new data for secondary empowerment.

[0035] When other data parties need these derived data, they send a derived data use request to the data user. After passing the validity verification or security verification, the corresponding derived data can be sent to these requesting parties. Of course, the data provider can also make a request for derived data as a requesting party to achieve a closed-loop circulation of data.

[0036] As an optional implementation, Figure 2 is a flow chart of the original data encryption transmission method provided by an embodiment of the present invention, such as Figure 2 As shown, the original data is encrypted to obtain ciphertext data, and the ciphertext data is sent to the data user, including:

[0037] S201, generating a corresponding data contract according to the original data; wherein the data contract includes a basic contract of the original data and a derived data contract;

[0038] After receiving the original data use request, the data provider loads the corresponding original data in the local database. Then, the corresponding data contract is generated based on the original data. In order to ensure the safe and reliable implementation of the derived data, a derived data contract is required on the basis of satisfying the basic contract at this stage. The basic contract can determine the basic terms such as the legal scope of use of the original data, the user's rights and the contract period, and ensure the responsibilities and obligations of the data provider and the data user. The derived data contract stipulates the generation, use, and return of the derived data.

[0039] S202, using the public key in the key pair to encrypt the original data to obtain ciphertext data;

[0040] After the data contract is generated, the data provider uses the public key in the key pair to encrypt the original data to obtain the ciphertext data. The key pair (public key and private key) is a technical means to ensure the confidentiality of data through public key encryption and private key decryption, and can be generated in advance.

[0041] S203: Send the ciphertext data, the data contract and the public key in the key pair to the data user.

[0042] The data provider bundles the ciphertext data and the data contract and adds the public key, and then sends the bundled result to the data user.

[0043] After receiving the ciphertext data and data contract, the data user stores them in the local database. When the user of the data user requests the data, the data user decrypts the data that complies with the data contract using the private key in its own key pair and sends the decrypted data to the user. The private key in the said key pair corresponds to the public key sent by the data provider.

[0044] As an optional implementation, Figure 3 is a flow chart of a method for generating derivative data provided by an embodiment of the present invention, such as Figure 3 As shown, the derived data obtained by using the ciphertext data includes:

[0045] S301, when receiving a data acquisition request sent by a user of a data user, loading the target ciphertext data and the target data contract in the local database;

[0046] S302. Determine whether the target ciphertext data complies with the corresponding target data contract. If so, decrypt the target ciphertext data using the private key corresponding to the public key sent by the data provider and send it to the user, and generate and store derivative data corresponding to the target ciphertext data; otherwise, do not perform subsequent processing.

[0047] Users will initiate data acquisition requests to data users. Specifically, users will make requests through specific APPs, such as data query APPs, data analysis APPs, data modeling APPs, etc.

[0048] Take the data query APP as an example to illustrate:

[0049] When a user initiates a data query request, the request will be sent to the data query APP of the data user. The data query APP retrieves the ciphertext data and the corresponding data contract in the local database of the data user. The data user determines whether the target ciphertext data consulted by the data query APP meets the target data contract corresponding to the data. If not, the query is rejected; if it is, the data user uses the private key corresponding to the public key sent by the data provider to decrypt the target ciphertext data and outputs the decrypted plaintext to the data query APP. When the data query APP obtains data, it generates derivative information (query user ID, query user time, query user content, etc.) based on the user information of the query user and sends and stores it in the local database of the data user.

[0050] As an optional implementation, the derivative data contract includes: whether derivative data can be generated; the number of times derivative data can be generated; whether derivative data can be transmitted back to users of the trusted data space other than the existing two parties; and the APP that can generate derivative data.

[0051] Among them, whether derivative data can be generated or not, this derivative data contract limits the generation rights of derivative data. If the contract stipulates that "derivative data generation is allowed", the data user can conduct further analysis or modeling based on the original data to generate derivative data such as credit scores and user behavior predictions; on the contrary, if the contract stipulates that "derivative data generation is not allowed", the data user can only use the original data for data query and analysis, and may not create new data on this basis. In addition, during the user review stage, if the derivative data contract stipulates that "derivative data generation is not allowed", then even if other contract conditions are met, the corresponding derivative data cannot be generated.

[0052] The derivative data contract limits the number of times derivative data can be generated to avoid data abuse.

[0053] The derived data transfer permission ensures that derived data will not be disclosed or disseminated without authorization to requesting parties who should not have access to derived data.

[0054] APP usage permissions specify which applications (APPs) can use raw data to generate derivative data. Different APPs may have different functions, such as data analysis APPs, machine learning APPs, predictive model APPs, etc. Control the environment in which derivative data is generated to ensure that only authorized APPs can use data to generate derivative data, avoid unauthorized or non-compliant applications from processing data, and reduce risks.

