Data management method and device based on application and data decoupling

Abstract

The invention provides a data management method and device based on application and data decoupling, and relates to the technical field of data processing, the method comprises the following steps: sending a data object attribute query request to a data interoperation system based on a data query request sent by a data user through a client and a data object address; receiving the secret key information of the data user and the ownership information of the data object sent by the data interoperation system; based on the key information of the data user and the ownership information of the data object, performing authorization verification on the data user to obtain an authorization verification result; and managing the data of the data owner based on the authorization verification result and a data storage module in the data management system. Through interaction among the data management service, the data interoperation system and the data user, data interconnection and exchange after application and data decoupling are achieved, then data management is achieved, ownership and privacy security of the decoupled data is ensured, and data management efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a data management method and device based on decoupling of application and data. Background Art

[0002] With the continuous breakthroughs in computer technology and the advancement of informatization, data has become a key production factor and an important asset. At present, data is monopolized by application service providers. For example, application service providers such as Taobao and Weibo have a large amount of user data and can process user data to obtain benefits. Users as data owners do not have any benefits, which infringes on the rights of data owners to a certain extent. At the same time, data leakage incidents are frequent and harmful. Since application service providers collect and store a large amount of user data in a centralized manner, once user data is leaked, the harm and scope of impact will be immeasurable. In addition, the requirements of various countries for data security compliance are also greatly increased. Therefore, the decoupling of applications and data is an inevitable development trend of the Internet, aiming to break the monopoly of application service providers on data, so that data owners can control data independently. Application service providers no longer own all user data, but need to "use" data on demand under the premise of user authorization, and fully respect and protect data ownership.

[0003] After the decoupling of applications and data, the need for data management arises. When data is controlled only by applications, applications can use data directly without the need for data exchange and ownership protection. After data is decoupled from applications, it is stored and controlled by the respective data owners. However, data decoupling does not mean closed data storage. Data still needs to be exchanged and circulated, but some data is more important or sensitive. Therefore, how to protect the ownership and privacy security of important data during data exchange is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The present invention provides a data management method and device based on application and data decoupling, which are used to solve the problem of how to protect the ownership and privacy security of important data in data exchange.

[0005] The present invention provides a data management method based on decoupling of application and data, which is applied to data management services in a data management system. The method comprises: The data management service sends a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; The data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system; The data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails; The data management service manages the data owner's data based on the authorization verification result and a data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0006] According to a data management method based on application and data decoupling provided by the present invention, the data management service manages the data of the data owner based on the authorization verification result and the data storage module in the data management system, including: When the authorization verification result indicates that the data user authorization verification is successful, the data management service sends a data acquisition request to the data storage module; The data management service receives the data sent by the data storage module; The data management service sends the data to the client.

[0007] According to a data management method based on application and data decoupling provided by the present invention, the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result, including: The data management service determines, based on the ownership information of the data object, whether a data user with access rights indicated by the ownership information is the data user; When the ownership information indicates that the data user with access rights is the data user, the data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperability system, and obtains the authorization verification result.

[0008] According to a data management method based on application and data decoupling provided by the present invention, the data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperation system, and obtains the authorization verification result, including: The data management service matches the access rights of the data user when accessing the data with the access rights of the data object determined from the data interoperation system; The data management service determines that the authorization verification of the data user is successful if the access rights of the data user when accessing the data match the access rights of the data object determined from the data interoperation system; The data management service determines that the data user authorization verification has failed when the access rights of the data user when accessing the data do not match the access rights of the data object determined from the data interoperation system.

[0009] According to a data management method based on application and data decoupling provided by the present invention, the method further includes: The data management service receives a data registration request sent by the data owner through the client; the data registration request carries the data object of the data owner, the public key of the data object, and the encryption key of the data object; the data registration request is used to request that the data owner's data be registered to the data management service; The data management service sends a data owner attribute query request to the data interoperation system; the data owner attribute query request is used to request to query the key information of the data owner; the data interoperation system pre-stores the key information of multiple data owners; The data management service verifies the identity of the data owner based on the key information of the data owner sent by the data interoperation system; When the identity authentication of the data owner is passed, the data management service stores the data object of the data owner in the data storage module, and receives the data address of the data object of the data owner returned by the data storage module.

[0010] According to a data management method based on application and data decoupling provided by the present invention, the method further includes: The data management service sends a data object registration request to the data interoperation system; the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: a data object identifier, a data owner object identifier, a public key signature of the data object, and a private key signature of the data object; the data object registration request is used to request that the data object be registered to the data interoperation system; The data management service receives a registration result sent by the data interoperation system; the registration result is used to indicate whether the data object is successfully registered in the data interoperation system; When the registration result indicates that the data object is successfully registered in the data interoperation system, the data management service sends a data object attribute update request to the data interoperation system; the data object attribute update request is used to request to update the data address and ownership information of the data object; The data management service receives a response result sent by the data interoperation system, and sends the response result to the client; the response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

[0011] According to the present invention, a data management device based on application and data decoupling is provided, which is applied to data management services in a data management system. The device includes: A first sending module is used to send a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: a data owner identifier, a data object identifier, a data summary, and a data fingerprint; A first receiving module, used for receiving the key information of the data user and the ownership information of the data object sent by the data interoperation system; An authorization verification module is used to perform authorization verification on the data user based on the key information of the data user and the ownership information of the data object, and obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails; The data management module is used to manage the data of the data owner based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data management method based on decoupling of application and data as described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described data management methods based on decoupling of application and data.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned data management methods based on decoupling of application and data.

