Data element management method, device, data element platform and storage medium

Abstract

The present application relates to a data element management method, device, data element platform and storage medium. The method includes: according to a data acquisition request, obtaining the data element corresponding to the data acquisition request; packaging the data element to generate a data packet including the data element and authorization information; sending the data packet to the data user so that the data user uses the data packet according to the SKD tool; according to the authorization information, managing the use of the data packet by the data user through the SKD tool. The solution provided by the present application can effectively supervise and protect the data elements during the use of the data elements, and ensure the safe use of the data elements.

Description

Technical Field

[0001] The present application relates to the field of data element technology, and in particular to a data element management method, device, data element platform and storage medium. Background Art

[0002] With the vigorous development of the digital economy, data elements, as key production factors, have become an important driving force for social progress in terms of circulation and utilization. However, the orderly circulation of data elements faces many challenges, especially in terms of the authorized use of data elements. Data element authorization means that in the process of data element circulation, the data provider provides data elements to the data user, and the data provider, for reasons of privacy and compliance, agrees with the data user on the use of data elements under certain restrictions and constraints. In this scenario, how to solve whether the actual use of data elements by the data user meets the agreement of the data provider? The data element authorization use solutions of relevant technologies in the industry mainly include two modes: 1. Authorization at the data source: In this mode, data elements are authorized once at the data source. Only authorized data users can obtain data elements from the data source. Data elements can be used freely after leaving the domain. This authorization method is simple and easy to understand, but it cannot effectively monitor and protect the entire process of subsequent use of data elements. There is a risk of abuse and leakage of data elements. After obtaining the original data elements, data users can perform data operations in any environment and device.

[0003] 2. Digital watermark traceability: In this model, by embedding imperceptible watermark information in the original data elements, once the data of the data element is leaked, the watermark can be used for traceability monitoring. However, this method cannot prevent unauthorized data use in a timely manner during the use of data elements, and has limitations for real-time data use supervision, which belongs to post-event supervision.

[0004] Therefore, the data element authorization use scheme of the relevant technology cannot limit the specific environment in which data elements are used, cannot promptly block the unauthorized use of data elements, cannot track operational behaviors during the use of data elements, and cannot effectively supervise and protect data elements during the use of data elements, which poses a very serious threat to the security of data elements. Summary of the invention

[0005] In order to solve or partially solve the problems existing in the related technology, the present application provides a data element management method, device, data element platform and storage medium, which can effectively supervise and protect data elements during the use of data elements and ensure the safe use of data elements.

[0006] The first aspect of the present application provides a data element management method, the method comprising: According to the data acquisition request, acquiring data elements corresponding to the data acquisition request; Packaging the data elements to generate a data packet including the data elements and authorization information; Sending the data packet to a data user so that the data user uses the data packet according to the SKD tool; Based on the authorization information, the use of the data package by the data user is managed through the SKD tool.

[0007] Preferably, the packaging of the data elements to generate a data packet including the data elements and the authorization information includes: The data elements are encrypted and packaged to generate an encrypted data packet including the data elements and authorization information; wherein the authorization information includes one or more of the authorization subject, authorization purpose, authorization environment, authorization duration, digital signature, usage type, and usage log.

[0008] Preferably, managing the use of the data packet by the data user through the SKD tool according to the authorization information includes: Based on the authorization information, the SKD tool authorizes and / or records the use of the encrypted data package by the data user.

[0009] Preferably, sending the data packet to a data user so that the data user uses the data packet according to a SKD tool includes: According to the encrypted data packet, specifying a SKD tool that uses the encrypted data packet; The encrypted data package and the SKD tool are sent to a data user, so that the data user uses the encrypted data package according to the SKD tool.

[0010] Preferably, sending the encrypted data package and the SKD tool to a data user so that the data user uses the encrypted data package according to the SKD tool includes: Sending the encrypted data package and the SKD tool to a data user, so that the data user uses the encrypted data package in an online mode according to the SKD tool; or The encrypted data package and the SKD tool are sent to a data user, so that the data user uses the encrypted data package in an offline mode according to the SKD tool.

[0011] Preferably, acquiring data elements corresponding to the data acquisition request according to the data acquisition request includes: According to the target data description information and / or the target data use authorization application information of the data acquisition request, data elements corresponding to the target data description information and / or the target data use authorization application information are acquired.

[0012] Preferably, the identification information of the authorization environment includes one or more of a host IP segment, a host MAC address, a host user name, a data development component, and a data development component version.

[0013] A second aspect of the present application provides a data element management device, the data element management device comprising: An acquisition module, used to acquire data elements corresponding to the data acquisition request according to the data acquisition request; A packaging module, used to package the data elements acquired by the acquisition module to generate a data packet including the data elements and authorization information; A transceiver module, used for sending the data packet generated by the packaging module to a data user, so that the data user uses the data packet according to the SKD tool; A management module is used to manage the use of the data package by the data user through the SKD tool according to the authorization information.

