A data flow method and system, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a data flow method and system, electronic equipment and storage medium. The method is that a data processing end obtains authorized data ciphertext obtained by joint encryption of an authorized data by a data demand end and a data providing end; the authorized data is determined by the data providing end according to a target data range and data use permission requested by the data demand end; in response to an authorized data use request sent by the data demand end, the data demand end and the data providing end are triggered to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext; in the case that a data processing strategy of the data processing end conforms to a data use rule generated by the data providing end according to the data use permission, the authorized data plaintext is operated according to the data processing strategy to obtain an operation result, and the operation result is returned to the data demand end. Embodiments of the present application can ensure that transaction data is safely and efficiently circulated, and promote the benign transaction and flow of data assets.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data flow, in particular to a data flow method, system, electronic device and storage medium. BACKGROUND

[0002] In view of the value and characteristics of data assets, in the field of data flow, in order to protect the ownership of data assets, the technologies such as multi-party secure computation, federated learning or homomorphic cryptography are usually used to realize the use of transaction data and the invisibility of transaction data. The data demand side needs to jointly perform data operation with the data provider based on a specific data operation protocol to obtain the operation result.

[0003] However, these technologies can only support limited data operation functions, and the overhead of most data operations is much higher than that of direct operation on transaction data in plaintext, which greatly increases the data operation overhead. In addition, the data provider needs to be online all the way to cooperate with the data demand side for data operation. If one or more data demand sides have different data operation requirements, the data provider needs to perform multiple different data operation schemes locally, which increases the technical difficulty of the data provider to provide transaction data externally. It can be seen that these technologies have great feasibility problems in practical application, which seriously restricts the benign transaction and flow of data assets. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a data flow method, system, electronic device and storage medium, which can realize the safe and efficient flow of transaction data and promote the benign transaction and flow of data assets.

[0005] In a first aspect, the embodiments of the present application provide a data flow method applied to a data processing end, which is in communication connection with a data demand end and a data providing end; the method comprises:

[0006] obtaining an authorized data ciphertext; wherein the authorized data ciphertext is obtained by joint encryption of the data demand end and the data providing end on authorized data, and the authorized data is determined by the data providing end according to the target data range and data use permission requested by the data demand end for authorization management;

[0007] in response to an authorized data use request sent by the data demand end, triggering the data demand end and the data providing end to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext;

[0008] If the data processing strategy at the data processing end conforms to the data usage rules at the data provider end, the authorized data plaintext is processed according to the data processing strategy to obtain the processing result, and the processing result is returned to the data request end; wherein, the data usage rules are generated by the data provider end based on the data usage permissions.

[0009] In the above implementation process, a trusted third party, namely the data processing end, is introduced, mutually trusted by both the data requester and the data provider. The data processing end determines the authorized data based on the target data scope and data usage permissions requested by the data requester, as determined by the data provider. After the data requester and data provider jointly encrypt the authorized data to obtain ciphertext, the data processing end responds to the authorized data usage request sent by the data requester, triggering joint decryption by both parties to obtain plaintext. If the data processing end's data processing strategy conforms to the data provider's data usage rules, the data processing end performs calculations on the plaintext and returns the calculation results to the data requester. Firstly, during the data authorization phase, the data provider addresses the data request... First, the system manages the scope of target data and data usage permissions requested by the client, effectively ensuring controllable access to authorized data. Second, under the premise of controllable authorization of target data, the data requester and data provider jointly encrypt the authorized data, effectively ensuring the security of the authorized data and making it invisible to the data requester. Third, during the data usage phase, the data provider can only participate in the decryption process of the encrypted authorized data without having to perform a series of complex calculations online throughout the process, effectively improving the feasibility of the data provider providing data to external parties and enabling the data requester to use the authorized data. Fourth, the data processing end directly performs corresponding calculations on the plaintext of the authorized data, ensuring that plaintext calculations are performed in a secure and trusted environment, effectively reducing data computation overhead, thereby ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0010] Furthermore, the data requester and the data provider are connected in communication; the authorized data is obtained through the following methods:

[0011] The data requester sends a target data authorization request to the data provider; wherein the target data authorization request includes the target data scope and the data usage permissions.

[0012] The data provider responds to the target data authorization request, determines the target data based on the target data range, and, if the data requester is allowed to use the target data according to the data usage permissions, determines the target data as the authorized data.

