Method, device and equipment for data exchange and storage medium

Abstract

The embodiment of the invention provides a data exchange method and device, equipment and a storage medium. The method described herein includes: initiating, by a service party, a first request to exchange target data between different platforms; acquiring a signature for exchanging target data; and controlling a target message for exchanging the target data to be generated based on the signature, the target message being provided to the auditing party so that the target message is transmitted or prevented from being transmitted based on an auditing result of the auditing party, and the auditing result being determined by the auditing party at least based on the signature included in the target message. Based on the mode, the embodiment of the invention can support on-demand exchange of specific types of data among different platforms.

Description

Technical Field

[0001] Various implementations of the present disclosure relate to the computer field, and more specifically, to a method, an apparatus, a device, and a computer storage medium for data exchange. Background Art

[0002] With the development of Internet technology, various Internet applications have become an important part of people's lives. Such applications will generate massive amounts of data every day, which brings about various data security issues such as data sovereignty protection. For example, some countries may prohibit certain types of user data from being sent to overseas servers.

[0003] However, in business scenarios, the exchange of certain specific data between different regions is necessary for business operations without violating relevant laws and regulations. Therefore, how to effectively manage the exchange of data between different regions has become a focus of attention. Summary of the invention

[0004] In a first aspect of the present disclosure, a data exchange method is provided. The method includes: a business party initiates a first request for exchanging target data between different platforms; obtains a signature for exchanging the target data; and controls a target message for exchanging the target data to be generated based on the signature, wherein the target message is provided to an audit party so that the target message is transmitted or blocked from being transmitted based on an audit result of the audit party, wherein the audit result is determined by the audit party based at least on the signature included in the target message.

[0005] In a second aspect of the present disclosure, a data exchange method is provided. The method includes: obtaining, by an auditing party, a target message for exchanging target data between different platforms; verifying a signature included in the message using key information associated with the target data; determining whether the target data is allowed to be exchanged based at least on a verification result of the signature; and transmitting the target message to the target platform if it is determined that the target data is allowed to be exchanged.

[0006] In a third aspect of the present disclosure, a device for data exchange is provided. The device includes: a request module configured to initiate a first request for exchanging target data between different platforms by a business party; a signature acquisition module configured to acquire a signature for exchanging the target data; and a control module configured to control a target message for exchanging the target data to be generated based on the signature, wherein the target message is provided to an auditing party so that the target message is transmitted or blocked from transmission based on an audit result of the auditing party, wherein the audit result is determined by the auditing party based at least on the signature included in the target message.

[0007] In a fourth aspect of the present disclosure, a device for data exchange is provided. The device includes: a message acquisition module configured to acquire a target message for exchanging target data between different platforms by an auditing party; a verification module configured to verify a signature included in the message using key information associated with the target data; a determination module configured to determine whether the target data is allowed to be exchanged based at least on a verification result of the signature; and a transmission module configured to transmit the target message to the target platform if it is determined that the target data is allowed to be exchanged.

[0008] In a fifth aspect of the present disclosure, an electronic device is provided, comprising: a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to the first aspect or the second aspect of the present disclosure.

[0009] In a sixth aspect of the present disclosure, a computer-readable storage medium is provided, on which one or more computer instructions are stored, wherein the one or more computer instructions are executed by a processor to implement the method according to the first aspect or the second aspect of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0011] Figure 1 A schematic block diagram of a data exchange system according to an embodiment of the present disclosure is shown;

[0012] FIG. 2A to FIG. 2B An example interface of data registration according to an embodiment of the present disclosure is shown;

[0013] Figure 3 An example audit process according to some embodiments of the present disclosure is shown;

[0014] Figure 4A and Figure 4B A flowchart illustrating an example process for data exchange according to some embodiments of the present disclosure;

[0015] Figure 5A and Figure 5B An example block diagram showing an apparatus for data exchange according to some embodiments of the present disclosure; and

[0016] Figure 6 A block diagram of an example device that may be used to implement embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0018] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0019] Herein, unless explicitly stated, executing a step “in response to A” does not mean executing the step immediately after “A” but may include one or more intermediate steps.

