Endogenous security government affair data sharing method based on digital object architecture

Abstract

The invention relates to the technical field of data sharing, and discloses an endogenous security government affair data sharing method based on a digital object architecture. Government affair data, metadata, computing resources and an access mechanism are packaged into a standardized data container, a multi-level government affair data space is constructed, and a collaborative architecture of cloud centralized management and control and edge node autonomous operation is achieved. Based on a digital object architecture, a unique identification code is allocated to each data resource, and accurate positioning and efficient access of data are realized through an identification analysis system. A dynamic heterogeneous redundant architecture and a mimicry judgment mechanism are adopted, potential attack risks are restrained from the bottom layer, and data sharing safety is guaranteed. And in combination with a block chain technology, the traceability and non-tampering property of the service directory and the data calling information are ensured. According to the method, the principle of'availability but not availability 'of data is considered, the efficiency, safety and supervision transparency of cross-department and cross-regional government affair data sharing are improved, and the method has important application value.

Description

Technical Field

[0001] The present invention relates to the technical field of data sharing, and in particular to an intrinsically secure government data sharing method based on a digital object architecture. Background Art

[0002] With the rapid development of big data and "Internet +", government data, as an important basic strategic resource of the country, has an increasingly urgent need to be shared and opened. However, the current government data sharing faces many challenges: first, inconsistent data standards make it difficult for data to be interoperable; second, the lack of unified identification makes it difficult to accurately locate data and access it efficiently; third, weak security control, the risk of data leakage and tampering; fourth, difficult regulatory traceability, and opaque data use process.

[0003] Traditional government data sharing methods are mainly achieved by establishing large-scale data exchange platforms or data middle platforms. This method not only requires a large amount of data migration, increasing system complexity, but also has security risks and is difficult to meet the security requirements of "available but not accessible" data. In addition, most existing methods use "after-the-fact remediation" security measures, such as firewalls, VPNs and other plug-in security products, which cannot fundamentally solve security problems.

[0004] Therefore, there is an urgent need for a new government data sharing method that can achieve efficient sharing and utilization of government data across domains and systems while ensuring data security. Summary of the invention

[0005] The purpose of the present invention is to provide an intrinsically secure government data sharing method based on a digital object architecture to solve the problems of inconsistent data standards, lack of unified identification, security vulnerabilities, etc. in existing government data sharing, and to achieve the discoverability, accessibility, interoperability and traceability of government data.

[0006] To achieve the above-mentioned purpose, the present invention provides an intrinsically secure government data sharing method based on a digital object architecture, comprising:

[0007] Encapsulate open or authorized government data, metadata, computing resources, and data access mechanisms into standardized data containers, deploy them on edge nodes of existing government information systems, and form a multi-level government data space through containerized orchestration to achieve a collaborative operation architecture of centralized cloud control and autonomous edge node operation.

[0008] Based on the digital object architecture, the government data in the container is abstracted into digital objects, and each digital object is assigned a unique digital object identification code. The digital object and its description information are registered in the digital object registration system, and stored and maintained in the digital object warehouse system. The identification code is resolved to the data entity through the collaboration of the local identification registration and resolution system and the global identification registration and resolution system, where the access address of the global identification registration and resolution system is globally known and remains unchanged.

[0009] Through the digital object identification and resolution system, the digital object interface protocol and the identification and resolution protocol are coordinated to achieve cross-domain digital object positioning, discovery, approval and access, and build a data directory based on metadata search and data tag network to provide search and identification capabilities for cross-departmental and cross-regional data calls;

[0010] Based on the dynamic heterogeneous redundant architecture, heterogeneous basic hardware, operating systems, and Web containers are run as multiple heterogeneous executors at the same time, and the output results of each executor are compared for consistency through the mimicry arbitration mechanism. If inconsistent output results are detected, the abnormal executor is offline based on the voting results, and the abnormal executor is automatically rotated and cleaned by restarting the virtual machine or replacing the container.

[0011] A service directory is built based on the digital object architecture, and the mapping information of the data container is stored through an inverted index mechanism. Blockchain technology is introduced to perform distributed storage and hash chain recording of the directory information to ensure that the creation, update, and access processes of the service directory are traceable and cannot be tampered with.