[0014] The third aspect of the present application provides a data element platform, including: Processor; and The memory stores executable codes thereon, and when the executable codes are executed by the processor, the processor is caused to execute the method as described above.

[0015] A fourth aspect of the present application provides a computer-readable storage medium having executable code stored thereon, which, when executed by a processor, causes the processor to execute the method as described above.

[0016] The technical solution provided by this application may have the following beneficial effects: The technical solution of the present application obtains data elements corresponding to a data acquisition request according to a data acquisition request; packages the data elements to generate a data packet including the data elements and authorization information; sends the data packet to a data user so that the data user uses the data packet according to a SKD tool; manages the use of the data packet by the data user through the SKD tool according to the authorization information; combines the SDK tool with the data packet to ensure that the scope of use of the data elements is limited according to the authorization information of the data packet during use, thereby avoiding the problem that the relevant technical data authorization method cannot timely block the unauthorized use of data elements and cannot track the compliance of the operation behavior during the use of data elements; and can effectively supervise and protect the data elements during the use of the data elements to ensure the safe use of the data elements. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above and other objects, features and advantages of the present application will become more apparent by describing in more detail exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0018] Figure 1 It is a flowchart of a data element management method shown in an embodiment of the present application; Figure 2 is another flowchart of the data element management method shown in an embodiment of the present application; Figure 3 It is a flowchart of the data element management method in a specific application scenario shown in an embodiment of the present application; Figure 4 It is a structural diagram of a data element management device shown in an embodiment of the present application; Figure 5 is another structural schematic diagram of the data element management device shown in an embodiment of the present application; Figure 6 It is a structural diagram of the data element platform shown in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0020] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0021] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0022] The embodiment of the present application provides a data element management method, which can effectively supervise and protect data elements during the process of using data elements, thereby ensuring the safe use of data elements.

[0023] The technical solution of the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0024] Figure 1 It is a flow chart of the data element management method shown in the embodiment of the present application.

[0025] See also Figure 1 , a data element management method, comprising: Step 101, according to the data acquisition request, obtain the data elements corresponding to the data acquisition request.

[0026] In one embodiment, the data element platform can retrieve the data elements provided by all data providers based on the data acquisition request sent by the data user, and obtain the data elements corresponding to the data acquisition request.

[0027] Step 102, package the data elements to generate a data packet including the data elements and authorization information.

[0028] In one embodiment, the data element platform can package the data elements corresponding to the data acquisition request to generate a data packet including the data elements and authorization information. The authorization information may include the authorized subject (data user) authorized to use the data elements, the authorization environment, the authorization duration, etc.

[0029] Step 103, sending the data packet to the data user so that the data user uses the data packet according to the SKD tool.

[0030] In one embodiment, the data element platform may send a data packet including data elements and authorization information to a data user; the data user receives the data packet including data elements and authorization information, and reads and uses the data elements of the data packet through a SKD tool.

[0031] Step 104: manage the use of the data package by the data user through the SKD tool according to the authorization information.

[0032] In one embodiment, during the process of a data user reading and using data elements of a data packet through a SKD tool, the data element platform may authorize, monitor, and record operations such as reading and using the data packet by the data user through the SKD tool.

[0033] In one embodiment, during the process of a data user reading and using data elements of a data packet through a SKD tool, if the data user's use of the data packet through the SKD tool complies with the authorization information, the data user is authorized to use the data packet through the SKD tool through the SKD tool, and the SKD tool monitors and records the data user's operations such as reading and using the data packet through the SKD tool in real time; if the data user's use of the data packet through the SKD tool does not comply with the authorization information, the data user is prohibited from using the data packet.

[0034] The data element management method of the embodiment of the present application obtains the data elements corresponding to the data acquisition request according to the data acquisition request; packages the data elements to generate a data packet including the data elements and authorization information; sends the data packet to the data user so that the data user uses the data packet according to the SKD tool; manages the use of the data packet by the data user through the SKD tool according to the authorization information; combines the SDK tool with the data packet to ensure that the scope of use of the data elements is limited according to the authorization information of the data packet during use, thereby avoiding the problem that the related technical data authorization method cannot timely block the unauthorized use of data elements and cannot track the compliance of the operation behavior during the use of data elements; it can effectively supervise and protect the data elements during the use of the data elements to ensure the safe use of the data elements.

[0035] Figure 2 It is another flow chart of the data element management method shown in an embodiment of the present application. Figure 2 Relative to Figure 1 The scheme of the present application is described in more detail.

[0036] See also Figure 2, a data element management method, comprising: Step 201, receiving a data acquisition request for acquiring data elements.