[0020] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0021] It is understandable that before using the technical solutions disclosed in the various embodiments of the present disclosure, the types, scopes of use, usage scenarios, etc. of the information involved in the present disclosure should be informed to relevant users and their authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations. The relevant users may include any type of right holders, such as individuals, enterprises, and groups.

[0022] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0023] The basic principles and several example implementations of the present disclosure are explained below with reference to the accompanying drawings.

[0024] The overall architecture of the data exchange system

[0025] According to an embodiment of the present disclosure, a data exchange system is provided. Figure 1 FIG. 1 is a schematic block diagram of a data exchange system 100 according to an embodiment of the present disclosure. As will be described in detail below, the data exchange system 100 exchanges data used in a target application from one platform to another platform.

[0026] In some embodiments, different platforms may include target application platforms governed by different countries or regions. Different platforms may be used to provide services related to the target application to users in different countries or regions; or different platforms may correspond to supporting different functions associated with the target application.

[0027] In some scenarios, some data needs to be exchanged between different platforms due to business implementation or data management needs. For example, it may be necessary to transfer specific data from a platform governed by a first region to a platform governed by another region.

[0028] The following will be combined Figure 1 The data exchange system 100 is shown to describe a process in which a business party 105 of a target application transmits target data associated with the target application.

[0029] As mentioned above, user data in target applications is usually not allowed to be exchanged across regions. However, in some business scenarios, some specific types of user data can be allowed to be exchanged across regions if they meet the compliance constraints of each region.

[0030] Taking the target application as a content sharing application as an example, for the creator-related data in the target application, such relevant data helps the creator to interact with more users in the target application. Under the premise of complying with the relevant regional compliance policies, the transmission of such creation-related data helps the creator to promote himself.

[0031] In addition, some target applications also need to be tested, so the relevant data of the test user may be transferred to another region to complete the test. Under the premise of complying with the compliance policies of the relevant regions, such data transfer of test users helps improve the stability of the application.

[0032] In addition, for data generated in a specific region, some compliance policies may only manage the data of users belonging to the specific region. However, the data of some users who do not belong to the specific region may also be retained in the platform within the specific region. Therefore, under the premise of complying with the relevant regional compliance policies, the data of such non-regional users also needs to be transmitted.

[0033] Therefore, in order to facilitate different business parties in the target application to apply for on-demand transmission of specific data, such as Figure 1 As shown, the business party 105 may, for example, first perform a registration regarding target data that needs to be exchanged.

[0034] like Figure 1As shown, the business party 105 may, for example, register the data to be exchanged with a registration center, such as a DECC (Data Exchange Control Center) 110 .

[0035] For example, the business party 105 may submit a registration request for exchanging target data to the DECC 110 , and the DECC 110 may review such registration request. Figure 2A and Figure 2B An example registration interface according to some embodiments of the present disclosure is shown.

[0036] like Figure 2A As shown, the business party 105 can indicate the source of the data to be exchanged, for example, table 210, and description 220 of the data to be exchanged through the registration interface 200A. Additionally, the business party 105 can also specify a scenario 215 for data exchange through the registration interface 200A.

[0037] Exemplarily, such scenarios may include but are not limited to the scenarios mentioned above, namely, the creator scenario, the test user scenario, and the non-regional user scenario. The business party 105 may, for example, select the scenario involved in the currently registered data exchange from a set of preset scenarios.

[0038] Furthermore, if Figure 2B As shown, the business party 105 may further indicate detailed information of the data to be transmitted. Such detailed information may include, for example, a message structure of data exchange. For example, the data to be exchanged may include information according to the following example: Figure 2B , namely, data item “a”, data item “b”, data item “c”, and data item “d”.

[0039] In addition, such detailed information may also indicate a data identifier associated with the data to be exchanged. Figure 2B As shown, the data identification may include the field name 225 of each data item. Additionally, such detailed information may also include a description of each field.