[0055] As an optional implementation, Figure 4 is a flow chart of a derivative data sorting method provided by an embodiment of the present invention, such as Figure 4As shown, the method also includes:

[0056] S4. Clean and process the derived data regularly according to business needs to obtain data processing results;

[0057] S5. Store the data processing results in a local database.

[0058] Data cleaning and processing can be achieved using a dedicated APP. Different types of cleaning and processing can be performed according to different business needs. A startup frequency is pre-set to regularly start the cleaning and processing program to process the derived data.

[0059] The purpose of data cleaning is to improve data quality, remove inaccurate, incomplete or inconsistent data, and ensure that the data can be used for effective analysis and decision-making.

[0060] Data processing is the process of processing and converting cleaned data. Its purpose is to convert the data into a format suitable for analysis. It usually includes steps such as feature engineering, data conversion, and normalization.

[0061] Take the scenario of multiple bank loans as an example to illustrate the closed-loop circulation of data:

[0062] In a multiple lending scenario, a single borrower may submit loan requests to two or more banks at the same time. In order to effectively assess the borrower's credit risk, the bank (data user) needs the data service company (data provider) to obtain the borrower's credit data.

[0063] Under this requirement, the bank (data user) sends an original data use request to the data service company (data provider), requesting to obtain the target borrower's credit data (such as credit score, historical loan records, repayment status, etc.). After receiving the original data use request, the data service company (data provider) loads the corresponding credit data and encrypts it to generate ciphertext data, and sends the ciphertext data and the corresponding contract back to the bank (data user).

[0064] After receiving the borrower's credit data, the bank (data user) stores it in the local database. When the borrower's credit data is retrieved and queried, derivative data will be generated, such as query records (the time and purpose of the bank's query of the borrower's credit data), loan decision data (the bank's decision on whether to approve the loan, the loan amount and interest rate, etc.). When the data service company (data provider) sends a derivative data use request to the bank (data user), these derivative data can be sent back to the data service company (data provider), and the data provider can iteratively update the original credit data stored locally based on these derivative data, thereby completing the closed-loop circulation of data. If multiple banks have conducted data queries on the target borrower, then the multiple data generated for the target borrower will be sent back to the data service company, and the data service company can update and iterate its own data based on the multiple data to improve data accuracy.

[0065] The embodiment of the present invention also provides a data closed-loop circulation system in a trusted data space. Figure 5 is a schematic diagram of the structure of a data closed-loop circulation system in a trusted data space provided by an embodiment of the present invention, such as Figure 5 As shown, the system includes:

[0066] The request sending module 100 is used for the data user to send the original data use request to the data provider;

[0067] The data user sends a raw data use request to the data provider based on its business needs, clearly indicating that it wants to use specific data. For example, if a medical institution requests the medical records of some patients from the hospital management system, it needs to send a corresponding medical record data use request to the hospital management system. In this embodiment, both the data user and the data provider are in a trusted execution environment (TEE).

[0068] The data encryption module 200 is used by the data provider to load the corresponding original data according to the original data use request, encrypt the original data to obtain ciphertext data, and send the ciphertext data to the data user;

[0069] After receiving the request to use the original data, the data provider first verifies the legality and validity of the request, and then loads the original data corresponding to the request after verification.

[0070] In order to ensure the security of data during transmission, the data provider encrypts the loaded original data to generate ciphertext data. The ciphertext data ensures that the data will not be stolen or tampered with by a third party during network transmission. The encrypted ciphertext data is sent to the data user through a secure communication channel.

[0071] The derived data transmission module 300 is used by the data user to obtain derived data after using the ciphertext data. When a derived data request is received, the derived data corresponding to the derived data request is sent to the requester who makes the derived data request.

[0072] After receiving the encrypted data, the data user stores it in a local database for use by users in need. When the user needs to use the data, the data user can decrypt the encrypted data and send it to the user. At the same time, the data user will generate corresponding derivative data when using the original data. Derivative data is useful information derived from the original data, usually used to support further analysis, decision-making or other business needs. For example, when a bank uses different data service providers and queries the information of some users, it will form multiple information, and this multiple information can be used to empower new businesses and data providers. For example, when a bank uses the data of a data service provider for modeling, the derivative data of the modeling results or the derivative data of the modeling process can be used as new data for secondary empowerment.

[0073] When other data parties need these derived data, they send a derived data use request to the data user. After passing the validity verification or security verification, the corresponding derived data can be sent to these requesting parties. Of course, the data provider can also make a request for derived data as a requesting party to achieve a closed-loop circulation of data.