[0012] Furthermore, micro-isolation technology is used between the data containers, and the lateral flow between the data containers is limited through a dynamic authentication and authorization mechanism, and only one-way data flow from the system to the data container is allowed.

[0013] Furthermore, the government data encapsulated in the data container includes structured data, unstructured data and unstructured files, the metadata includes hierarchical classification, label characteristics and multi-angle description information of the data, the computing resources include computing modules for data processing and analysis, and the data access mechanism includes identity authentication, permission control and access auditing.

[0014] Furthermore, the digital object identification coding scheme is based on the Handle coding standard, including an identification prefix and an identification suffix, the identification coding prefix is ​​composed of a provincial code, a provincial / municipal department code, and a district / county code, and the identification coding suffix is ​​composed of a basic classification code, a data resource code, a table sequence code, and a primary key code.

[0015] Furthermore, the dynamic heterogeneous redundancy architecture includes three heterogeneous levels:

[0016] Hardware layer: A heterogeneous combination of x86, ARM, and RISC-V architecture processors;

[0017] System layer: deploy heterogeneous operating environments of CentOS, Windows Server, and Ubuntu operating systems;

[0018] Container layer: Configure the combined deployment of three web containers: Tomcat, Nginx, and Jetty.

[0019] Furthermore, the service directory adopts an inverted index mechanism to establish inverted index mappings for the data and metadata in the data container respectively, thereby achieving retrieval complexity that is independent of the size of the data set and lower time complexity. The blockchain technology adopts a consortium chain structure to automatically execute permission control and auditing of data sharing through smart contracts.

[0020] Furthermore, the global identification registration and resolution system adopts a dual-active node deployment architecture, realizes the global knowability of the access address through DNS load balancing technology, and the address record is solidified and stored in the blockchain; the service resolution of the global identification registration and resolution system adopts a three-level node step-by-step query mechanism:

[0021] Top-level node: receives resolution requests and routes them to the corresponding provincial-level nodes;

[0022] Provincial node: forwards the request to the district and county nodes after verifying the request authority;

[0023] District and county node: returns the physical address of the target data container.

[0024] Furthermore, the digital object interoperability is achieved through an open software architecture and standardized interoperability protocols, supporting the interconnection and interoperability of heterogeneous data at different locations.

[0025] Furthermore, the cross-departmental and cross-regional data interoperability is achieved through a digital object interface protocol, which specifically includes the steps of data calling, access approval and data transmission.

[0026] The beneficial effects of the present invention are:

[0027] The present invention effectively solves practical problems such as inconsistent data standards, missing identifiers, weak security control, and difficulty in tracing by introducing digital object architecture and endogenous security concepts into the government data sharing solution. The present invention adopts standardized data containers and multi-level government data spaces, taking into account centralized cloud control and autonomous operation of edge nodes, effectively improving the efficiency of data collaboration between departments and regions. Based on the digital object architecture, a unique identification code is assigned to each data resource. Combined with the local and global identification registration and analysis system, the target data can be accurately located and efficiently retrieved, improving the problems of low search efficiency and inconvenient access in the past. Through the dynamic heterogeneous redundancy (DHR) architecture and mimetic arbitration mechanism, potential attack risks are suppressed from the bottom layer, and the collaboration and consistency comparison of multiple heterogeneous executors are used to quickly identify and isolate abnormal executors, fundamentally strengthening the security control of data sharing. Blockchain technology is introduced in service directory management, and distributed storage and hash chain recording methods are used to ensure that directory or data call information is "traceable and cannot be tampered with", greatly improving regulatory transparency and facilitating legal and compliant audits. In addition, by building data containers and dynamic authentication and authorization mechanisms, sharing needs can be met without large amounts of data migration. While simplifying system construction and maintenance costs, it also takes into account the "available but not available" principle, thereby improving the practicality and security of data sharing.