[0040] Additionally, such detailed information may also include type information of each data item. Such type information may, for example, indicate what type of data each data item is. The business party 105 may, for example, specify a corresponding type from a set of preset types corresponding to the scenario. Figure 2B As an example, the user may indicate that the type of data item "b" is a user identification of a test user. For example, the identification may be "Test_account_uid" to indicate that the field is the account ID of the test account.

[0041] Further, the business party 105 may submit a registration request, for example, so that the registration request can indicate the Figure 2A and / or Figure 2B Various information discussed. Further, the registration request from the business party 105 can be approved offline, so that the approved data exchange request can be added as a whitelist. As an example, such offline approval can be based on the data management policy in the corresponding area.

[0042] In some embodiments, Figure 1 As shown, the registration information from DECC 110 can be synchronized to DRS (Data Registry Service) 115. It should be understood that DECC 110 and DRS 115 can be located in different VPCs (Application Virtual Private Data Centers). For example, DECC 110 can be located in VPC1 185, and DRS 115 can be located in VPC2 190. Different VPCs can correspond to data centers managed by different management parties.

[0043] In some embodiments, VPC2 190 may be managed by a TTP (Trusted Technology Partner), which may include any individual, enterprise, or organization that is technically trusted within a specific region (eg, a specific country or jurisdiction).

[0044] Continue to refer Figure 1 After completing the registration of the data to be exchanged, the business party 105 may initiate a first request to exchange the target data between different platforms. Figure 1 As shown, the business party 105 may, for example, request to implement the exchange of target data through different types of channels.

[0045] In some embodiments, the business party may, for example, utilize the DES-RPC channel 125 to implement the exchange of target data. Specifically, the business party 105 may send a data exchange request to the service manager 130. The service manager may, for example, include a management service (also referred to as source_of_truth_service) maintained by the TTP.

[0046] Further, the business party 105 may perform process 120. Specifically, when the business party 105 determines that the business party 105 allows the on-demand channel to be used to exchange target data, the service manager 130 may provide the business party 105 with a signature corresponding to the exchange target data, also known as a token.

[0047] Accordingly, after obtaining the corresponding signature, the business party may send a second request including the signature to the data management party. For example, the business party 105 may put the returned signature into the RPC Header, thereby requesting the TTP to obtain the data. Further, the TTP may put the signature into the header of the response message to the request, and the response may also include the target data to be exchanged.

[0048] Further, the business party 105 may transmit the response message to the audit party via DES-RPC 125. Figure 1 As shown, the auditing party may include, for example, a gateway located in VPC2 190, that is, DES-worker 150. DES-worker 150 may further audit whether the data included in the message is allowed to be exchanged, thereby determining whether to allow or block the transmission of the message.

[0049] In some embodiments, the business party 105 may also utilize other types of data channels, such as DES-MQ (Message Queue) or DES-HDFS (Hadoop Distributed File System) to exchange data.

[0050] As an example, Figure 1 As shown, the business party 105 may send the target message including the signature to the DES-Worker 150 via the DES-MQ 135. In the case of using the DES-MQ 135, the business party 105 may not be sensitive to the acquisition of the signature, for example.

[0051] As another example, Figure 1 As shown, the business party 105 can also perform process 140. Specifically, the business party 105 can obtain the offline Hive table provided by Source_of_truth_service, that is, the offline source data 160, which can include the meta information of the on-demand subject and the corresponding signature. Accordingly, the business party 105 can match the data that it needs to transmit with the original information to filter the data that can be transmitted and the corresponding signature. Accordingly, the target message containing the signature can be transmitted to the DES-Worker 150 via DES-Hive 145.

[0052] The following describes the process of DES-Worker 150 reviewing whether the target message is allowed to be transmitted.

[0053] In some embodiments, DES-Worker 150 may perform a real-time verification process on the target message. Figure 3 To describe the specific process of real-time verification. Figure 3 An example audit process 300 is shown in accordance with some embodiments of the present disclosure.