[0074] As an optional implementation, Figure 6 is a schematic diagram of the structure of a data encryption module provided by an embodiment of the present invention, such as Figure 6 As shown, the data encryption module 200 includes:

[0075] The data contract generation submodule 2001 is used to generate a corresponding data contract according to the original data; wherein the data contract includes a basic contract of the original data and a derived data contract;

[0076] After receiving the original data use request, the data provider loads the corresponding original data in the local database. Then, the corresponding data contract is generated based on the original data. In order to ensure the safe and reliable implementation of the derived data, a derived data contract is required on the basis of satisfying the basic contract at this stage. The basic contract can determine the basic terms such as the legal scope of use of the original data, the user's rights and the contract period, and ensure the responsibilities and obligations of the data provider and the data user. The derived data contract stipulates the generation, use, and return of the derived data.

[0077] The encryption submodule 2002 is used to encrypt the original data using the public key in the key pair to obtain ciphertext data;

[0078] After the data contract is generated, the data provider uses the public key in the key pair to encrypt the original data to obtain the ciphertext data. The key pair (public key and private key) is a technical means to ensure the confidentiality of data through public key encryption and private key decryption, and can be generated in advance.

[0079] The data transmission submodule 2003 is used to send the ciphertext data, the data contract and the public key in the key pair to the data user.

[0080] The data provider bundles the ciphertext data and the data contract and adds the public key, and then sends the bundled result to the data user.

[0081] After receiving the encrypted data and data contract, the data user stores them in the local database. When the user requests data, the data that complies with the data contract is decrypted using the private key corresponding to the public key sent by the data provider and sent to the user.

[0082] As an optional implementation, Figure 7 is a schematic diagram of the structure of a derivative data transmission module provided in an embodiment of the present invention, such as Figure 7 As shown, the derived data transmission module 300 includes:

[0083] The data loading submodule 3001 is used to load the target ciphertext data and the target data contract in the local database when receiving a data acquisition request sent by a user of the data user;

[0084] The judgment submodule 3002 is used to judge whether the target ciphertext data complies with the corresponding target data contract. If so, the target ciphertext data is decrypted by the private key corresponding to the public key sent by the data provider and sent to the user, and the derivative data corresponding to the target ciphertext data is generated and stored; otherwise, no subsequent processing is performed.

[0085] Users will initiate data acquisition requests to data users. Specifically, users will make requests through specific APPs, such as data query APPs, data analysis APPs, data modeling APPs, etc.

[0086] Take the data query APP as an example to illustrate:

[0087] When a user initiates a data query request, the request will be sent to the data query APP of the data user. The data query APP retrieves the ciphertext data and the corresponding data contract in the local database of the data user. The data user determines whether the target ciphertext data consulted by the data query APP meets the target data contract corresponding to the data. If not, the query is rejected; if it is, the data user uses the corresponding private key to decrypt the target ciphertext data and outputs the decrypted plaintext to the data query APP. When the data query APP obtains data, it generates derivative information (query user ID, query user time, query user content, etc.) based on the user information of the query user and sends and stores it to the local database of the data user.

[0088] As an optional implementation, the derivative data contract includes: whether derivative data can be generated; the number of times derivative data can be generated; whether derivative data can be transmitted back to users of the trusted data space other than the existing two parties; and the APP that can generate derivative data.

[0089] Among them, whether derivative data can be generated or not, this derivative data contract limits the generation rights of derivative data. If the contract stipulates that "derivative data generation is allowed", the data user can conduct further analysis or modeling based on the original data to generate derivative data such as credit scores and user behavior predictions; on the contrary, if the contract stipulates that "derivative data generation is not allowed", the data user can only use the original data for data query and analysis, and may not create new data on this basis. In addition, during the user review stage, if the derivative data contract stipulates that "derivative data generation is not allowed", then even if other contract conditions are met, the corresponding derivative data cannot be generated.

[0090] The derivative data contract limits the number of times derivative data can be generated to avoid data abuse.

[0091] The derived data transfer permission ensures that derived data will not be disclosed or disseminated without authorization to requesting parties who should not have access to derived data.

[0092] APP usage permissions specify which applications (APPs) can use raw data to generate derivative data. Different APPs may have different functions, such as data analysis APPs, machine learning APPs, predictive model APPs, etc. Control the environment in which derivative data is generated to ensure that only authorized APPs can use data to generate derivative data, avoid unauthorized or non-compliant applications from processing data, and reduce risks.

[0093] As an optional implementation, Figure 8 is a schematic diagram of the structure of a module for arranging derived data provided by an embodiment of the present invention, such as Figure 8 As shown, the system also includes:

[0094] The data sorting module 400 is used to regularly clean and process the derived data according to business requirements to obtain data processing results;

[0095] The data storage module 500 is used to store the data processing results in a local database.