[0028] The innovation of this invention lies in the effective combination of digital object architecture and intrinsic security technology, providing full-chain protection for government data from identification establishment to secure sharing. Without reducing sharing efficiency, it greatly improves the security and traceability of the system, and has important application value for cross-regional and cross-departmental linkage of government big data. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a flow chart of the method for sharing endogenous secure government affairs data based on digital object architecture of the present invention;

[0030] Figure 2 It is a schematic diagram of a digital object architecture of an intrinsically secure government data sharing method based on a digital object architecture of the present invention;

[0031] Figure 3 It is a schematic diagram of the government digital object identification coding prefix structure of the intrinsically secure government data sharing method based on the digital object architecture of the present invention;

[0032] Figure 4 It is a schematic diagram of the suffix structure of the government digital object identification code of the intrinsically secure government data sharing method based on the digital object architecture of the present invention;

[0033] Figure 5 It is a schematic diagram of a dynamic heterogeneous redundant architecture system model of an intrinsically secure government data sharing method based on a digital object architecture of the present invention;

[0034] Figure 6 It is a schematic diagram of the government data sharing process of the intrinsically secure government data sharing method based on the digital object architecture of the present invention. DETAILED DESCRIPTION

[0035] In order to better understand the technical solution, the method of the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0036] This embodiment provides an intrinsically secure government data sharing method based on a digital object architecture, which is used to solve the data sharing and circulation problems of inconsistent government data standards and lack of unified data identification, as well as data security issues such as backdoors and loopholes that may exist in government information systems. The current traditional data center model of government data governance cannot meet the needs. This embodiment is based on a digital object architecture and uses an intrinsically secure structure to solve government data security issues, which is suitable for secure and trusted sharing of government data.

[0037] like Figure 1 As shown, the steps of this embodiment include: first, data container, which forms a data container with the data to be opened, metadata, and access mechanism, and deploys it at the edge of the existing system; second, data space, which combines several data containers into a government data space for data sharing; third, government digital object architecture, which packages the data in the data container into a digital object based on the digital object architecture, and performs identification encoding; fourth, relying on the intrinsic security theory, by designing data sharing components that support the DHR architecture, the security and reliability of the data sharing process are guaranteed; fifth, the service directory, which uses the data object discovery capability of digital objects to ensure ease of use and efficiency in data sharing; sixth, data service, which uses the data interoperability capability of digital objects to parse the identification code into the desired data.

[0038] As the basic unit of the entire architecture, the data container refers to a virtualized unit that encapsulates open data, metadata, computing resources, and data access mechanisms. The first step in building a data container is to take inventory of data resources. In view of the characteristics of government data resources, such as large data volume, multiple data types, and outstanding data value, it is necessary to comprehensively sort out the data that can be used as resources. In reality, the construction of government informationization is built separately by various departments, and then integrated according to business needs in the later stage, which brings about problems such as data unavailability and data islands. Therefore, the first task is to understand the overall picture of departmental data resources and sort them out according to the principle of "whoever produces is responsible, whoever collects is responsible". Data resources can generally be divided into structured data, unstructured data, and unstructured files, and then the data is divided into general, important, and core data to prepare for further opening. It should also be made clear that data resource inventory is an ongoing and continuously optimized work, which requires the system platform to have the ability to dynamically update.

[0039] After the data resource inventory, we have learned about the data source of the government information system. Next, we need to manage the data source, which is an important part of converting data into data containers and lays the foundation for the creation of subsequent data services. Data source management supports various relational databases (MySql, Oracle, SqlServer, etc.) and non-relational databases (Mongo, ES, etc.), and provides the functions of adding, deleting, modifying and querying data sources, and synchronizing the library table field information of data sources. For example, for library table type data, users need to first add data sources through data source management. For audio, video, and text file type data, users need to first upload the files to the specified object storage system.

[0040] After the data source is determined, it is necessary to further collect metadata information of the data source. Metadata provides the functions of viewing metadata, editing data classification, searching metadata information, and adding metadata descriptions. After adding a data source, the system will automatically synchronize metadata information of this type of data, such as field name, field type, index, constraint, etc. Metadata can be further classified, layered, graded, and divided into label features of data objects to describe data information from multiple angles. Batch import of metadata information is supported.