[0037] In one embodiment, when a data user needs to use a data element, the data user can submit a data acquisition request to the data element platform; the data element platform receives the data acquisition request from the data user to obtain the data element. The data acquisition request submitted by the data user to the data element platform includes but is not limited to target data description information and target data use authorization application information.

[0038] In one embodiment, the target data description information includes but is not limited to the data name of the target data element and a detailed description of the data file; wherein the detailed description of the data file includes but is not limited to the file name of the target data element file, the hash value, the date range of the data contained, etc. The data element platform can retrieve and obtain the target data element according to the target data description information.

[0039] In one embodiment, the target data use authorization application information includes but is not limited to the authorization subject, authorization purpose, authorization environment, etc. of the data element. The authorization subject may be an authorized data user, which may be represented by the unique user ID of the data user. The data element platform may write the target data use authorization application information into the encrypted data packet of the data element so as to perform authorization verification in the subsequent use process of the data element.

[0040] Step 202: According to the data acquisition request, acquire the data elements corresponding to the data acquisition request.

[0041] In one embodiment, data elements corresponding to the target data description information and / or the target data use authorization application information may be acquired according to the target data description information and / or the target data use authorization application information of the data acquisition request.

[0042] In one embodiment, the data element platform may perform regulatory review and approval on received data acquisition requests. After the regulatory review and approval of the data acquisition requests are passed, a search may be performed on the data element platform based on the data acquisition request to retrieve all data elements provided by data providers that are pre-stored on the data element platform, and obtain the data elements provided by the data providers that correspond to the data acquisition request.

[0043] In one embodiment, the data element platform may perform regulatory approval on the received data acquisition request, and after the data acquisition request is approved, forward the data acquisition request to the data provider; the data provider receives the data acquisition request, performs regulatory approval on the received data acquisition request, and after the data acquisition request is approved, searches the data provider's database based on the data acquisition request to obtain the data elements corresponding to the data acquisition request; sends the data elements corresponding to the data acquisition request to the data element platform; the data element platform receives the data elements corresponding to the data acquisition request sent by the data provider.

[0044] It should be noted that the data provider can refer to the device terminal that provides the data elements, or the provider of the data. The data user can refer to the device terminal that uses the data elements, or the user of the data.

[0045] Step 203, encrypt and package the data elements to generate an encrypted data packet including the data elements and authorization information.

[0046] In one embodiment, the data element platform may encrypt and package the data elements corresponding to the data acquisition request to generate an encrypted data packet including the data elements and authorization information. Based on the authorization information embedded in the encrypted data packet, when the data user uses the data elements of the encrypted data packet through the SDK (Software Development Kit) tool, it can be determined whether the data user meets the authorization requirements for using the data elements of the encrypted data packet, and the use of the encrypted data packet by the data user can be managed through the SKD tool.

[0047] In one embodiment, the data element platform may use AES (Advanced Encryption Standard) two-way encryption technology to encrypt and package the data elements corresponding to the data acquisition request, and generate an encrypted data packet including the data elements and authorization information; compress the encrypted data packet to obtain a compressed encrypted data packet, and the compressed encrypted data packet can reduce the network and disk pressure during the transmission of the encrypted data packet.

[0048] In one embodiment, the data element platform can write authorization information into the authorization information field embedded in the encrypted data packet, and the authorization information includes one or more of the authorized subject, authorization purpose, authorization environment, authorization duration, digital signature, usage type, and usage log.

[0049] In one embodiment, the authorized subject represents a data user who has been reviewed and approved by the data element platform and is able to use a certain data element, and can be represented by a unique user identifier generated by the data element platform for the data user.

[0050] In one embodiment, the authorization purpose can be used to describe the use of the data element. By describing the purpose of the data element, the use of the data element can be limited and the authorization purpose of the data element can be described.

[0051] In one embodiment, the authorization environment may be used to describe the usage environment of the data element, and may specify information used to mark the usage environment of the data element.

[0052] In one embodiment, the identification information of the authorized environment includes but is not limited to one or more of the host IP (Internet Protocol) segment, host MAC address (Media Access Control Address), host user name, data development component, and data development component version.

[0053] In one embodiment, the authorization duration may be used to set a specific time range for authorized use of a data element, specifically describing the usage duration of the data element.

[0054] In one embodiment, a digital signature may be generated based on the data elements included in the encrypted data packet, and before using the data elements included in the encrypted data packet, the digital signature may be used to verify the data elements included in the encrypted data packet through the SDK tool. For example, the integrity of the data elements included in the encrypted data packet may be verified using the digital signature through the SDK tool.

[0055] In one embodiment, the usage type can be used to describe some restrictive conditions for the use of data elements. When the use of data elements meets the set restrictive conditions, the data elements are processed as set, for example, destroyed after a single use, destroyed after reaching the maximum number of uses, etc.