[0096] Data cleaning and processing can be achieved using a dedicated APP. Different types of cleaning and processing can be performed according to different business needs. A startup frequency is pre-set to regularly start the cleaning and processing program to process the derived data.

[0097] The purpose of data cleaning is to improve data quality, remove inaccurate, incomplete or inconsistent data, and ensure that the data can be used for effective analysis and decision-making.

[0098] Data processing is the process of processing and converting cleaned data. Its purpose is to convert the data into a format suitable for analysis. It usually includes steps such as feature engineering, data conversion, and normalization.

[0099] The above technical solution has the following beneficial effects: by re-empowering the derivative data, the utilization rate of the data is improved, and these derivative data can be transmitted back to the data providers and other data requesters, providing more business expansion opportunities for each derivative data generator; limiting the authority of the derivative data and improving the security of data use; and improving data quality by regularly cleaning and processing the data.

[0100] The specific implementation methods of the above invention further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above content is only the specific implementation methods of the present invention and is not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A closed-loop data circulation method in a trusted data space, characterized in that: include: The data user sends the original data usage request to the data provider; The data provider loads the corresponding original data according to the original data use request, encrypts the original data to obtain ciphertext data, and sends the ciphertext data to the data user; The data user obtains the derivative data after using the ciphertext data, and when receiving a derivative data request, sends the derivative data corresponding to the derivative data request to the requester who made the derivative data request.

2. The method for closed-loop data circulation in a trusted data space according to claim 1, characterized in that: The step of encrypting the original data to obtain ciphertext data and sending the ciphertext data to a data user includes: Generate a corresponding data contract according to the original data; wherein the data contract includes a basic contract of the original data and a derived data contract; Encrypting the original data using the public key in the key pair to obtain the ciphertext data; The ciphertext data, data contract and the public key in the key pair are sent to the data user.

3. The method for closed-loop data circulation in a trusted data space according to claim 2, characterized in that: The method of obtaining the derived data by using the ciphertext data includes: When receiving a data acquisition request sent by a user of the data user, the target ciphertext data and the target data contract are loaded into the local database; Determine whether the target ciphertext data complies with the corresponding target data contract. If so, decrypt the target ciphertext data using the private key corresponding to the public key sent by the data provider and send it to the user, and generate and store the derivative data corresponding to the target ciphertext data; otherwise, no subsequent processing is performed.

4. The method for closed-loop data circulation in a trusted data space according to claim 2, characterized in that: The derivative data contract includes: Whether derivative data can be generated; The number of times derivative data can be generated; Whether the derived data can be transmitted back to other users of the trusted data space besides the existing two parties; An app that can generate derivative data.

5. The method for closed-loop data circulation in a trusted data space according to claim 1, characterized in that: Also includes: Regularly clean and process the derivative data according to business needs to obtain data processing results; The data processing result is stored in a local database.

6. A data closed-loop circulation system in a trusted data space, characterized in that: include: A request sending module is used by a data user to send an original data use request to a data provider; A data encryption module, used for the data provider to load the corresponding original data according to the original data use request, encrypt the original data to obtain ciphertext data, and send the ciphertext data to the data user; The derived data transmission module is used for a data user to obtain derived data after using the ciphertext data. When a derived data request is received, the derived data corresponding to the derived data request is sent to the requesting party that makes the derived data request.

7. The data closed-loop circulation system in a trusted data space according to claim 6, characterized in that: The data encryption module comprises: A data contract generation submodule, used to generate a corresponding data contract according to the original data; wherein the data contract includes a basic contract of the original data and a derived data contract; The encryption submodule is used to encrypt the original data using the public key in the key pair to obtain the ciphertext data; The data transmission submodule is used to send the ciphertext data, the data contract and the public key in the key pair to the data user.

8. The data closed-loop circulation system in a trusted data space according to claim 7, characterized in that: The derived data transmission module comprises: The data loading submodule is used to load the target ciphertext data and target data contract in the local database when receiving a data acquisition request sent by a user of the data user; The judgment submodule is used to judge whether the target ciphertext data complies with the corresponding target data contract. If so, the target ciphertext data is decrypted by the private key corresponding to the public key sent by the data provider and sent to the user, and the derivative data corresponding to the target ciphertext data is generated and stored; otherwise, no subsequent processing is performed.

9. The data closed-loop circulation system in a trusted data space according to claim 7, characterized in that: The derivative data contract includes: Whether derivative data can be generated; The number of times derivative data can be generated; Whether the derived data can be transmitted back to other users of the trusted data space besides the existing two parties; An app that can generate derivative data.

10. The data closed-loop circulation system in a trusted data space according to claim 6, characterized in that: Also includes: A data sorting module is used to regularly clean and process the derived data according to business needs to obtain data processing results; The data storage module is used to store the data processing results in a local database.

Images