[0041] After completing metadata collection, due to the sensitivity and privacy of government data, it is also necessary to audit the data to be opened. The contents that need to be audited include the integrity and accuracy of data resources, the effectiveness of data models, the rationality of data flows, the clarity of data ownership and access rights, and data compliance requirements and security. The integrity and accuracy of data resources ensure that the data resource inventory covers every data resource to prevent data protection loss caused by omissions; the effectiveness of data models, the data model should be able to accurately reflect the data structure and data flow; the rationality of data flows, clarifying the source, destination and use of data, helps to identify the value and potential risks of data resources; the clarity of data ownership and access rights ensures that the ownership of each data resource is clear; data compliance requirements and security, audit data resources to comply with relevant laws and regulations and compliance requirements, and evaluate the security performance of data resources.

[0042] After the above steps, a data container is finally formed. A data container contains open data, metadata, computing resources, and data access mechanisms. The data container is deployed at the edge of the government information system and has complete identity and access management. The data container and the government information system are one-way. Only the government information system is allowed to flow data to the data container. The data container cannot send any data or requests to the government information system, which effectively avoids north-south traffic attacks.

[0043] After building a single data container, several data containers together constitute the government data space, which becomes the basic environment for data sharing. In the government data space, micro-isolation technology is used between data containers. Access between data containers must be dynamically authenticated and authorized to limit the lateral flow of data or requests, which effectively avoids east-west traffic attacks.

[0044] In order to achieve standardized management and interoperability of data in the government data space, this embodiment introduces a digital object architecture, which is a data architecture built on top of a basic network with the main purpose of data system intercommunication and computing. Focusing on government data, this embodiment provides an implementation of a government digital object architecture. The architecture is a data-centric open software architecture that is a logical extension of the Internet architecture. It solves the needs of government information system management and achieves interoperability between participating government information systems. The digital object architecture abstracts data resources in the form of digital objects, and marks each digital object with an identifier to uniquely and persistently identify each digital object, ensuring the persistent referenceability of resources. A digital object is a bit sequence or a collection of a series of bit sequences. Digital objects are used to abstract Internet data so that heterogeneous data resources can be encapsulated and modeled in a unified form, thereby shielding the heterogeneity of data resources. Digital objects are assigned a unique identifier to uniquely and persistently identify each digital object, without changing due to changes in factors such as the storage location and access method of the digital object. As Figure 2 As shown in Figure 1, the digital object architecture includes two basic protocols, namely the Digital Object Identification / Resolution Protocol (DO-IRP) and the Digital Object Interface Protocol (DOIP), which are used to create, modify, delete and resolve digital objects. The digital object architecture includes three core components, namely the digital object identification and resolution system, the digital object warehouse system and the digital object registration system.

[0045] On the basis of establishing a digital object architecture, it is necessary to perform digital object identification encoding on government data. Based on the Handle encoding standard, the present invention provides an identification encoding scheme suitable for government data. The identification code is a unique and unchanging identifier of the data object, which consists of an identification prefix and an identification suffix. The identification prefix and the identification suffix are separated by the UTF-8 character " / ". Figure 3 As shown in the figure, the prefix of the government digital object identifier is composed of the provincial code, provincial / municipal department code, and district / county code, separated by the UTF-8 character ".". Figure 4As shown, the identification suffix is ​​composed of the basic classification code, data resource code, table sequence code and primary key code. The basic classification code consists of 5 digits and is classified according to the form of data resources. The code is divided into three levels and is used to identify data objects from the data resource form. The data resource code is used to identify the object of the data resource. The table sequence code and primary key code are composed of numbers of indefinite length and are both optional codes used to identify tables in the database.

[0046] This standardized identification and coding scheme is conducive to the sharing and exchange of heterogeneous data in different locations, and thus provides great help in eliminating the problems of data chimneys and data islands. The identification and coding scheme for government data is compatible with the mainstream identification and coding structure, specifications and standards, and provides a basis for addressing and resolution of identification resolution at all levels of nodes. The prefix code is based on segmentation and is combined with the administrative division code code, which is more conducive to hierarchical structural management of data resources from a geographical dimension.

[0047] After the identification encoding is completed, the digital object discovery function needs to be implemented. The digital object discovery method helps users or systems quickly find the required digital objects through specific mechanisms or tools. In the data interconnection and sharing network based on the digital object architecture, data providers characterize data resources based on usage scenarios in different regions or fields, encapsulate the data resources in their data platforms and systems into digital objects, obtain standardized identification from the identification resolution system as the unique identification of the digital object, register the description information as metadata to the registry system, store and manage digital objects in the digital object warehouse system, and thus realize the standardized encapsulation of data resources and make them discoverable, addressable, and usable. Based on digital object registration and collaborative metadata search, a data directory and data tag network are formed, which can realize cross-domain data resource discovery and identification, and also support precise search and fuzzy query of data objects.