[0056] In one embodiment, the usage log can be used to record each operation performed on the encrypted data package through the SDK tool during the use of the data element. For example, the SDK tool can write back the current operation (e.g., plaintext reading, ciphertext reading, verification, etc.) and usage environment information on the encrypted data package to the usage log in the encrypted data package, so as to conduct a post-event traceability audit on the use of the encrypted data package.

[0057] Step 204, according to the encrypted data packet, specify the SKD tool that uses the encrypted data packet.

[0058] In one embodiment, the data element platform can integrate SDK tools (for example, Flink Connector, Spark Connector, etc.) that are compatible with relevant big data frameworks based on mainstream big data development platforms; and specify the SKD tool that uses the encrypted data package based on the encrypted data package, so that data users can directly use the encrypted data package based on the SKD tool that specifies the use of the encrypted data package, thereby reducing the intermediate process from the encrypted data package to the use of data elements.

[0059] In one embodiment, the data element platform can specify an SDK tool for using the encrypted data package according to the encrypted data package and notify the data user. The data element platform can specify a dedicated SDK tool for using the encrypted data package and notify the data user in the form of information; the data user downloads the dedicated SDK tool for using the encrypted data package from the data element platform or other platforms on the network according to the information, so that after receiving the encrypted data package, the encrypted data package can be used according to the dedicated SDK tool for using the encrypted data package.

[0060] Step 205: Send the encrypted data package to the data user, so that the data user uses the encrypted data package according to the SDK tool specified to use the encrypted data package.

[0061] In one embodiment, the data element platform can send the encrypted data package and the designated SDK tool for using the encrypted data package to the data user, so that the data user can use the encrypted data package according to the designated SDK tool for using the encrypted data package. The data user can specify a dedicated SDK tool for using the encrypted data package through the data element platform to read and use the encrypted data package.

[0062] In one embodiment, the data element platform may send the encrypted data package and the SKD tool to the data user, so that the data user can use the encrypted data package in an online mode according to the SKD tool.

[0063] In one embodiment, the data element platform can send the encrypted data package and the SKD tool to the data user; when the data user uses the encrypted data package according to the SKD tool, an online mode is adopted to establish a heartbeat connection between the SDK tool and the data element platform, and the key of the encrypted data package is sent to the SDK tool, so that the SDK tool uses the key to unpack the encrypted data package and transmit data. During the heartbeat connection between the SDK tool and the data element platform, the use of the encrypted data package can be continuously and dynamically monitored.

[0064] In one embodiment, the data element platform may send the encrypted data package and the SKD tool to the data user, so that the data user can use the encrypted data package in an offline mode according to the SKD tool.

[0065] In one embodiment, the data element platform can send the encrypted data package, the SKD tool, and the key of the encrypted data package to the data user. When the data user uses the encrypted data package according to the SKD tool, the offline mode is adopted, and the offline key is directly loaded through the SDK tool according to the key sent by the data element platform to decrypt the encrypted data package, and the data elements of the encrypted data package are used through the SDK tool.

[0066] Step 206: manage the use of the encrypted data package by the data user through the SDK tool according to the authorization information of the encrypted data package.

[0067] In one embodiment, the data element platform may authorize and / or record the use of the encrypted data package by the data user through the SKD tool based on the authorization information of the encrypted data package.

[0068] In one embodiment, the data element platform can manage the use of the encrypted data package by the data user through the SDK tool based on one or more of the authorized subject, authorization purpose, authorization environment, authorization duration, digital signature, usage type, and usage log of the authorization information, so that the data elements of the encrypted data package can be effectively supervised and protected through the SDK tool throughout the entire process of the data user using the encrypted data package.

[0069] In one embodiment, when a data user uses a data element of an encrypted data package through an SDK tool, the SDK tool can be used to obtain in real time the user's unique identification, purpose of use, use environment, duration of use, and number of times of use of the data element of the encrypted data package when the data user uses the data element of the encrypted data package through the SDK tool; the SDK tool can verify the data element of the encrypted data package according to the digital signature of the authorization information of the encrypted data package; the SDK tool can record various operations of the data user when using the data element of the encrypted data package through the SDK tool according to the usage log of the authorization information of the encrypted data package, record the verification results of the verification of the data element of the encrypted data package, and record the user's unique identification, purpose of use, use environment, duration of use, and number of times of use of the data element of the encrypted data package when the data user uses the data element of the encrypted data package through the SDK tool. By recording the usage log of the authorization information of the encrypted data package, it is possible to conduct a post-tracing audit on the use of the data element of the encrypted data package and track the operation behavior of the entire process of using the data element of the encrypted data package.

[0070] In one embodiment, when a data user uses data elements of an encrypted data packet through an SDK tool, the SDK tool can verify the data elements of the encrypted data packet based on the digital signature of the authorization information; if the verification of the data elements of the encrypted data packet fails, the data user is prohibited from being authorized, and the data user is prohibited from using the data elements of the encrypted data packet; if the verification of the data elements of the encrypted data packet passes, the data user is authorized, and the data user is allowed to use the data elements of the encrypted data packet; the integrity and security of the data elements of the encrypted data packet can be guaranteed, so that complete and secure data elements can be provided to the data user, ensuring the security of the data user's use of the data elements.