[0013] In the above implementation process, by sending a target data authorization request, which includes the target data range and data usage permissions, from the data requester to the data provider, and the data provider responding to the target data authorization request, determining the target data based on the target data range, and confirming the target data as authorized data if the data requester is allowed to use the target data according to the data usage permissions, the data provider can accurately manage the authorization of the target data range and data usage permissions requested by the data requester during the data authorization stage, effectively ensuring that the usage permissions of the authorized data are controllable.

[0014] Furthermore, the data requester and the data provider are connected in communication; the authorized encrypted data is obtained in the following way:

[0015] The data requester sends its public key to the data provider.

[0016] Through the data provider, using the public key of the data provider and the public key of the data requester, the authorized data is subjected to hierarchical encryption or collaborative encryption to obtain the ciphertext of the authorized data; or,

[0017] The data requester sends its public key to the data provider.

[0018] The authorized data is encrypted using the encryption key provided by the data provider to obtain the initial ciphertext.

[0019] Using the data provider's public key and the data requester's public key, the encryption key is subjected to hierarchical encryption or collaborative encryption to obtain the encryption key ciphertext.

[0020] The authorized data ciphertext is obtained from the data provider based on the initial data ciphertext and the encryption key ciphertext.

[0021] In the above implementation process, the public key of the data requester is sent to the data provider. The data provider then selects a hierarchical encryption method based on the public key, a collaborative encryption method based on the public key, a hierarchical encryption method based on the encryption key, or a collaborative encryption method based on the encryption key to jointly encrypt the authorized data, thereby obtaining the encrypted authorized data. This allows for the flexible selection of multiple encryption methods to jointly encrypt the authorized data, effectively ensuring the security of the authorized data.

[0022] Furthermore, the step of triggering the data requester and the data provider to jointly decrypt the authorized data ciphertext to obtain the authorized data plaintext includes:

[0023] Based on the data authorization information corresponding to the authorized data ciphertext, generate a first decryption request and a second decryption request for the authorized data ciphertext;

[0024] Send the first decryption request to the data requester and obtain the first decryption result returned by the data requester;

[0025] Send the second decryption request to the data provider and obtain the second decryption result returned by the data provider;

[0026] Based on the first decryption result and the second decryption result, the plaintext of the authorized data is determined.

[0027] In the above implementation process, the data processing end generates a first decryption request and a second decryption request for the authorized data ciphertext based on the data authorization information corresponding to the authorized data ciphertext. The first decryption request is sent to the data request end, and a first decryption result is returned by the data request end. The second decryption request is sent to the data provider end, and a second decryption result is returned by the data provider end. Based on the first decryption result and the second decryption result, the authorized data plaintext is determined. This can efficiently trigger the data request end and the data provider end to jointly decrypt the authorized data ciphertext, ensuring accurate acquisition of the authorized data plaintext.

[0028] Furthermore, the first decryption request includes first remote authentication information of the data processing terminal, and the second decryption request includes second remote authentication information of the data processing terminal; the first decryption result and the second decryption result are obtained in the following ways:

[0029] Through the data request terminal, responding to the first decryption request, verifying the first remote authentication information, and decrypting the authorized data ciphertext if the first remote authentication information passes verification, to obtain the first decryption result;

[0030] The data provider responds to the second decryption request, verifies the second remote authentication information, and, if the second remote authentication information is verified, decrypts the authorized data ciphertext to obtain the second decryption result.

[0031] In the above implementation process, by adding the first remote authentication information of the data processing terminal to the first decryption request and the second remote authentication information of the data processing terminal to the second decryption request, the data requesting party decrypts the authorized data ciphertext only after confirming that the first remote authentication information of the data processing terminal has been verified, and the data providing party decrypts the authorized data ciphertext only after confirming that the second remote authentication information of the data processing terminal has been verified. This effectively ensures the security and reliability of the communication environment among the three parties: the data processing party, the data requesting party, and the data providing party. This further ensures the secure and efficient circulation of transaction data and promotes the healthy trading and flow of data assets.

[0032] Further, verifying the first remote proof information includes:

[0033] The first remote authentication information is compared with the standard remote authentication information stored locally through the data request terminal;

[0034] If the first remote proof information is consistent with the standard remote proof information, it is determined that the first remote proof information has passed verification; otherwise, it is determined that the first remote proof information has failed verification.