[0054] like Figure 3 As shown, in box 305, DES-Worker 150 can determine whether the scenario of data exchange matches the preset scenario, that is, determine whether the current data exchange is an on-demand channel. Further, after determining that the data exchange is an on-demand channel, DES-Worker 150 can determine whether a signature can be obtained, that is, whether the target message includes a signature. Accordingly, if a signature can be obtained, process 300 can proceed to box 315, that is, DES-worker 150 can obtain registration information associated with the business party requesting to exchange target data and use the registration information to parse traffic.

[0055] Specifically, as described above, during the registration process of the business party 105, it can indicate the message structure of data exchange, that is, the data organization method in the message used to exchange data. Figure 2B As an example, the message structure of the message may indicate that it includes four fields, and the order of the fields is field "a", field "b", field "c", and field "d". Such a message structure may also be stored by json_schema. In contrast, if the signature cannot be obtained in the message, the process 300 may proceed to block 340, i.e., the DES-worker 150 may prevent the transmission of the target message.

[0056] Further, at block 320, DES-worker 150 may perform a basic verification process and may remove the columns marked as needed. Specifically, DES-worker 150 may determine whether the target message to be transmitted matches the message structure indicated by the registration information. Such a match may, for example, indicate that the number of data items included in the target message is consistent with the number of data items indicated in the message structure.

[0057] In contrast, if the target message does not match the message structure indicated by the registration information, the DES-worker 150 may block the transmission of the target message.

[0058] Further, at block 325, DES-worker 150 may verify the signature included in the message using the key information associated with the target data. Specifically, DES-worker 150 may determine a data exchange scenario (e.g., a test user scenario) corresponding to the exchange target data, and may obtain a public key associated with the data exchange scenario as the key information.

[0059] Further, DES-worker 150 may determine whether the public key can be used to resolve the signature at block 330. If the public key cannot be used to resolve the signature, DES-worker 150 may determine that the signature verification has failed and may prevent transmission of the target message.

[0060] On the contrary, if the DES-worker 150 can parse the signature using the public key, it can obtain the parsing result of the signature, which can indicate the identification of the data item to be transmitted on demand, for example.

[0061] Further, in box 335, DES-worker 150 can determine whether the parsing result matches the target message. Specifically, the correct parsing result of the signature can indicate the first identification of the data item that is allowed to be transmitted. DES-worker 150 can determine whether the first identification indicated by the parsing result matches the second identification of the target data item in the target data, that is, whether the entity value (i.e., the identification indicated in the signature) is consistent with the column of the special mark (i.e., the second representation). In the case where the two match, process 300 can proceed to box 345, that is, DES-worker 150 can allow the transmission of the target data, so that the target message is transmitted to the target platform.

[0062] by Figure 2B As an example, the first identifier indicated by the signature is "b". Thus, if the identifier of the on-demand transmission data item in the target data is also "b", the target data is allowed to be exchanged. On the contrary, the DES-worker 150 can prevent the transmission of the target data.

[0063] In some embodiments, at block 350 , for each data transfer that occurs, the DES-worker 150 may also generate log information about the target data being exchanged, and may provide the log information for offline auditing of the exchanged target data.

[0064] like Figure 1 As shown, the DES-worker 150 can back up the actually transmitted traffic to generate record information 180.

[0065] In some embodiments, such record information may indicate at least one of the following: an exchange scenario for exchanging target data (e.g., a test user scenario, a creator scenario, a non-regional user scenario, etc.), an identifier of a data item in the target data (e.g., field "b"), a type of data item in the target data (e.g., Test_account_id), a time of exchanging the target data (e.g., a timestamp of data transmission), descriptive information about the data item's compliance with the exchange scenario (e.g., why the information belongs to Test_account_id), etc.

[0066] In some embodiments, Figure 1 As shown, such record information 180 can be provided for offline auditing of data exchange performed by the TTP. Specifically, the record information 180 can be stored in the DES-Hive 170. In addition, the data in the service metadata 155 from the VPC1 185 can be regularly migrated to the service metadata 165 maintained by the VPC2 190, so that the TTP can determine whether the transmitted subject information is consistent with the metadata maintained by the Source_of_truth_service based on the subject information about the actually transmitted data stored in the service metadata 165 and the DES-Hive 170.