[0015] The data management method and device based on application and data decoupling provided by the present invention, the data management service in the data management system sends a data object attribute query request to the data mutual operation system based on the data query request sent by the data user through the client and the data object address; wherein the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data mutual operation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data mutual operation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object; the data management service manages the data owner's data based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners. Through the interaction between the data management service, the data mutual operation system and the data user, the data interconnection exchange after the application and data are decoupled is realized, and then the data management of the data owner is realized, the ownership and privacy security of the decoupled data are ensured, and the data management efficiency is improved. . BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is one of the schematic diagrams of data and applications provided by the prior art.

[0018] Figure 2 This is the second schematic diagram of data and applications provided by the prior art.

[0019] Figure 3 It is a schematic diagram of the application, data interoperability system and multiple data management systems provided by the present invention.

[0020] Figure 4 It is a structural schematic diagram of the data management system provided by the present invention.

[0021] Figure 5 It is a schematic diagram of the architecture of data management based on decoupling of application and data provided by the present invention.

[0022] Figure 6 It is a schematic diagram of the data management service and the data storage module provided by the present invention running on the same device.

[0023] Figure 7 It is a schematic diagram of the data management service and data storage module provided by the present invention running on different devices.

[0024] Figure 8 It is a schematic diagram of the basic operation provided by the present invention being adapted to different storage media.

[0025] Fig. 9 This is one of the flow charts of the data management method based on application and data decoupling provided by the present invention.

[0026] Fig.10 It is a schematic diagram of the relationship between the data user and the data management system provided by the present invention.

[0027] Fig.11 This is the second flow chart of the data management method based on application and data decoupling provided by the present invention.

[0028] Fig.12 It is a flowchart of data registration provided by the present invention.

[0029] Fig.13 It is a structural schematic diagram of a data management device based on application and data decoupling provided by the present invention.

[0030] Fig.14 It is a schematic diagram of the physical structure of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0032] In order to clearly illustrate the various embodiments of the present application, relevant background technical knowledge is first introduced.

[0033] After the application and data are decoupled, the need for data management arises. When data is controlled only by the application, the application can use the data directly without the need for data exchange and data ownership protection. However, after the data is decoupled from the application, it is stored and controlled by each data owner, which leads to the following problems: 1) The relationship between applications and data changes from a one-to-one relationship to a many-to-many relationship, which greatly increases the complexity of cross-access between applications and data; 2) Data was originally collected and stored centrally by applications, and the applications knew the address corresponding to each piece of data. However, after data decoupling, the data is stored and controlled by each owner. Therefore, data is stored in a distributed manner on the Internet. How to enable applications to locate and access the corresponding data is also an urgent problem to be solved; 3) Data decoupling does not mean closed data storage. Data still needs to be exchanged and circulated, but some data is more important or sensitive, and the ownership and privacy security of important data need to be protected during data exchange.

[0034] Figure 1 It is one of the schematic diagrams of data and applications provided by the prior art, such as Figure 1 As shown in the figure, after the decoupling of data and applications, the data owner controls the data independently, and the application service provider no longer owns all the user data. Instead, it "uses" the data on demand with the user's authorization, fully respecting and protecting the ownership of the data.

[0035] Figure 2 This is the second schematic diagram of data and applications provided by the prior art, such as Figure 2 As shown in the figure, after the data is decoupled from the application, it is stored and controlled by the respective data owners themselves, and the relationship between the application and the data changes from a one-to-one relationship to a many-to-many relationship.

[0036] Existing technical solutions: 1) For data management after the decoupling of applications and data, a social linked data (Solid) solution has been proposed, which stores and manages data through personal online data stores (Pods). However, there is still a problem of high data access complexity between different applications and different Pods, which has low usability in the scenario of massive Internet data.

[0037] 2) The personal data management (MyData) solution is to build a service platform through MyData operators approved by the government, but MyData has not completely decoupled applications from data. Data is still managed through the platform. Data ownership and privacy are highly dependent on the security of the platform, and users do not have control over their data.

[0038] Traditional data management systems focus more on issues such as storage, retrieval, and performance, while the data management system of this application focuses on solving the problems of interconnection, exchange, and secure sharing of application and decoupled data, ensuring that the decoupled data can still circulate, thereby realizing the value of data.