[0048] Corresponding to digital object discovery is digital object resolution. The digital object identification resolution method accurately locates the required digital object by resolving the identifier of the digital object into a specific access address. The identification is used to uniquely and persistently identify each digital object. By resolving the identification of the digital object, the data corresponding to the digital object entity can be obtained to achieve access to cross-domain data resources. The digital object identification resolution system is one of the three basic components in the digital object architecture system, and is mainly responsible for the identification and resolution of digital objects. Data users use identification resolution technology through the identification network to address and access the required digital objects from massive digital resources. In the hierarchical identification network, users can accurately locate cross-domain data scattered in the Internet environment by searching for identifications layer by layer.

[0049] Ultimately, digital object interoperability is achieved, that is, independent systems or platforms can recognize, exchange and use each other's data objects, thereby achieving cross-system data sharing and business collaboration. The interoperability of data objects helps to achieve logical or physical connections between data objects, so that data can be interconnected and shared between different systems or platforms. The digital object architecture is essentially a system that is physically distributed in different locations. In order to achieve data sharing and exchange across organizations, fields, and systems, all data resources are established as independent digital objects, and data is defined through a basic model. This standardized processing enables data from different sources and formats to be managed and operated under a unified framework.

[0050] In the process of data sharing, security issues are particularly important. Traditional data security protection often adopts a superimposed security defense system. Whether it is blockchain, zero trust, encryption authentication and other engineering implementation technologies, they cannot avoid endogenous security issues. Compared with traditional data security, endogenous security, through the DHR architecture, can suppress data security, functional safety and information security issues that exist in the form of differential mode in the structure. Figure 5 As shown, in the DHR system model, the concept of data infrastructure can be large or small. It can be the entire government data space or a middleware in the data flow process. The IPO model of the DHR system is: Inputs->Agents->Processes->Decisions->Outputs, that is, input->agent->multiple executor processing->decision->output.

[0051] Based on the DHR architecture, this embodiment designs a data security sharing component. Attacks on data, vulnerability backdoors often hijack the communication process of the facility or directly control the facility, so the key point of the solution is to promptly discover the hijacked data elements and modified data packets, and rotate the malicious application. An equivalent heterogeneous data sharing component is an executor, which consists of heterogeneous basic hardware, heterogeneous operating systems and heterogeneous web containers. The hardware generally includes CPUs of architectures such as x86, ARM, and RISC-V. Heterogeneous operating systems can choose CentOS, Ubuntu, WindowsServer, etc., and can also adapt to the needs of domestic data infrastructure. This makes the instruction set architecture diversified, the operating system diversified, and the runtime diversified. The basic hardware and operating systems of different architectures from different manufacturers are used to achieve the heterogeneity of the data infrastructure. The heterogeneous web container includes deploying equivalent heterogeneous software on containers such as Tomcat, Nginx, and Jetty to achieve the heterogeneity of the web container. When there is a data access request, multiple equivalent heterogeneous executors are redundantly executed, and the arbitrator determines the consistency of the data returned by different executors, and the returned data is voted on by the arbitrator. For the return results of the heterogeneous executors that have passed the vote, the redundant execution status is recorded and the output data of the executors that have passed the vote is allowed, and the response is returned to the requesting end. For the heterogeneous executor requests that have not passed the vote, the corresponding heterogeneous executor application is blocked from accessing and modifying the persistent storage data, and the application status of the corresponding heterogeneous executor is reported, and the heterogeneous executor application is rotated. This method can effectively resist the attack of differential mode vulnerabilities.