[0035] The verification of the second remote authentication information includes:

[0036] The second remote authentication information is compared with the standard remote authentication information stored locally through the data providing terminal;

[0037] If the second remote authentication information matches the standard remote authentication information, the second remote authentication information is determined to have passed verification; otherwise, the second remote authentication information is determined to have failed verification.

[0038] The standard remote verification information is obtained by the data requester and the data provider through a trusted channel.

[0039] In the above implementation process, by having the data requester and data provider obtain standard remote authentication information from trusted channels and store it locally, and by having the data processing end add its first remote authentication information to the first decryption request and its second remote authentication information to the second decryption request, the data requester will only decrypt the authorized data ciphertext if it confirms that the first remote authentication information and the standard remote authentication information of the data processing end are consistent. Similarly, the data provider will only decrypt the authorized data ciphertext if it confirms that the second remote authentication information and the standard remote authentication information of the data processing end are consistent. This effectively ensures the secure and reliable communication environment and the effective and reliable execution functions among the three ends: the data processing end, the data requester, and the data provider. This further ensures the secure and efficient circulation of transaction data and promotes the healthy trading and flow of data assets.

[0040] Further, before decrypting the authorized data ciphertext to obtain the second decryption result, the process includes:

[0041] The data provider determines that the data processing strategy conforms to the data usage rules.

[0042] In the above implementation process, the data provider decrypts the encrypted authorized data only after verifying the second remote authentication information of the data processing end and confirming that the data processing end's data processing strategy complies with the data usage rules. This allows the data provider to review the data processing end's processing strategy for the authorized data, ensuring that the data processing end processes the authorized data within the scope of its data usage permissions. This further guarantees the secure and efficient circulation of transaction data and promotes the healthy trading and flow of data assets.

[0043] Further, determining that the data processing strategy conforms to the data usage rules includes:

[0044] The description data of the data processing strategy is compared with the description data of the data usage rules stored locally through the data providing end;

[0045] If the data provider determines that the data processing strategy conforms to the data usage rule when the description data of the data processing strategy matches the description data of the data usage rule, the data processing strategy is deemed to conform to the data usage rule.

[0046] In the above implementation process, by having the data provider use descriptive data comparison to determine whether the data processing strategy complies with the data usage rules, it is possible to ensure that the data provider can quickly and accurately determine whether the data processing strategy complies with the data usage rules, thereby further ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0047] Furthermore, the data processing terminal is a terminal that includes programs running in a trusted execution environment or services built on a trusted execution environment.

[0048] In the above implementation process, by selecting a terminal that includes programs running in a trusted execution environment or services built on a trusted execution environment as the data processing terminal, it is possible to introduce third-party trusted terminals to participate in the authorized data use process, thereby further ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0049] Secondly, embodiments of this application provide a data circulation system, including a data processing terminal; the data processing terminal is connected to both the data demand terminal and the data supply terminal.

[0050] The data processing terminal is used for:

[0051] Obtain the encrypted authorized data; wherein the encrypted authorized data is obtained by the data requester and the data provider jointly encrypting the authorized data, and the authorized data is determined by the data provider based on the target data range and data usage permissions requested by the data requester;

[0052] In response to the authorized data usage request sent by the data requesting end, the data requesting end and the data providing end are triggered to jointly decrypt the encrypted authorized data to obtain the plaintext authorized data;

[0053] If the data processing strategy at the data processing end conforms to the data usage rules at the data provider end, the authorized data plaintext is processed according to the data processing strategy to obtain the processing result, and the processing result is returned to the data request end; wherein, the data usage rules are generated by the data provider end based on the data usage permissions.

[0054] Thirdly, embodiments of this application provide an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, it implements the method described above.

[0055] Fourthly, embodiments of this application provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program; wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the method described above.

[0056] Fifthly, embodiments of this application provide a computer program product including instructions that, when executed by a computer, cause the computer to perform the method described above. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A schematic flowchart illustrating a data flow method provided in the first embodiment of this application;

[0059] Figure 2 A data flow diagram illustrating the authorization of target data exemplified in the first embodiment of this application;

[0060] Figure 3 The data flow diagram used for the authorized data exemplified in the first embodiment of this application;

[0061] Figure 4 This is a data flow diagram illustrating the data flow method exemplified in the first embodiment of this application;

[0062] Figure 5 This is a schematic diagram of the structure of a data circulation system provided in the second embodiment of this application;

[0063] Figure 6 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0064] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0065] It should be noted that in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance. Furthermore, the step numbers in the text are only for the convenience of explaining the embodiments of this application and are not intended to limit the order in which the steps are performed.