[0039] Based on the above problems, the present invention provides a data management method that decouples applications from data, which is applied to a data management system. Figure 3 is a schematic diagram of the application, data interoperability system and multiple data management systems provided by the present invention, such as Figure 3 As shown in the figure, the data management system interacts with the data interoperation system so that the data after the application and data are decoupled can be stored, managed, interconnected, exchanged and securely shared. The Data Interoperating System (DIS) is an Internet basic technology that promotes cross-domain data interconnection and interoperability under the premise of ensuring the ownership and security and privacy of data. The underlying technology of the data interoperation system is based on the Domain Name System (DNS) and blockchain technology to solve problems related to data rights confirmation, authentication and authorization, and secure exchange. As an intermediate layer between the application and the data management system, the data interoperation system can reduce the complexity of data access based on the data interoperation system, and the interaction between the data management system and the data interoperation system can realize data rights confirmation, interconnection and exchange, and secure sharing.

[0040] Figure 4 It is a structural diagram of the data management system provided by the present invention, such as Figure 4As shown, the data management system includes a data storage module and data management services. The data management services include basic operations, data rights confirmation and data exchange. Among them, data exchange includes data registration, access control and secure exchange. Data rights confirmation includes data fingerprint calculation, ownership statement construction, and ownership upload. Basic operations include data upload, query, delete and update. Through the interaction between the data management system and the data interoperability system, on the one hand, it provides data owners with data storage and basic operation functions such as addition, deletion, modification and query. On the other hand, it provides data owners and data users with data interconnection and exchange functions, and ensures data ownership and privacy security through rights confirmation, access control and encryption.

[0041] Figure 5 Schematic diagram of the architecture of data management based on application and data decoupling provided by the present invention, such as Figure 5 As shown, a data storage module, a data management service, a client and a data interoperation system are constructed, wherein the data storage module is used to store data for storing users, the data management service interacts with the data interoperation system and completes the interconnection and exchange of data after the application and data are decoupled, the client is an operation interface provided for data owners and data users, the underlying layer of the data interoperation system is blockchain technology and DNS, the blockchain has security features such as decentralization, tamper-proof and traceability, and the domain name system provides identity resolution services.

[0042] Data management service is a trusted service. Data management service is divided into client and server. Among them: 1) The client interacts with the server through the Software Development Kit (SDK); 2) The server runs on a self-built server.

[0043] There are also two situations for the data storage module: 1) Running on the same device as the data management service, such as Figure 6 As shown, Figure 6 is a schematic diagram of the data management service and data storage module provided by the present invention running on the same device; 2) and the data management service running on different devices, such as Figure 7 As shown, Figure 7 It is a schematic diagram of the data management service and data storage module provided by the present invention running on different devices.

[0044] This application includes two roles: data owner and data user. 1) Data Owner. The data owner is the owner of the data. The data owner can be an individual or an institutional user and has the ownership and use rights of the data. The data owner can store and control his or her own data through the data management system. The data owner has his or her own unique public key and private key as identity information, and the public and private keys are generated by the asymmetric encryption algorithm (RSA algorithm) by default.

[0045] 2) Data User. Data users are users who apply to access and use data. Data users can be individuals, enterprises or applications. Data users are the party that applies to use data. Data users have their own unique public and private keys as identity information. By default, the RSA algorithm is used to generate public and private keys.

[0046] The data storage module is used to store user data. Since the data is decoupled from the application, it is no longer stored by the application, but is stored in the data storage module by the data owner. Each data resource contains a corresponding metadata file, and the two are associated and managed through data object identifiers. At the same time, in order to meet the needs of actual use, the data storage module can choose different computer devices as storage media, including but not limited to terminal devices (such as mobile phones, personal computers), edge devices (such as servers built by users themselves), and cloud servers trusted by users. Taking full consideration of the practicality of the data management system, the underlying layer of the data storage is compatible with different storage media, which can be switched transparently for users.

[0047] The basic operations in the data management service are compatible with different storage media in the underlying storage module, and can provide unified data addition, deletion, modification, and query functions to the outside world. Even if the underlying storage medium changes, it will not affect the execution of the data management system.

[0048] Figure 8 is a schematic diagram of the basic operation provided by the present invention adapted to different storage media, such as Figure 8 As shown, the basic operations are adapted to different storage media such as cloud servers, terminal devices, and edge devices.

[0049] Fig. 9 This is one of the flow charts of the data management method based on application and data decoupling provided by the present invention, such as Fig. 9 As shown, the data management service is applied to the data management system, and the method includes steps 901 to 904.

[0050] Step 901, the data management service sends a data object attribute query request to the data interoperation system based on the data query request sent by the data user through the client and the data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identifier, data object identifier, data summary and data fingerprint.

[0051] It should be noted that the data management method based on application and data decoupling provided by the present invention is suitable for scenarios of data management after application and data decoupling. The executor of the method can be a data management device based on application and data decoupling, such as an electronic device, a data management service in a data management system, or a control module in the data management device based on application and data decoupling for executing the data management method based on application and data decoupling.