[0067] Based on the data exchange system discussed above, the embodiments of the present disclosure can support business parties to implement on-demand data transmission across regions as needed, while ensuring data transmission compliance.

[0068] In addition, by having the business party perform on-demand transmission registration and the gateway perform signature (or token)-based auditing, the embodiments of the present disclosure can further ensure the compliance of data transmission.

[0069] Data exchange process

[0070] Figure 4A A flow chart of an example process 400A for data exchange according to some embodiments of the present disclosure is shown.

[0071] like Figure 4A As shown, in block 402 , a first request for exchanging target data between different platforms is initiated by a business party.

[0072] At block 404, a signature for exchanging target data is obtained.

[0073] In block 406, a target message for exchanging target data is controlled to be generated based on the signature, wherein the target message is provided to an auditor so that the target message is transmitted or blocked from transmission based on an audit result of the auditor, wherein the audit result is determined by the auditor based at least on the signature included in the target message.

[0074] In some embodiments, obtaining a signature for exchanging target data includes: registering the target data type to be exchanged between different platforms by a business direction registration center; and obtaining a signature generated by the registration center based on the registration result of the target data type.

[0075] In some embodiments, registering the target data type to be exchanged between different platforms by a business direction registration center includes: sending a data registration request by the business direction registration center, the data registration request indicating at least one of the following: a target scenario for data exchange, a message structure for data exchange, an identifier of at least one data item in the data to be exchanged, descriptive information of the data to be exchanged, and a type of at least one data item.

[0076] In some embodiments, the target scenario is selected from a set of preset scenarios that allow data exchange; or the message structure indicates how data is organized in a message used to exchange data; or the type of at least one data item is selected from a set of preset types corresponding to the target scenario.

[0077] In some embodiments, the process 400A further includes: when the data registration request is approved, the registration center generates registration information, wherein the registration information is provided for the auditor to determine the audit result of the target message.

[0078] In some embodiments, the first request further indicates a type of data channel used to exchange the target data.

[0079] In some embodiments, controlling the target message for exchanging target data to be generated based on the signature includes: sending, by the business party, a second request including the signature to the data manager to generate a message for exchanging target data, wherein the signature is included in a header of the message.

[0080] In some embodiments, the different platforms include target application platforms governed by different countries or regions.

[0081] Figure 4B A flow chart of an example process 400B for data exchange according to some embodiments of the present disclosure is shown.

[0082] like Figure 4B As shown, at block 412, a target message for exchanging target data between different platforms is obtained by an auditor.

[0083] At block 414, a signature included in the target message is verified using key information associated with the target data.

[0084] At block 416, based at least on the verification result of the signature, it is determined whether the target data is allowed to be exchanged.

[0085] At block 418, upon determining that the target data is allowed to be exchanged, the target message is caused to be transmitted to the target platform.

[0086] In some embodiments, verifying a signature included in a message using key information associated with target data includes: determining whether an exchange scenario of the target data matches a preset scenario; if the exchange scenario matches the preset scenario, determining whether a signature is included in the target message; if the target message includes a signature, verifying the signature included in the target message using key information associated with the target data.

[0087] In some embodiments, verifying a signature included in a target message using key information associated with the target data includes: obtaining registration information associated with a business party requesting to exchange the target data, the registration information at least indicating a message structure for data exchange, the message structure indicating how data in the target message used to exchange data is organized; determining whether the target message matches the message structure indicated by the registration information; and if the target message matches the message structure, verifying the signature included in the target message using the key information associated with the target data.

[0088] In some embodiments, the process 400B further includes: determining a data exchange scenario corresponding to the exchange target data; and obtaining a public key associated with the data exchange scenario as key information.

[0089] In some embodiments, verifying a signature included in a message using key information associated with target data includes: determining whether a public key can be used to parse the signature; and determining that signature verification has failed if the public key cannot be used to parse the signature.