[0071] In one embodiment, the data element platform may, based on the authorization subject of the encrypted data package authorization information, match the data user's user unique identifier with the user unique identifier of the authorization subject through the SDK tool when the data user uses the data elements of the encrypted data package through the SDK tool; if the data user's user unique identifier does not match the user unique identifier of the authorization subject, the SDK tool may prohibit the data user from being authorized and prohibiting the data user from using the data elements of the encrypted data package; if the data user's user unique identifier matches the user unique identifier of the authorization subject, the SDK tool may authorize the data user and allow the data user to use the data elements of the encrypted data package.

[0072] In one embodiment, the data element platform may, based on the authorization purpose of the encrypted data package authorization information, match the data element usage purpose of the data element of the encrypted data package by the data user through the SDK tool with the authorization purpose of the encrypted data package authorization information when the data user uses the data element of the encrypted data package through the SDK tool; if the data user's usage purpose does not match the authorization purpose of the encrypted data package authorization information, the SDK tool prohibits the data user from being authorized and prohibits the data user from using the data element of the encrypted data package; if the data user's usage purpose matches the authorization purpose of the encrypted data package authorization information, the SDK tool authorizes the data user and allows the data user to use the data element of the encrypted data package.

[0073] In one embodiment, the data element platform may match the usage environment of the data user when using the data elements of the encrypted data package through the SDK tool with the authorization environment of the encrypted data package authorization information when the data user uses the data elements of the encrypted data package through the SDK tool, based on the authorization environment of the encrypted data package authorization information; if the usage environment of the data user does not match the authorization environment of the encrypted data package authorization information, the SDK tool may be used to prohibit the data user from being authorized, prohibit the data user from using the data elements of the encrypted data package, and forcibly disconnect the data user from using the data elements of the encrypted data package; if the usage environment of the data user matches the authorization environment of the encrypted data package authorization information, the SDK tool may be used to authorize the data user and allow the data user to use the data elements of the encrypted data package.

[0074] In one embodiment, when the usage environment of the data user when using the data elements of the encrypted data package through the SDK tool is matched with the authorization environment of the encrypted data package authorization information, if the host IP segment, host MAC address, host user name, data development component, and data development component version of the data user are different from one or more of the host IP segment, host MAC address, host user name, data development component, and data development component version of the authorization environment of the encrypted data package authorization information, it can be determined that the usage environment of the data user does not match the authorization environment of the encrypted data package authorization information; if the host IP segment, host MAC address, host user name, data development component, and data development component version of the data user are all the same as the host IP segment, host MAC address, host user name, data development component, and data development component version of the authorization environment of the encrypted data package authorization information, it can be determined that the usage environment of the data user matches the authorization environment of the encrypted data package authorization information.

[0075] In one embodiment, the data element platform may compare the usage time of the data elements of the encrypted data package by the data user through the SDK tool with the usage time of the authorization information of the encrypted data package when the data user uses the data elements of the encrypted data package through the SDK tool and the usage time of the authorization information of the encrypted data package; if the usage time of the data elements of the encrypted data package by the data user is greater than or equal to the usage time of the authorization information of the encrypted data package, the SDK tool is used to prohibit the data user from being authorized, prohibit the data user from using the data elements of the encrypted data package, and destroy the data elements of the encrypted data package; if the usage time of the data elements of the encrypted data package by the data user is less than the usage time of the authorization information of the encrypted data package, the SDK tool is used to authorize the data user and allow the data user to use the data elements of the encrypted data package. The SDK tool is used to compare the usage duration of the data elements of the encrypted data package by the data user with the usage duration of the authorization information of the encrypted data package. The SDK tool is used to resist the use of the data elements of the encrypted data package by the data user by adjusting the system time offline. The SDK tool is used to record the usage duration of each use of the data elements of the encrypted data package. Once the total usage duration of the data elements of the encrypted data package exceeds the specified time range (the authorization duration of the authorization information), the SDK tool is used to forcibly disconnect the use of the data elements of the encrypted data package.

[0076] In one embodiment, the data element platform may match the number of times the data user uses the data element of the encrypted data package through the SDK tool with the usage type of the encrypted data package authorization information when the data user uses the data element of the encrypted data package through the SDK tool; if the number of times the data user uses the data element of the encrypted data package and the usage type of the encrypted data package authorization information match (i.e., the number of times the data user uses the data element of the encrypted data package is greater than or equal to the number of times set in the usage type of the encrypted data package authorization information), the SDK tool prohibits the data user from being authorized, prohibits the data user from using the data element of the encrypted data package, and destroys the data element of the encrypted data package; if the number of times the data user uses the data element of the encrypted data package and the usage type of the encrypted data package authorization information do not match (i.e., the number of times the data user uses the data element of the encrypted data package is less than the number of times set in the usage type of the encrypted data package authorization information), the SDK tool authorizes the data user and allows the data user to use the data element of the encrypted data package.