[0052] Specifically, the data user sends an address query request for the data object that the data user needs to use to the data interoperation system through the client, and the data interoperation system returns the data address to the client; wherein the address query request carries the data object identifier (Digital Object Identifier, DOI), and the address query request is used to request the data interoperation system to query the data address stored in the data object corresponding to the data object identifier, that is, the data address register (DataAddress, DAR), and the data address register stores the data object. The data interoperation system pre-stores the data address of the data object. It should be noted that after the data owner registers and stores the data in the data storage module, the data storage module returns the data address to the data management service, and the data management service registers the data address of the data object to the data interoperation system. The data address includes the address of the data management service.

[0053] The data user sends a data query request to the address of the data management service through the client, and the data management service receives the data query request; the data query request is used to request to query the data that the data user needs to use, and the data query request carries the data user's data user object identifier, data object identifier and data user's private key.

[0054] Based on the data query request, the data management service sends a data object attribute query request to the data interoperability system, where the data object attribute query request is used to request to query the data user's key information and the data object's ownership information, and the data object attribute query request carries the data user's data user object identifier, data object identifier and the data user's private key.

[0055] The data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the key information includes the public key of the data user, and the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint.

[0056] It should be noted that the specific process of the data interoperability system obtaining the ownership information of the data object, that is, the data ownership confirmation, is as follows: The data owner uses a hash algorithm on the data content of the data object through the client to generate a data summary, for example, the SHA256 algorithm. The data owner can also choose other algorithms. The data owner uses a fuzzy hash algorithm on the data content of the data object through the client to generate a data fingerprint. The data owner has his own data owner object identifier, that is, the data owner's identity identifier. The identity identifier complies with the domain name specification. Each piece of data has a globally unique data object identifier (DOI), and the data object identifier also complies with the domain name specification. Based on the data owner object identifier, data object identifier, data summary and data fingerprint, the ownership information of the data object is constructed. The data owner uploads the ownership information of the data object to the data interoperability system with the underlying block.

[0057] In this application, by uploading the ownership information of the data object to the data interoperability system, the security features of the data interoperability system such as decentralization, tamper-proofing and traceability ensure the evidence and clarification of data ownership.

[0058] Step 902: The data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system.

[0059] Specifically, the data interoperation system sends the key information of the queried data user and the ownership information of the data object to the data management service, and the data management service can receive the key information of the data user and the ownership information of the data object sent by the data interoperation system.

[0060] Step 903: The data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails.

[0061] Specifically, the data management service can perform authorization verification on the data user based on the data user's key information and the ownership information of the data object, and obtain an authorization verification result. The authorization verification result is used to indicate whether the data user's authorization verification succeeds or fails, that is, to verify whether the data user's authorization verification succeeds.

[0062] Step 904: The data management service manages the data owner's data based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0063] Specifically, the data storage module pre-registers and stores data of multiple data owners, and the data management service can manage the data that the data user needs to use based on the authorization verification result and the data storage module in the data management system.

[0064] The present invention provides a data management method based on application and data decoupling. The data management service in the data management system sends a data object attribute query request to the data interoperation system based on the data query request sent by the data user through the client and the data object address; wherein the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate that the data user authorization verification succeeds or fails; the data management service manages the data of the data owner based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners. Through the interaction between data management services, data interoperability systems and data users, data interconnection and exchange can be achieved after the decoupling of applications and data, thereby realizing data management for data owners, ensuring the ownership and privacy security of the decoupled data, and improving data management efficiency.

[0065] Optionally, a specific implementation of step 904 includes: (1) When the authorization verification result indicates that the data user authorization verification is successful, the data management service sends a data acquisition request to the data storage module.

[0066] Specifically, when the authorization verification result indicates that the data user's authorization verification is successful, the data management service sends a data acquisition request to the data storage module.

[0067] It should be noted that the data management system provides a data registration function, so that the data decoupled from the application can be discovered and found. In the mode of application and data decoupling, data is distributed and stored in various data management systems. There is a one-to-many relationship between each application (data user) and the data management system. The application cannot directly discover and find the required data. Fig.10 is a schematic diagram of the relationship between the data user and the data management system provided by the present invention, such as Fig.10 As shown, data users can perform cross-data access to data stored in the data management system, which increases the complexity of data users and data cross-data access.

[0068] (2) The data management service receives the data sent by the data storage module.

[0069] Specifically, after the data storage module obtains the data corresponding to the data acquisition request, the data set storage module sends the data to the data management service, and the data management service receives the data sent by the data storage module.

[0070] (3) The data management service sends the data to the client.

[0071] Specifically, the data management service returns the data sent by the data storage module to the client so that the data user can use the data.

[0072] Fig.11 This is the second flow chart of the data management method based on application and data decoupling provided by the present invention, such as Fig.11 As shown, the method includes steps 1101 to 1110.

[0073] Step 1101: The data user sends an address query request for the data object that the data user needs to use to the data interoperation system through the client. The address query request carries the data object identifier, and is used to request the data interoperation system to query the data address stored in the data object corresponding to the data object identifier.

[0074] Step 1102: The client receives the data address sent by the data interoperation system.