[0090] In some embodiments, determining whether the target data is allowed to be exchanged based at least on the verification result of the signature includes: if the signature verification is successful, obtaining the parsing result of the signature; and determining whether the target data is allowed to be exchanged based on comparing the parsing result with the target message.

[0091] In some embodiments, the parsing result indicates a first data identifier of a data item allowed to be transmitted, and determining whether the target data is allowed to be exchanged based on a comparison of the parsing result with a message target message includes: determining whether the first data identifier indicated by the parsing result matches the second data identifier of the target data item in the target data in the message; and in response to the first data identifier matching the second data identifier, determining that the target data is allowed to be exchanged.

[0092] In some embodiments, the process 400B further includes: generating record information about the target data being exchanged; and providing the record information for offline review of the exchanged target data.

[0093] In some embodiments, the recorded information indicates at least one of the following: an exchange scenario for exchanging target data, an identification of a data item in the target data, a type of data item in the target data, a time of exchanging the target data, and descriptive information about whether the data item complies with the exchange scenario.

[0094] In some embodiments, registration information associated with the business party requesting the exchange of target data is also provided for offline review of the exchange target data.

[0095] Example devices and equipment

[0096] The embodiments of the present disclosure also provide corresponding devices for implementing the above methods or processes. Figure 5A An example block diagram of an apparatus 500A for data exchange according to some embodiments of the present disclosure is shown.

[0097] like Figure 5A As shown, the device 500A includes a request module 510, which is configured to initiate a first request for exchanging target data between different platforms by a business party; a signature acquisition module 520, which is configured to acquire a signature for exchanging the target data; and a control module 530, which is configured to control the generation of a target message for exchanging the target data based on the signature, wherein the target message is provided to an auditor so that the target message is transmitted or blocked from transmission based on an audit result of the auditor, wherein the audit result is determined by the auditor based at least on the signature included in the target message.

[0098] In some embodiments, the signature acquisition module 520 is further configured to: register the target data type to be exchanged between different platforms by the business direction registration center; and acquire the signature generated by the registration center based on the registration result of the target data type.

[0099] In some embodiments, the signature acquisition module 520 is also configured to: send a data registration request by the business direction registration center, and the data registration request indicates at least one of the following: send a data registration request by the business direction registration center, and the data registration request indicates at least one of the following: the target scenario of data exchange, the message structure of data exchange, the identification of at least one data item in the data to be exchanged, the description information of the data to be exchanged, and the type of at least one data item.

[0100] In some embodiments, the target scenario is selected from a set of preset scenarios that allow data exchange; or the message structure indicates how data is organized in a message used to exchange data; or the type of at least one data item is selected from a set of preset types corresponding to the target scenario.

[0101] In some embodiments, the apparatus 500A further comprises a generating module configured to: when the data registration request is approved, generate registration information by the registration center, wherein the registration information is provided for the auditor to determine the audit result of the target message.

[0102] In some embodiments, the first request further indicates a type of data channel used to exchange the target data.

[0103] In some embodiments, the control module 530 is further configured to: send a second request including a signature by the business party to the data manager, so that the data manager generates a message for exchanging target data, wherein the signature is included in a header of the message.

[0104] In some embodiments, the different platforms include target application platforms governed by different countries or regions.

[0105] Figure 5B An example block diagram of an apparatus 500B for data exchange according to some embodiments of the present disclosure is shown.

[0106] like Figure 5B As shown, the device 500 includes a message acquisition module 540, which is configured to acquire, by an auditor, a target message for exchanging target data between different platforms; a verification module 550, which is configured to verify a signature included in the target message using key information associated with the target data; a determination module 560, which is configured to determine whether the target data is allowed to be exchanged based at least on a verification result of the signature; and a transmission module 570, which is configured to transmit the target message to the target platform if it is determined that the target data is allowed to be exchanged.

[0107] In some embodiments, the verification module 550 is further configured to: determine whether the exchange scenario of the target data matches the preset scenario; if the exchange scenario matches the preset scenario, determine whether the target message includes a signature; if the target message includes a signature, verify the signature included in the target message using the key information associated with the target data.