[0077] Figure 3 It is a flow chart of the data element management method in a specific application scenario shown in an embodiment of the present application.

[0078] like Figure 3 As shown, the bank (data user) submits a data acquisition request to the data element platform, applying for the use of 5G signaling location data in the first quarter of 2024 for joint modeling in the bank's intranet production environment. The modeling tools used are Flink and Spark, and the data usage time range is from April to June 2024.

[0079] The data element platform reviews the data acquisition request submitted by the bank. After the data acquisition request is reviewed and approved, the data acquisition request is forwarded to the operator (data provider). The operator reviews the data acquisition request. After the data acquisition request is reviewed and approved, the operator collects the 5G signaling location data corresponding to the data acquisition request from the designated data source according to the data acquisition request, and sends the 5G signaling location data to the data element platform.

[0080] The data element platform receives the 5G signaling location data corresponding to the data acquisition request sent by the operator, encrypts and packages the 5G signaling location data, generates an encrypted data packet including authorization information and 5G signaling location data, compresses the encrypted data packet, obtains the compressed encrypted data packet, records the encryption key, and pushes the encrypted data packet to the data storage interface designated by the bank.

[0081] The bank obtains the offline key file (key) from the data element platform, downloads the specified Flink Connector dependency package (SDK tool), and uses the encrypted data package in the Flink environment.

[0082] In May 2024, due to adjustments to the bank's business, its production environment needed to be closed and transformed. During this period, the 5G signaling location data of the encrypted data packet was temporarily transferred to its backup environment for use. Due to the change in the usage environment, the SDK tool refused to perform decryption of the encrypted data packet, effectively preventing the unauthorized use of the 5G signaling location data. After the production environment was restored, the SDK tool decrypted the encrypted data packet normally in the authorized usage environment.

[0083] On July 1, 2024, the authorization period of 5G signaling location data will end. Banks will no longer be able to use encrypted data packets through the SDK tool and will have to destroy the encrypted data packets in a timely manner through the SDK tool.

[0084] The data element management method of the embodiment of the present application obtains the data elements corresponding to the data acquisition request according to the data acquisition request; encrypts and packages the data elements to generate an encrypted data packet including the data elements and authorization information; specifies the SKD tool for using the encrypted data packet according to the encrypted data packet; sends the encrypted data packet and the SKD tool to the data user so that the data user uses the encrypted data packet according to the SKD tool; authorizes and / or records the use of the encrypted data packet by the data user through the SKD tool according to the authorization information; combines the SDK tool with the data packet to ensure that the data elements of the encrypted data packet are limited in scope of use according to the authorization information of the encrypted data packet during the entire process of use, ensures that the data elements of the encrypted data packet are subject to authorization checks during the entire process of use, effectively protects the data elements of the encrypted data packet from unauthorized use, and avoids the problem that the data authorization method of the related technology cannot timely block the unauthorized use of data elements and cannot track the compliance of the operation behavior during the use of data elements; can effectively supervise and protect the data elements of the encrypted data packet during the entire process of use to ensure the safe use of the data elements.

[0085] Furthermore, the data element management method of the embodiment of the present application encrypts and packages the data elements to generate an encrypted data package including the data elements and authorization information; wherein the authorization information includes one or more of the authorized subject, the authorization purpose, the authorization environment, the authorization duration, the digital signature, the usage type, and the usage log; based on the authorization information, the use of the encrypted data package by the data user is authorized and / or recorded through the SKD tool; by defining the data format of the encrypted data package authorization information, it is possible to comprehensively and completely describe the usage scenarios of the data elements, facilitate accurate judgment of the usage environment and usage scope of the data elements through the SDK tool, limit the specific environment for using the data elements of the encrypted data package, ensure that the data elements of the encrypted data package limit their usage scope according to the authorization information of the encrypted data package during the entire use process, ensure that the data elements of the encrypted data package have authorization checks during the entire use process, can timely block unauthorized use of the data elements of the encrypted data package, track the operation of the data elements of the encrypted data package during the entire use process, eliminate the security risks of the data elements of the encrypted data package during the entire use process, and effectively supervise and protect the data elements during the entire use process of the data elements of the encrypted data package to ensure the safe use of the data elements.