[0075] Step 1103, the data user sends a data query request to the address of the data management service through the client. The data query request is used to request to query the data that the data user needs to use. The data query request carries the data user's data user object identifier, data object identifier and the data user's private key.

[0076] Step 1104, the data management service sends a data object attribute query request to the data interoperability system. The data object attribute query request is used to request to query the data user's key information and the data object's ownership information. The data object attribute query request carries the data user's data user object identifier, data object identifier and the data user's private key.

[0077] Step 1105: The data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system.

[0078] Step 1106, the data management service performs authorization verification on the data user based on the data user's key information and the ownership information of the data object, and obtains an authorization verification result; the authorization verification result is used to indicate whether the data user's authorization verification succeeds or fails.

[0079] Step 1107, when the authorization verification result indicates that the data user authorization verification is successful, the data management service sends a data acquisition request to the data storage module; the data storage module pre-registers and stores the data of multiple data owners.

[0080] Step 1108: The data management service receives the data content sent by the data storage module.

[0081] Step 1109: The data management service sends the data content to the client.

[0082] Step 1110: When the authorization verification result indicates that the data user authorization verification fails, the data management service sends empty data content to the client.

[0083] In this application, through the interaction between the data management system and the data interoperability system, a unified and standardized process is used to solve the data management problem in the scenario of application and data decoupling, including data storage, basic management, rights confirmation and exchange. In the scenario of application and data decoupling, the data interaction process is standardized and unified, which reduces the complexity of cross-data access and saves time.

[0084] Optionally, the process of registering data to the data management service includes the following steps: a) The data management service receives a data registration request sent by the data owner through the client; the data registration request carries the data object of the data owner, the public key of the data object, and the encryption key of the data object; the data registration request is used to request that the data owner's data be registered to the data management service.

[0085] Specifically, the data owner calls the "data registration" interface of the data management service through the client. The data owner can choose whether to encrypt the data. If the data owner chooses to encrypt the data, the encryption key (symmetric key) used to encrypt the data is uploaded when calling the data registration interface. If the data owner chooses not to encrypt the data, the encryption key parameter is ignored.

[0086] The data owner sends a data registration request to the data management service through the client, and the data management service receives the data registration request sent by the data owner through the client; wherein the data registration request carries the data owner's data object, the public key of the data object, and the encryption key of the data object; the data registration request is used to request that the data owner's data be registered to the data management service, and the encryption key is used to indicate that the data owner's data is encrypted and stored in the data storage module through the data management service.

[0087] b) The data management service sends a data owner attribute query request to the data interoperation system; the data owner attribute query request is used to request to query the key information of the data owner; the data interoperation system pre-stores key information of multiple data owners.

[0088] Specifically, the data management service sends a data owner attribute query request to the data interoperation system; wherein the data owner attribute query request is used to request to query the key information of the data owner, so that the data management service verifies the identity of the data owner; the data interoperation system pre-stores the key information of multiple data owners. The key information of the data owner is the public key of the data owner.

[0089] The data interoperation system queries the key information of the data owner based on the data owner attribute query request and sends the key information of the data owner to the data management service. The data management service receives the key information of the data owner sent by the data interoperation system.

[0090] c) The data management service verifies the identity of the data owner based on the key information of the data owner sent by the data interoperation system.

[0091] Specifically, the data management service verifies the identity of the data owner based on the key information of the data owner sent by the data interoperability system, that is, it decrypts the data owner's public key to obtain the data, and then decrypts the data owner's private key to obtain the data, determines whether the two data are the same, and determines whether the identity of the data owner is verified.

[0092] d) When the data owner's identity authentication is passed, the data management service stores the data object of the data owner in the data storage module, and receives the data address of the data object of the data owner returned by the data storage module.

[0093] Specifically, when the data owner's identity authentication is passed, the data management service stores the data owner's data object in the data storage module. The data storage module returns the data address of the data owner's data object to the data management service, and the data management service receives the data address of the data owner's data object returned by the data storage module.

[0094] Optionally, the process of registering data to the data interoperability system includes the following steps: e) The data management service sends a data object registration request to the data interoperation system; the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: data object identifier, data owner object identifier, public key signature of the data object, private key signature of the data object; the data object registration request is used to request to register the data object to the data interoperation system.

[0095] Specifically, after the data owner's data object is stored in the data storage module, the data management service sends a data object registration request to the data interoperability system, wherein the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: data object identifier, data owner object identifier, public key signature of the data object, private key signature of the data object; the data object registration request is used to request that the data object be registered to the data interoperability system.

[0096] The data interoperation system registers the data object to the data interoperation system based on the data object registration request sent by the data management service, and sends the registration result to the data management service.

[0097] f) The data management service receives a registration result sent by the data interoperation system; the registration result is used to indicate whether the data object is successfully registered in the data interoperation system.

[0098] Specifically, the data management service may receive a registration result sent by the data interoperation system; wherein the registration result is used to indicate whether the data object is successfully registered in the data interoperation system.