[0108] In some embodiments, the verification module 550 is further configured to: obtain registration information associated with the business party requesting to exchange target data, the registration information at least indicating a message structure for data exchange, the message structure indicating how data is organized in messages used to exchange data; determine whether the target message matches the message structure indicated by the registration information; and if the target message matches the message structure, verify the signature included in the target message using key information associated with the target data.

[0109] In some embodiments, the apparatus 500 further includes a key acquisition module configured to: determine a data exchange scenario corresponding to the exchange target data; and acquire a public key associated with the data exchange scenario as key information.

[0110] In some embodiments, the verification module 550 is further configured to: determine whether the public key can be used to parse the signature; and determine that the signature verification has failed if the public key cannot be used to parse the signature.

[0111] In some embodiments, the determination module 560 is further configured to: if the signature verification is successful, obtain the parsing result of the signature; and determine whether the target data is allowed to be exchanged based on the comparison between the parsing result and the target message.

[0112] In some embodiments, the parsing result indicates a first data identifier of a data item allowed to be transmitted, and the determination module 560 is also configured to: determine whether the first data identifier indicated by the parsing result matches the second data identifier of the target data item in the target data in the message; and in response to the first data identifier matching the second data identifier, determine that the target data is allowed to be exchanged.

[0113] In some embodiments, the apparatus 500B further comprises an offline audit module configured to: generate record information about the target data being exchanged; and provide the record information for offline auditing of the exchanged target data.

[0114] In some embodiments, the recorded information indicates at least one of the following: an exchange scenario for exchanging target data, an identification of a data item in the target data, a type of data item in the target data, a time of exchanging the target data, and descriptive information about whether the data item complies with the exchange scenario.

[0115] In some embodiments, registration information associated with the business party requesting the exchange of target data is also provided for offline review of the exchange target data.

[0116] Figure 6 A schematic block diagram of an example device 600 that can be used to implement an embodiment of the present disclosure is shown. For example, the system 100 and / or system 400 according to an embodiment of the present disclosure can be implemented by the device 600. As shown, the device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 602 or computer program instructions loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0117] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0118] The various processes and processing described above, such as process 400A and / or process 400B, may be performed by processing unit 601. For example, in some embodiments, 400A and / or process 400B may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by CPU 601, one or more actions of 400A and / or process 400B described above may be performed.

[0119] The present disclosure may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0120] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0121] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0122] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0123] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0124] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0125] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0126] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of a module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0127] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes are obvious to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A data exchange method, comprising: The business party initiates the first request to exchange target data between different platforms; Obtaining a signature for exchanging the target data; as well as Controlling a target message for exchanging the target data to be generated based on the signature, wherein the target message is provided to an auditor so that the target message is transmitted or blocked from transmission based on an audit result of the auditor, wherein the audit result is determined by the auditor based at least on the signature included in the target message.

2. The method according to claim 1, wherein obtaining a signature for exchanging the target data comprises: The business direction registration center registers the target data type to be exchanged between different platforms; as well as The signature generated by the registration center based on the registration result of the target data type is obtained.

3. The method according to claim 2, wherein registering, by the business direction registration center, the target data type to be exchanged between different platforms comprises: The business direction sends a data registration request to the registration center, and the data registration request indicates at least one of the following: a target scenario for data exchange, a message structure for data exchange, an identifier of at least one data item in the data to be exchanged, description information of the data to be exchanged, and a type of at least one data item.

4. The method according to claim 3, wherein: The target scene is selected from a set of preset scenes that allow data exchange; or The message structure indicates the way in which data is organized in a message used to exchange data; or The type of the at least one data item is selected from a group of preset types corresponding to the target scenario.

5. The method according to claim 3, further comprising: In the case that the data registration request is approved, the registration center generates registration information, wherein the registration information is provided for the auditor to determine the audit result of the target message. The method according to claim 1 , wherein the first request further indicates a type of a data channel used to exchange the target data.