[0066] In today's digital age, data has become a key asset. Data circulation provides unprecedented business opportunities for enterprises and individuals, and brings enormous economic benefits to society. Data assets differ from physical assets, characterized by the absence of fixed and controllable boundaries, unlimited replication, and arbitrary splitting, transfer, or use.

[0067] In related technologies, given the value and characteristics of data assets, in the field of data circulation, to protect data asset ownership—that is, to ensure that the data requester can only use the data according to its authorized data processing strategy and cannot resell the data in any form—techniques such as multi-party secure computation, federated learning, or homomorphic cryptography are typically applied to achieve usability without visibility of the transaction data. The data requester needs to collaborate with the data provider, based on specific data operation protocols, to perform data operations on the transaction data held by the data provider and obtain the results.

[0068] However, these technologies only support limited data processing capabilities, and the overhead of most data processing operations far exceeds the overhead of processing directly on the plaintext of transaction data, significantly increasing computational costs. Furthermore, data providers need to collaborate with data requesters online throughout the entire process. If one or more data requesters have multiple different data processing needs, the data provider must execute multiple different data processing schemes locally, greatly increasing the technical difficulty of providing transaction data. Therefore, these technologies have significant feasibility issues in practical applications, severely hindering the healthy trading and flow of data assets.

[0069] To this end, this application proposes a data circulation method. This method introduces a trusted third party, namely a data processing end, mutually trusted by both the data requester and the data provider. The data processing end determines the authorized data based on the target data scope and data usage permissions requested by the data requester, as determined by the data provider. After the data requester and data provider jointly encrypt the authorized data to obtain ciphertext, the data processing end responds to the authorized data usage request sent by the data requester, triggering joint decryption of the ciphertext to obtain plaintext. If the data processing end's data processing strategy conforms to the data provider's data usage rules, the data processing end performs calculations on the plaintext according to its data processing strategy and returns the calculation result to the data requester. Firstly, during the data authorization phase, the data provider targets… First, the authorization management of the target data scope and data usage permissions requested by the data demand side effectively ensures the controllability of the usage permissions of the authorized data. Second, under the premise of controllable authorization of the target data, the data demand side and the data provider jointly encrypt the authorized data, effectively ensuring the security of the authorized data and making the authorized data invisible to the data demand side. Third, during the data usage stage, the data provider can only participate in the decryption process of the encrypted authorized data without having to perform a series of complex calculations online throughout the process, effectively improving the feasibility of the data provider to provide data to the outside world and enabling the data demand side to use the authorized data. Fourth, the data processing end directly performs corresponding calculations on the plaintext of the authorized data, ensuring that the plaintext calculations of the data are performed in a secure and trusted environment, effectively reducing the data calculation overhead, thereby ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0070] The methods provided in this application can be executed by relevant terminal devices, and the following descriptions all use a data processing terminal as the execution subject.

[0071] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a data circulation method according to the first embodiment of this application. The first embodiment of this application provides a data circulation method applied to a data processing end, which is communicatively connected to both a data demand end and a data provider end; the method includes steps S101-S103:

[0072] S101. Obtain the encrypted authorized data; wherein, the encrypted authorized data is obtained by the data requester and the data provider jointly encrypting the authorized data, and the authorized data is determined by the data provider based on the target data scope and data usage permissions requested by the data requester.

[0073] S102. Respond to the authorized data usage request sent by the data requesting party, triggering the data requesting party and the data providing party to jointly decrypt the authorized data ciphertext to obtain the authorized data plaintext;

[0074] S103. If the data processing strategy at the data processing end conforms to the data usage rules at the data provider end, the authorized plaintext data is processed according to the data processing strategy to obtain the processing result, and the processing result is returned to the data request end; wherein, the data usage rules are generated by the data provider end based on the data usage permissions.

[0075] It should be noted that the data request end can be a terminal device with communication capabilities, such as a mobile phone, tablet, or computer held by the data requester, or it can be a server-side device used by the data requester; the data provider end can be a terminal device with communication capabilities, such as a mobile phone, tablet, or computer held by the data provider, or it can be a server-side device used by the data provider; the data processing end can be a server-side device or platform used by a third party. The data processing end performs trusted authentication with both the data requester and the data provider to establish communication connections with each of them separately.