[0099] g) when the registration result indicates that the data object is successfully registered in the data interoperation system, the data management service sends a data object attribute update request to the data interoperation system; the data object attribute update request is used to request to update the data address and ownership information of the data object.

[0100] Specifically, when the registration result indicates that the data object is successfully registered in the data interoperation system, the data management service can send a data object attribute update request to the data interoperation system; wherein the data object attribute update request is used to request to update the data address and ownership information of the data object.

[0101] The data interoperability system updates the data address and ownership information of the data object based on the data object attribute update request sent by the data management service.

[0102] h) The data management service receives a response result sent by the data interoperation system, and sends the response result to the client; the response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

[0103] Specifically, the data management service receives a response result sent by the data interoperation system, and sends the response result to the client; wherein the response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

[0104] Fig.12 It is a schematic diagram of the data registration process provided by the present invention, such as Fig.12 As shown, the method includes steps 120 to 1211.

[0105] Step 1201, the data owner sends a data registration request to the data management service through the client; wherein the data registration request carries the data owner's data object, the public key of the data object, and the encryption key of the data object; the data registration request is used to request that the data owner's data be registered to the data management service.

[0106] Step 1202, the data management service sends a data owner attribute query request to the data interoperation system; wherein the data owner attribute query request is used to request to query the key information of the data owner; the data interoperation system pre-stores the key information of multiple data owners; the key information of the data owner is the public key of the data owner.

[0107] Step 1203: The data management service receives the key information (public key) of the data owner sent by the data interoperability system.

[0108] Step 1204: The data management service verifies the identity of the data owner based on the key information of the data owner sent by the data interoperability system.

[0109] Step 1205 , when the data owner's identity authentication is passed, the data management service stores the data object of the data owner in the data storage module.

[0110] Step 1206: The data management service receives the data address of the data object of the data owner sent by the data storage module.

[0111] Step 1207, the data management service sends a data object registration request to the data interoperation system; wherein the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: data object identifier, data owner object identifier, public key signature of the data object, private key signature of the data object; the data object registration request is used to request to register the data object to the data interoperation system.

[0112] Step 1208: The data management service receives the registration result sent by the data interoperation system; wherein the registration result is used to indicate whether the data object is successfully registered in the data interoperation system.

[0113] Step 1209, when the registration result indicates that the data object is successfully registered in the data interoperation system, the data management service sends a data object attribute update request to the data interoperation system; wherein the data object attribute update request is used to request to update the data address and ownership information of the data object.

[0114] Step 1210: The data management service receives a response result sent by the data interoperation system. The response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

[0115] Step 1211: The data management service sends a response result to the client.

[0116] Optionally, a specific implementation of step 903 includes: (a) The data management service determines, based on the ownership information of the data object, whether a data user who is indicated by the ownership information as having access rights is the data user.

[0117] Specifically, the ownership information is used to indicate whether a data user with access rights is a data user. Based on the ownership information of the data object, the data management service can determine whether the data user with access rights indicated by the ownership information is a data user.

[0118] (b) When the ownership information indicates that the data user with access rights is the data user, the data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperability system, and obtains the authorization verification result.

[0119] Specifically, data users can carry access rights when accessing data, such as read, write, modify, add, query and delete access rights. The data interoperability system preselects the access rights of stored data objects. When the ownership information indicates that the data user with access rights is the data user, the data management service can perform authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperability system to obtain the authorization verification result.

[0120] It should be noted that for each piece of data, the data owner sets a corresponding authorization strategy, which includes public or authorized access, that is, the data owner can choose "public" or "authorized access". The data owner stores the data strategy in the data interoperability system through the data management service.

[0121] If the data owner chooses "public", everyone can access it. When the data user accesses the data, the data management service can verify the authorization of the data user through the data interoperability system and obtain the authorization verification result.

[0122] If the data owner chooses "Authorized Access", the data owner also needs to set the corresponding authorization policy through the client, and the data management service will publish the policy to the data interoperability system. The policy is a set of data access permissions defined by the owner, including but not limited to reading data, modifying data, etc. Fully consider data security issues and provide options for data owners, including encrypted storage of data and authorized access control. Data owners can choose whether to perform more secure operations based on their needs and the importance of the data, thereby improving data security.

[0123] The data owner sets the authorization rule through the client, and the data management service publishes the authorization rule to the data interoperability system.<data_identifier,user_identifier,policy> The triplet, data_identifier is the data object identifier, user_identifier refers to the data user object identifier, that is, the identity identifier of the authorized user. The meaning of the triplet is: for the data object identifier data_identifier, a set of policy permissions are granted to the data user object identifier user_identifier, such as data access permissions such as reading data and modifying data.

[0124] The data interoperability system stores authorization strategy, policy, and rule as a decentralized authorization server. The data interoperability system is used as a decentralized authorization server to interact with each other to achieve more secure and reliable access control.

[0125] When a data user accesses data, the access control can be completed by performing authorization verification on the data user based on the data user's access rights and the access rights of the data object identifier corresponding to the data user's object identifier determined from the data interoperability system, that is, determining the policy from the data interoperability system.