[0086] Furthermore, the data element management method of the embodiment of the present application sends the encrypted data package and the SKD tool to the data user so that the data user uses the encrypted data package in an online mode according to the SKD tool; or sends the encrypted data package and the SKD tool to the data user so that the data user uses the encrypted data package in an offline mode according to the SKD tool; and can use the encrypted data package in an online mode or an offline mode through the SDK tool according to different data security levels to meet the needs of the data user to use the data elements of the encrypted data package in internal and external network environments, and when the security level requirements for the data elements of the encrypted data package are high, it can force the data user to use the data elements with a high security level in an online mode.

[0087] Corresponding to the aforementioned application function implementation method embodiment, the present application also provides a data element management device, a data element platform and corresponding embodiments.

[0088] Figure 4 It is a structural diagram of the data element management device shown in an embodiment of the present application.

[0089] See also Figure 4 , a data element management device, including an acquisition module 401, a packaging module 402, a sending and receiving module 403, and a management module 404.

[0090] The acquisition module 401 is used to acquire data elements corresponding to the data acquisition request according to the data acquisition request.

[0091] In one embodiment, the acquisition module 401 may retrieve the data elements provided by all data providers according to the data acquisition request sent by the data user, and acquire the data elements corresponding to the data acquisition request.

[0092] The packaging module 402 is used to package the data elements obtained by the obtaining module 401 to generate a data packet including the data elements and authorization information.

[0093] In one embodiment, the packaging module 402 may package the data elements corresponding to the data acquisition request acquired by the acquisition module 401 to generate a data packet including the data elements and authorization information. The authorization information may include the authorized subject (data user) authorized to use the data elements, the authorization environment, the authorization duration, etc.

[0094] The transceiver module 403 is used to send the data packet generated by the packaging module 402 to the data user, so that the data user uses the data packet according to the SKD tool.

[0095] In one embodiment, the transceiver module 403 can send the data packet including data elements and authorization information generated by the packaging module 402 to the data user; the data user receives the data packet including data elements and authorization information, and reads and uses the data elements of the data packet through the SKD tool.

[0096] The management module 404 is used to manage the use of the data package by the data user through the SKD tool according to the authorization information.

[0097] In one embodiment, during the process in which the data user reads and uses the data elements of the data packet sent by the transceiver module 403 through the SKD tool, the management module 404 can authorize, monitor, and record the data user's operations such as reading and using the data packet through the SKD tool.

[0098] In one embodiment, during the process of a data user reading and using data elements of a data packet through a SKD tool, if the data user's use of the data packet through the SKD tool complies with the authorization information, the management module 404 authorizes the data user to use the data packet through the SKD tool through the SKD tool, and monitors and records in real time the data user's reading, use, and other operations of the data packet through the SKD tool through the SKD tool; if the data user's use of the data packet through the SKD tool does not comply with the authorization information, the management module 404 prohibits the data user from using the data packet.

[0099] The technical solution of the embodiment of the present application obtains data elements corresponding to the data acquisition request according to the data acquisition request; packages the data elements to generate a data packet including the data elements and authorization information; sends the data packet to the data user so that the data user uses the data packet according to the SKD tool; manages the use of the data packet by the data user through the SKD tool according to the authorization information; combines the SDK tool with the data packet to ensure that the scope of use of the data elements is limited according to the authorization information of the data packet during use, thereby avoiding the problem that the relevant technical data authorization method cannot timely block the unauthorized use of data elements and cannot track the compliance of the operation behavior during the use of data elements; it can effectively supervise and protect the data elements during the use of the data elements to ensure the safe use of the data elements.

[0100] Figure 5 It is another structural diagram of the data element management device shown in an embodiment of the present application.

[0101] See also Figure 5 , a data element management device, including an acquisition module 401, a packaging module 402, a sending and receiving module 403, a management module 404, and a designation module 501.

[0102] The acquisition module 401 is used to acquire data elements corresponding to the target data description information and / or the target data use authorization application information according to the target data description information and / or the target data use authorization application information of the data acquisition request.

[0103] The packaging module 402 is used to encrypt and package the data elements obtained by the acquisition module 401 to generate an encrypted data packet including the data elements and authorization information; wherein the authorization information includes one or more of the authorization subject, authorization purpose, authorization environment, authorization duration, digital signature, usage type, and usage log.

[0104] The designation module 501 is used to designate the SKD tool that uses the encrypted data package according to the encrypted data package generated by the packaging module 402.

[0105] The transceiver module 403 is used to send the encrypted data packet generated by the packaging module 402 and the SKD tool specified by the specifying module 501 to the data user, so that the data user uses the encrypted data packet according to the SKD tool.

[0106] The management module 404 is used to authorize and / or record the use of the encrypted data package by the data user through the SKD tool according to the authorization information.

[0107] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated again here.

[0108] Figure 6 It is a structural diagram of the data element platform shown in an embodiment of the present application.

[0109] See also Figure 6 , the data element platform 1000 includes a memory 1010 and a processor 1020.