7. The method of claim 1, wherein controlling a target message for exchanging the target data to be generated based on the signature comprises: The service provider sends a second request including the signature to the data management party to generate the message for exchanging the target data, wherein the signature is included in the header of the message. The method according to claim 1 , wherein the different platforms include target application platforms governed by different countries or regions.

9. A data exchange method, comprising: The auditing party obtains target messages for exchanging target data between different platforms; verifying a signature included in the target message using key information associated with the target data; Determining whether the target data is allowed to be exchanged based at least on the verification result of the signature; as well as When it is determined that the target data is allowed to be exchanged, the target message is transmitted to the target platform.

10. The method of claim 9, wherein verifying the signature included in the target message using key information associated with the target data comprises: Determining whether the exchange scenario of the target data matches a preset scenario; If the exchange scenario matches the preset scenario, determining whether the target message includes a signature; If the target message includes the signature, the signature included in the target message is verified using key information associated with the target data.

11. The method of claim 9, wherein verifying a signature included in the target message using key information associated with the target data comprises: Acquire registration information associated with a business party requesting to exchange the target data, wherein the registration information at least indicates a message structure for data exchange, and the message structure indicates a data organization method in a message for exchanging data; Determining whether the target message matches the message structure indicated by the registration information; as well as If the target message matches the message structure, the signature included in the target message is verified using the key information associated with the target data.

12. The method according to claim 9, further comprising: Determining a data exchange scenario corresponding to exchanging the target data; as well as A public key associated with the data exchange scenario is obtained as the key information.

13. The method of claim 12, wherein verifying a signature included in the target message using key information associated with the target data comprises: determining whether the public key can be used to parse the signature; as well as If the public key cannot be used to resolve the signature, it is determined that the signature verification has failed.

14. The method according to claim 13, wherein determining whether the target data is allowed to be exchanged based at least on the verification result of the signature comprises: If the signature verification is successful, obtain the parsing result of the signature; as well as Based on the comparison between the parsing result and the target message, it is determined whether the target data is allowed to be exchanged.

15. The method according to claim 14, wherein the parsing result indicates a first identification of a data item that is allowed to be transmitted, and determining whether the target data is allowed to be exchanged based on a comparison between the parsing result and the target message comprises: Determining whether the first identifier indicated by the parsing result matches a second identifier of a target data item in the target data; as well as In response to the first identifier matching the second identifier, it is determined that the target data is allowed to be exchanged.

16. The method according to claim 9, further comprising: generating record information about the target data being exchanged; as well as The record information is provided for offline review of the exchange of the target data.

17. The method according to claim 16, wherein the record information indicates at least one of the following: An exchange scenario for exchanging the target data, an identifier of a data item in the target data, a type of a data item in the target data, a time for exchanging the target data, and descriptive information about whether the data item complies with the exchange scenario.

18. The method of claim 16, wherein registration information associated with a business party requesting the exchange of the target data is also provided for the offline review of the exchange of the target data.

19. A device for data exchange, comprising: A request module, configured to initiate a first request by a business party to exchange target data between different platforms; A signature acquisition module, configured to acquire a signature for exchanging the target data; as well as A control module is configured to control a target message for exchanging the target data to be generated based on the signature, wherein the target message is provided to an auditor so that the target message is transmitted or blocked from transmission based on an audit result of the auditor, wherein the audit result is determined by the auditor based on at least the signature included in the target message.

20. A device for data exchange, comprising: A message acquisition module, configured to acquire, by the auditing party, a target message for exchanging target data between different platforms; a verification module configured to verify a signature included in the target message using key information associated with the target data; a determination module, configured to determine whether the target data is allowed to be exchanged based at least on the verification result of the signature; as well as The transmission module is configured to transmit the target message to the target platform when it is determined that the target data is allowed to be exchanged.

21. An electronic device comprising: Memory and processor; The memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to any one of claims 1 to 8 or 9 to 18.

22. A computer-readable storage medium having one or more computer instructions stored thereon, wherein the one or more computer instructions are executed by a processor to implement the method according to any one of claims 1 to 8 or 9 to 18.

Images