[0126] Optionally, the specific implementation of the above step (b) includes: The data management service matches the access rights of the data user when accessing data with the access rights of the data object determined from the data interoperation system; the data management service determines that the data user authorization verification is successful if the access rights of the data user when accessing data and the access rights of the data object determined from the data interoperation system match; the data management service determines that the data user authorization verification has failed if the access rights of the data user when accessing data and the access rights of the data object determined from the data interoperation system do not match.

[0127] Specifically, the data management service matches the access rights of the data user when accessing the data with the access rights of the data object determined from the data interoperation system; if the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperation system match, the data management service can determine that the data user authorization verification is successful. If the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperation system do not match, the data management service can determine that the data user authorization verification has failed.

[0128] In this application, the data management system completes access control through authorization strategies, authorization policies, and access permissions corresponding to the authorization policies, and interacts with the data interoperability system as a decentralized authorization server to achieve more secure and reliable access control.

[0129] The data management device based on application and data decoupling provided by the present invention is described below. The data management device based on application and data decoupling described below and the data management method based on application and data decoupling described above can refer to each other.

[0130] Fig.13 is a structural diagram of a data management device based on application and data decoupling provided by the present invention, such as Fig.13 As shown, the data management device 1300 based on application and data decoupling includes: a first sending module 1301, a first receiving module 1302, an authorization verification module 1303 and a data management module 1304; wherein,

[0131] The first sending module 1301 is used to send a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; The first receiving module 1302 is used to receive the key information of the data user and the ownership information of the data object sent by the data interoperation system; The authorization verification module 1303 is used to perform authorization verification on the data user based on the key information of the data user and the ownership information of the data object, and obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails; The data management module 1304 is used to manage the data owner's data based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0132] The data management device based on application and data decoupling provided by the present invention comprises a data management service in a data management system that sends a data object attribute query request to a data mutual operation system based on a data query request sent by a data user through a client and a data object address; wherein the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data mutual operation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data mutual operation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object; the data management service manages the data owner's data based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners. Through the interaction between the data management service, the data mutual operation system and the data user, the data interconnection and exchange after application and data decoupling is realized, and then the data management of the data owner is realized, the ownership and privacy security of the decoupled data are ensured, and the data management efficiency is improved.

[0133] Optionally, the data management module 1304 is specifically configured to: When the authorization verification result indicates that the data user authorization verification is successful, the data management service sends a data acquisition request to the data storage module; The data management service receives the data sent by the data storage module; The data management service sends the data to the client.

[0134] Optionally, the authorization verification module 1303 is specifically used to: The data management service determines, based on the ownership information of the data object, whether a data user with access rights indicated by the ownership information is the data user; When the ownership information indicates that the data user with access rights is the data user, the data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperability system, and obtains the authorization verification result.

[0135] Optionally, the data management 1300 based on application and data decoupling further includes: A second receiving module is used to receive a data registration request sent by the data owner through the client; the data registration request carries the data object of the data owner, the public key of the data object, and the encryption key of the data object; the data registration request is used to request to register the data of the data owner to the data management service; A second sending module is used to send a data owner attribute query request to the data interoperation system; the data owner attribute query request is used to request to query the key information of the data owner; the data interoperation system pre-stores the key information of multiple data owners; An identity authentication module, used to verify the identity of the data owner based on the key information of the data owner sent by the data interoperation system; The storage module is used to store the data object of the data owner in the data storage module when the identity authentication of the data owner is passed, and receive the data address of the data object of the data owner returned by the data storage module.

[0136] Optionally, the data management 1300 based on application and data decoupling further includes: A third sending module is used to send a data object registration request to the data interoperation system; the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: a data object identifier, a data owner object identifier, a public key signature of the data object, and a private key signature of the data object; the data object registration request is used to request that the data object be registered to the data interoperation system; A third receiving module is used to receive a registration result sent by the data interoperation system; the registration result is used to indicate whether the data object is successfully registered in the data interoperation system; A fourth sending module, configured to send a data object attribute update request to the data interoperation system when the registration result indicates that the data object is successfully registered in the data interoperation system; the data object attribute update request is used to request to update the data address and ownership information of the data object; The fourth sending module is used to receive the response result sent by the data interoperation system and send the response result to the client; the response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

[0137] Fig.14 is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Fig.14As shown, the electronic device 1400 may include: a processor 1410 , a communication interface 1420 , a memory 1430 and a communication bus 1440 , wherein the processor 1410 , the communication interface 1420 , and the memory 1430 communicate with each other via the communication bus 1440 . The processor 1410 can call the logic instructions in the memory 1430 to execute a data management method based on the decoupling of application and data, the method comprising: the data management service sends a data object attribute query request to the data mutual operation system based on the data query request sent by the data user through the client and the data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data mutual operation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data mutual operation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate that the authorization verification of the data user is successful or the authorization verification fails; the data management service manages the data of the data owner based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0138] In addition, the logic instructions in the above-mentioned memory 1430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk.