[0110] The processor 1020 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0111] The memory 1010 may include various types of storage units, such as system memory, read-only memory (ROM), and permanent storage devices. Among them, ROM can store static data or instructions required by the processor 1020 or other modules of the computer. The permanent storage device may be a readable and writable storage device. The permanent storage device may be a non-volatile storage device that does not lose the stored instructions and data even after the computer is powered off. In some embodiments, the permanent storage device uses a large-capacity storage device (such as a magnetic or optical disk, flash memory) as a permanent storage device. In some other embodiments, the permanent storage device may be a removable storage device (such as a floppy disk, optical drive). The system memory may be a readable and writable storage device or a volatile readable and writable storage device, such as a dynamic random access memory. The system memory may store some or all instructions and data required by the processor at run time. In addition, the memory 1010 may include any combination of computer-readable storage media, including various types of semiconductor storage chips (such as DRAM, SRAM, SDRAM, flash memory, programmable read-only memory), and disks and / or optical disks may also be used. In some embodiments, the memory 1010 may include a readable and / or writable removable storage device, such as a laser disc (CD), a read-only digital versatile disc (such as a DVD-ROM, a double-layer DVD-ROM), a read-only Blu-ray disc, an ultra-density optical disc, a flash memory card (such as an SD card, a mini SD card, a Micro-SD card, etc.), a magnetic floppy disk, etc. The computer-readable storage medium does not include carrier waves and transient electronic signals transmitted wirelessly or wired.

[0112] The memory 1010 stores executable codes, and when the executable codes are processed by the processor 1020 , the processor 1020 can execute part or all of the methods described above.

[0113] In addition, the method according to the present application may also be implemented as a computer program or a computer program product, which includes computer program code instructions for executing some or all of the steps in the above method of the present application.

[0114] Alternatively, the present application can also be implemented as a computer-readable storage medium (or non-transitory machine-readable storage medium or machine-readable storage medium) on which executable code (or computer program or computer instruction code) is stored. When the executable code (or computer program or computer instruction code) is executed by a processor of a data element platform (or electronic device, or server, etc.), the processor executes part or all of the steps of the above-mentioned method according to the present application.

[0115] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A data element management method, characterized in that: include: According to the data acquisition request, acquiring data elements corresponding to the data acquisition request; Packaging the data elements to generate a data packet including the data elements and authorization information; Sending the data packet to a data user so that the data user uses the data packet according to the SKD tool; Based on the authorization information, the use of the data package by the data user is managed through the SKD tool.

2. The method according to claim 1, characterized in that The step of packaging the data elements to generate a data packet including the data elements and authorization information includes: The data elements are encrypted and packaged to generate an encrypted data packet including the data elements and authorization information; wherein the authorization information includes one or more of the authorization subject, authorization purpose, authorization environment, authorization duration, digital signature, usage type, and usage log.

3. The method according to claim 2, characterized in that The managing the use of the data packet by the data user through the SKD tool according to the authorization information includes: Based on the authorization information, the SKD tool authorizes and / or records the use of the encrypted data package by the data user.

4. The method according to claim 2, characterized in that: The step of sending the data packet to a data user so that the data user uses the data packet according to a SKD tool includes: According to the encrypted data packet, specifying a SKD tool that uses the encrypted data packet; The encrypted data package and the SKD tool are sent to a data user, so that the data user uses the encrypted data package according to the SKD tool.

5. The method according to claim 4, characterized in that The step of sending the encrypted data packet and the SKD tool to a data user so that the data user uses the encrypted data packet according to the SKD tool includes: Sending the encrypted data package and the SKD tool to a data user, so that the data user uses the encrypted data package in an online mode according to the SKD tool; or The encrypted data package and the SKD tool are sent to a data user, so that the data user uses the encrypted data package in an offline mode according to the SKD tool.

6. The method according to claim 1, characterized in that The step of acquiring data elements corresponding to the data acquisition request according to the data acquisition request includes: According to the target data description information and / or the target data use authorization application information of the data acquisition request, data elements corresponding to the target data description information and / or the target data use authorization application information are acquired.

7. The method according to claim 2, characterized in that The identification information of the authorization environment includes one or more of a host IP segment, a host MAC address, a host user name, a data development component, and a data development component version.

8. A data element management device, characterized in that: include: An acquisition module, used to acquire data elements corresponding to the data acquisition request according to the data acquisition request; A packaging module, used to package the data elements acquired by the acquisition module to generate a data packet including the data elements and authorization information; A transceiver module, used for sending the data packet generated by the packaging module to a data user, so that the data user uses the data packet according to the SKD tool; A management module is used to manage the use of the data package by the data user through the SKD tool according to the authorization information.

9. A data element platform, characterized in that: include: processor; as well as A memory having executable codes stored thereon, which, when executed by the processor, causes the processor to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: An executable code is stored thereon, and when the executable code is executed by a processor, the processor is caused to execute the method according to any one of claims 1 to 7.

Images