[0052] After implementing the data security sharing component, in order to improve the convenience of data sharing, this embodiment constructs a government service directory. The service directory will display all digital objects in the government data space and the data services that can be provided. According to the digital object discovery capability, a standardized service list is formed, and different service views are formed according to different classifications to facilitate service queries. The service directory provides ordinary users with the functions of viewing the published service list at the node and across nodes / departments, as well as previewing data, displaying service details, applying for services, and evaluating services. The digital object retrieval of the service directory adopts the inverted index method, and the data and metadata in the data container are respectively mapped to inverted indexes. This can achieve retrieval complexity that is independent of the size of the data set and lower time complexity, which is crucial for the retrieval of massive government data.

[0053] To ensure the reliability of the service directory information, this embodiment also uses blockchain technology to ensure that the information of the service directory is traceable and cannot be tampered with. The service directory adds a new service directory and updates the status of the service directory in the blockchain system through the operations of chaining and service off-chaining. Each update of the service directory will be recorded on the blockchain to form a complete historical record chain. The hash value and continuous block number of the blockchain are used to ensure that the content of the service directory cannot be tampered with once it is on the chain. The hash value of each block depends on the hash value of the previous block, forming a chain structure. The hash value and continuous block number within the block ensure the non-tamperability of the service directory, and the distributed storage structure ensures that data is difficult to lose. The service directory data is stored on multiple nodes of the blockchain, and each node saves a complete copy of the data, which enhances the security and reliability of the data.

[0054] Based on the service directory, this embodiment further provides government data services. The data service has a DHR structure, is deployed on a cloud platform, and uses the ability of digital object resolution to resolve data into the data you want to obtain through identification coding. The identification resolution system includes a local identification registration and resolution system LRS and a global identification registration and resolution system GRS. GRS is a special identification resolution system, and the access address is globally known and unchanged. The digital object warehouse is responsible for encapsulating digital resources into digital objects and is responsible for the management of digital objects. The digital object obtains a unique identifier from the identification resolution system, and the metadata of the digital object is also registered in the digital object registry, which establishes a metadata index for it.

[0055] Through identity resolution, the status information of digital objects can be located in the hierarchical identity resolution system, and then the warehouse address of the digital object can be queried, and the digital object corresponding to the identity can be obtained by searching the warehouse. By searching keywords, data distributed in different node systems can be discovered based on metadata. Relying on an open software architecture and two basic standard protocols, it can achieve efficient connection of various data platforms and systems, and support the interconnection and interoperability of heterogeneous data in different hosts, locations, and structures.

[0056] Combining the above components, a complete government data sharing process is finally formed. The government data space is a system that is physically distributed in different locations. It is necessary to build several system nodes on the Internet and connect them based on standard protocols to form a networked software system to support data identification, parsing, search, discovery and use in the form of digital objects on the Internet. The components in data sharing use the DHR architecture to ensure the security of data sharing and circulation. The sharing process is as follows: Figure 6 shown.

[0057] Taking the cross-node data flow and sharing process as an example, assuming that the data provider and data user are located at the third-level node and the top-level node respectively, data provider a publishes the data service in system B (third-level node), and publishing the service will put the service on the chain. After being on the chain, data user b sees the service in the service directory in system A (top-level node) and applies for the service. System A will parse the prefix code of the node where the service is located and send a service application request to node B. After system B receives the service application request, data provider a needs to approve the request, and the approval result is approval or rejection. If rejected, the data sharing process ends. If the approval result is approval at this time, system B needs to parse the application node identification code to send the application approval result to system A, and the application approval will be on the chain. After seeing that it has been approved, data user b will subscribe to the service. System A sends a subscription request to system B again, and system B will return the subscription certificate and related parameters to system A. Finally, data user b gets the subscription-related information and can obtain the data. At the same time, our components use the DHR architecture, which can provide data security protection.

[0058] Through the above implementation methods, the present invention realizes an intrinsically secure government data sharing method based on a digital object architecture, solves problems such as inconsistent government data standards, lack of unified identification, security vulnerabilities, etc., and realizes the discoverability, accessibility, interoperability and traceability of government data.