[0139] On the other hand, the present invention further provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the data management method based on application and data decoupling provided by the above methods, the method including: the data management service sends a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; The ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate that the authorization verification of the data user succeeds or fails; the data management service manages the data of the data owner based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores data of multiple data owners.

[0140] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the data management method based on application and data decoupling provided by the above methods, the method comprising: the data management service sends a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: Data owner identification, data object identification, data summary and data fingerprint; the data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system; the data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate that the authorization verification of the data user succeeds or fails; the data management service manages the data owner's data based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

[0141] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0142] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0143] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data management method based on decoupling of application and data, characterized in that: A data management service applied to a data management system, the method comprising: The data management service sends a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: data owner identification, data object identification, data summary and data fingerprint; The data management service receives the key information of the data user and the ownership information of the data object sent by the data interoperation system; The data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object to obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails; The data management service manages the data owner's data based on the authorization verification result and a data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

2. The data management method based on application and data decoupling according to claim 1, characterized in that: The data management service manages the data of the data owner based on the authorization verification result and the data storage module in the data management system, including: When the authorization verification result indicates that the data user authorization verification is successful, the data management service sends a data acquisition request to the data storage module; The data management service receives the data sent by the data storage module; The data management service sends the data to the client.

3. The data management method based on application and data decoupling according to claim 1, characterized in that: The data management service performs authorization verification on the data user based on the key information of the data user and the ownership information of the data object, and obtains an authorization verification result, including: The data management service determines, based on the ownership information of the data object, whether a data user with access rights indicated by the ownership information is the data user; When the ownership information indicates that the data user with access rights is the data user, the data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperability system, and obtains the authorization verification result.

4. The data management method based on application and data decoupling according to claim 3 is characterized in that: The data management service performs authorization verification on the data user based on the access rights of the data user when accessing the data and the access rights of the data object determined from the data interoperation system, and obtains the authorization verification result, including: The data management service matches the access rights of the data user when accessing the data with the access rights of the data object determined from the data interoperation system; The data management service determines that the authorization verification of the data user is successful if the access rights of the data user when accessing the data match the access rights of the data object determined from the data interoperation system; The data management service determines that the data user authorization verification has failed when the access rights of the data user when accessing the data do not match the access rights of the data object determined from the data interoperation system.

5. The data management method based on application and data decoupling according to any one of claims 1 to 4, characterized in that: The method further comprises: The data management service receives a data registration request sent by the data owner through the client; the data registration request carries the data object of the data owner, the public key of the data object, and the encryption key of the data object; the data registration request is used to request that the data owner's data be registered to the data management service; The data management service sends a data owner attribute query request to the data interoperation system; the data owner attribute query request is used to request to query the key information of the data owner; the data interoperation system pre-stores the key information of multiple data owners; The data management service verifies the identity of the data owner based on the key information of the data owner sent by the data interoperation system; When the identity authentication of the data owner is passed, the data management service stores the data object of the data owner in the data storage module, and receives the data address of the data object of the data owner returned by the data storage module.

6. The data management method based on application and data decoupling according to claim 5, characterized in that: The method further comprises: The data management service sends a data object registration request to the data interoperation system; the data object registration request carries the registration information of the data object, and the registration information includes at least one of the following: a data object identifier, a data owner object identifier, a public key signature of the data object, and a private key signature of the data object; the data object registration request is used to request that the data object be registered to the data interoperation system; The data management service receives a registration result sent by the data interoperation system; the registration result is used to indicate whether the data object is successfully registered in the data interoperation system; When the registration result indicates that the data object is successfully registered in the data interoperation system, the data management service sends a data object attribute update request to the data interoperation system; the data object attribute update request is used to request to update the data address and ownership information of the data object; The data management service receives a response result sent by the data interoperation system, and sends the response result to the client; the response result is used to indicate whether to update the data address and ownership information of the data object in the data interoperation system.

7. A data management device based on application and data decoupling, characterized in that: A data management service applied to a data management system, the device comprising: A first sending module is used to send a data object attribute query request to the data interoperation system based on a data query request sent by a data user through a client and a data object address; the data object attribute query request is used to request to query the key information of the data user and the ownership information of the data object; the data interoperation system pre-stores the key information of the data user and the ownership information of the data object; the ownership information includes at least one of the following: a data owner identifier, a data object identifier, a data summary, and a data fingerprint; A first receiving module, used for receiving the key information of the data user and the ownership information of the data object sent by the data interoperation system; An authorization verification module is used to perform authorization verification on the data user based on the key information of the data user and the ownership information of the data object, and obtain an authorization verification result; the authorization verification result is used to indicate whether the authorization verification of the data user succeeds or fails; The data management module is used to manage the data of the data owner based on the authorization verification result and the data storage module in the data management system; the data storage module pre-registers and stores the data of multiple data owners.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the data management method based on decoupling of application and data as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data management method based on decoupling of application and data as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data management method based on decoupling of application and data as claimed in any one of claims 1 to 6 is implemented.

Images