[0076] As an example, the data requester applies to the data provider for permission to use the target data based on its own data usage needs. The data provider then manages the authorization based on the target data scope and data usage permissions requested by the data requester, determines the authorized data, generates data usage rules based on the data usage permissions requested by the data requester, and jointly encrypts the authorized data with the data requester to obtain the authorized data ciphertext. The authorized data ciphertext is then sent to the data processing end, allowing the data processing end to obtain the authorized data ciphertext.

[0077] During the data usage phase, once the data requester confirms that they have obtained the permission to use the target data, that is, the authorized data, they can send an authorized data usage request to the data processing end whenever they need to use the authorized data.

[0078] After obtaining the encrypted authorized data, the data processing end waits to receive the authorized data usage request from the data requesting end. Upon receiving the authorized data usage request, it responds to the request, triggering the data requesting end and the data providing end to jointly decrypt the encrypted authorized data to obtain the plaintext authorized data. After confirming that the data processing end's data processing strategy conforms to the data providing end's data usage rules, it performs calculations on the plaintext authorized data according to the data processing end's data processing strategy, obtains the calculation result, and returns the calculation result to the data requesting end. After that, the data requesting end can receive the calculation result and complete the use of the authorized data.

[0079] Among them, the data processing strategy of the data processing end is generated by the data processing end in response to the authorized data use request.

[0080] In practical applications, to avoid data leakage, the data processing end needs to clear its local running status and delete all data information from the current calculation process after returning the calculation results to the data request end.

[0081] This application embodiment introduces a trusted third party, namely a data processing terminal, jointly trusted by the data requester and the data provider. The data processing terminal determines the authorized data based on the target data scope and data usage permissions requested by the data requester, as determined by the data provider. After the data requester and data provider jointly encrypt the authorized data to obtain ciphertext, the data processing terminal responds to the authorized data usage request sent by the data requester, triggering joint decryption of the ciphertext to obtain plaintext. If the data processing terminal's data processing strategy conforms to the data provider's data usage rules, the data processing terminal performs calculations on the plaintext according to its data processing strategy and returns the calculation result to the data requester. Firstly, in the data authorization phase, the data provider targets the data requester... The system employs several mechanisms: First, it manages the scope of target data and data usage permissions, effectively ensuring controllable access to authorized data. Second, under the premise of controllable authorization of target data, it collaborates with both the data requester and data provider to encrypt authorized data, effectively guaranteeing the security of authorized data and making it invisible to the data requester. Third, during the data usage phase, the data provider can participate only in the decryption process of the encrypted authorized data, without having to perform a series of complex calculations online throughout the process, effectively improving the feasibility of the data provider providing data externally and enabling the data requester to access the authorized data. Fourth, the data processing end directly performs corresponding calculations on the plaintext of the authorized data, ensuring that plaintext calculations are performed in a secure and trustworthy environment, effectively reducing data computation overhead, thereby ensuring the secure and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0082] In an optional embodiment, the data requester and the data provider are connected in communication; the authorized data is obtained by: the data requester sending a target data authorization request to the data provider; wherein the target data authorization request includes the target data scope and data usage permissions; the data provider responding to the target data authorization request, determining the target data according to the target data scope, and determining the target data as authorized data if the data requester is allowed to use the target data according to the data usage permissions.

[0083] As an example, the data demand side and the data provider side communicate with each other.

[0084] During the data authorization phase, the data requester inputs the target data scope and data usage permissions on the data request platform based on their data usage needs. Data usage permissions include one or more of the following: data usage method and data usage duration. For example, the target data scope may be dataset A and dataset B stored on the data provider's platform; data usage permissions may include the data usage method (collecting the mode of data from datasets A and B) and the data usage duration (one month from the date of request).

[0085] After obtaining the target data scope and data usage permissions input by the data requester, the data requester generates a target data authorization request that includes the target data scope and data usage permissions, and sends the target data authorization request to the data provider.

[0086] Upon receiving a target data authorization request, the data provider responds to the request, extracts the target data scope and data usage permissions from the request, determines the target data based on the target data scope, and, according to the pre-stored authorization management policy, determines whether the data requester is allowed to use the target data according to the data usage permissions. If the data requester is allowed to use the target data according to the data usage permissions, the target data is determined to be authorized data; otherwise, a target data authorization failure response is returned to the data requester.