Claims

1. A method for sharing endogenous secure government data based on a digital object architecture, characterized in that: include: Encapsulate open or authorized government data, metadata, computing resources, and data access mechanisms into standardized data containers, deploy them on edge nodes of existing government information systems, and form a multi-level government data space through containerized orchestration to achieve a collaborative operation architecture of centralized cloud control and autonomous edge node operation. Based on the digital object architecture, the government data in the container is abstracted into digital objects, and each digital object is assigned a unique digital object identification code. The digital object and its description information are registered in the digital object registration system, and stored and maintained in the digital object warehouse system. The identification code is resolved to the data entity through the collaboration of the local identification registration and resolution system and the global identification registration and resolution system, where the access address of the global identification registration and resolution system is globally known and remains unchanged. Through the digital object identification and resolution system, the digital object interface protocol and the identification and resolution protocol are coordinated to achieve cross-domain digital object positioning, discovery, approval and access, and build a data directory based on metadata search and data tag network to provide search and identification capabilities for cross-departmental and cross-regional data calls; Based on the dynamic heterogeneous redundant architecture, heterogeneous basic hardware, operating systems, and Web containers are run as multiple heterogeneous executors at the same time, and the output results of each executor are compared for consistency through the mimicry arbitration mechanism. If inconsistent output results are detected, the abnormal executor is offline based on the voting results, and the abnormal executor is automatically rotated and cleaned by restarting the virtual machine or replacing the container. A service directory is built based on the digital object architecture, and the mapping information of the data container is stored through an inverted index mechanism. Blockchain technology is introduced to perform distributed storage and hash chain recording of the directory information to ensure that the creation, update, and access processes of the service directory are traceable and cannot be tampered with.

2. According to claim 1, a method for sharing endogenous secure government data based on a digital object architecture is characterized by: Micro-isolation technology is used between the data containers, and the lateral flow between the data containers is limited through a dynamic authentication and authorization mechanism, and only one-way data flow from the system to the data container is allowed.

3. The method for sharing endogenous secure government data based on digital object architecture according to claim 1, characterized in that: The government data encapsulated in the data container includes structured data, unstructured data and unstructured files, the metadata includes hierarchical classification, label characteristics and multi-angle description information of the data, the computing resources include computing modules for data processing and analysis, and the data access mechanism includes identity authentication, permission control and access audit.

4. The method for sharing endogenous secure government data based on digital object architecture according to claim 1, characterized in that: The digital object identification coding scheme is based on the Handle coding standard, including an identification prefix and an identification suffix. The identification coding prefix is ​​composed of a provincial code, a provincial / municipal department code, and a district / county code. The identification coding suffix is ​​composed of a basic classification code, a data resource code, a table sequence code, and a primary key code.

5. The method for sharing endogenous secure government data based on digital object architecture according to claim 1 is characterized by: The dynamic heterogeneous redundancy architecture includes three heterogeneous levels: Hardware layer: A heterogeneous combination of x86, ARM, and RISC-V architecture processors; System layer: deploy heterogeneous operating environments of CentOS, Windows Server, and Ubuntu operating systems; Container layer: Configure the combined deployment of three web containers: Tomcat, Nginx, and Jetty.

6. The method for sharing endogenous secure government data based on digital object architecture according to claim 1, characterized in that: The service directory adopts an inverted index mechanism to establish inverted index mappings for the data and metadata in the data container, respectively, to achieve retrieval complexity and lower time complexity that is independent of the size of the data set. The blockchain technology adopts a consortium chain structure to automatically execute permission control and auditing of data sharing through smart contracts.

7. The method for sharing endogenous secure government data based on digital object architecture according to claim 4 is characterized by: The global identification registration and resolution system adopts a dual-active node deployment architecture, realizes the global knowability of the access address through DNS load balancing technology, and the address record is solidified and stored in the blockchain; the service resolution of the global identification registration and resolution system adopts a three-level node step-by-step query mechanism: Top-level node: receives resolution requests and routes them to the corresponding provincial-level nodes; Provincial node: forwards the request to the district and county nodes after verifying the request authority; District and county node: returns the physical address of the target data container.

8. The method for sharing endogenous secure government data based on digital object architecture according to claim 1, characterized in that: The digital object interoperability is achieved through an open software architecture and standardized interoperability protocols, supporting the interconnection and interoperability of heterogeneous data in different hosts, locations and structures.

9. The method for sharing endogenous secure government data based on digital object architecture according to claim 1, characterized in that: The cross-departmental and cross-regional data interoperability is achieved through the digital object interface protocol, which specifically includes the steps of data calling, access approval and data transmission.

Images