[0087] In practical applications, authorization management policies can be customized by the data provider.

[0088] In an optional implementation of this embodiment, the target data authorization request carries a digital signature from the data requester; before responding to the target data authorization request, the method further includes: determining, through the data provider, that the digital signature has been verified.

[0089] As an example, after obtaining the target data scope and data usage permissions input by the data requester, the data requester generates a target data authorization request that includes the target data scope and data usage permissions, and digitally signs the request data of the target data authorization request so that the target data authorization request carries the digital signature of the data requester, so as to send the target data authorization request to the data provider.

[0090] Upon receiving a target data authorization request, the data provider verifies the digital signature of the data requester carried in the request. If the digital signature of the data requester is verified, the provider considers the identity information of the data requester to be correctly identified and allows the provider to respond to the target data authorization request. If the digital signature of the data requester fails to be verified, the provider considers the identity information of the data requester to be incorrectly identified, does not allow the provider to respond to the target data authorization request, and directly returns a target data authorization failure response to the data requester.

[0091] By having the data requester send a target data authorization request carrying its own digital signature to the data provider, and the data provider only allowing the response to the target data authorization request after verifying that the data requester's digital signature has been verified, the use of target data by legitimate data requesters can be guaranteed, further improving the security of authorized data.

[0092] This application embodiment involves the data requester sending a target data authorization request, including the target data range and data usage permissions, to the data provider. The data provider responds to the target data authorization request, determines the target data based on the target data range, and, if the data requester is allowed to use the target data according to the data usage permissions, determines the target data as authorized data. This ensures that the data provider accurately manages the authorization of the target data range and data usage permissions requested by the data requester during the data authorization stage, effectively guaranteeing the controllability of the usage permissions of the authorized data.

[0093] In an optional embodiment, the data requester and the data provider are connected in communication. The authorized data ciphertext is obtained through the following methods: the data requester sends its public key to the data provider; the data provider performs hierarchical encryption or collaborative encryption on the authorized data based on the public key of the data provider and the public key of the data requester to obtain the authorized data ciphertext; or, the data requester sends its public key to the data provider; the data provider encrypts the authorized data based on its encryption key to obtain the initial data ciphertext; the data provider performs hierarchical encryption or collaborative encryption on the encryption key based on the public key of the data provider and the public key of the data requester to obtain the encryption key ciphertext; and the data provider obtains the authorized data ciphertext based on the initial data ciphertext and the encryption key ciphertext.

[0094] As an example, the data demand side and the data provider side communicate with each other.

[0095] During the data authorization phase, the data requester sends its public key to the data provider.

[0096] In practical applications, the data requester can add its public key to the target data authorization request and digitally sign the request data. This ensures that the target data authorization request includes both the data requester's public key and digital signature, which is then sent to the data provider. Upon receiving the target data authorization request, the data provider verifies the data requester's digital signature. If the digital signature passes verification, the provider considers the data requester's identity information correctly authenticated, confirms that the public key in the target data authorization request is indeed the data requester's public key, and obtains the data requester's public key.

[0097] After obtaining the public key from the data requester and confirming the authorized data, the data provider can choose any of the following encryption methods to jointly encrypt the authorized data, obtaining the ciphertext of the authorized data: 1. Hierarchical encryption based on public keys: The authorized data is encrypted hierarchically using the public keys of both the data provider and the data requester, resulting in the ciphertext of the authorized data; 2. Collaborative encryption based on public keys: The authorized data is collaboratively encrypted using the public keys of both the data provider and the data requester, resulting in the ciphertext of the authorized data; 3. Hierarchical encryption based on encryption keys: The authorized data is first encrypted using the encryption key of the data provider. 1. **Collaborative Encryption Based on Encryption Keys:** First, the authorized data is encrypted using the encryption key of the data provider to obtain the initial ciphertext. Then, based on the public keys of the data provider and the data requester, the encryption key of the data provider is encrypted hierarchically to obtain the encryption key ciphertext. Finally, the authorized data ciphertext is obtained based on the initial ciphertext and the encryption key ciphertext. 2. **Collaborative Encryption Based on Encryption Keys:** First, the authorized data is encrypted using the encryption key of the data provider to obtain the initial ciphertext. Then, based on the public keys of the data provider and the data requester, the encryption key of the data provider is encrypted collaboratively to obtain the encryption key ciphertext. Finally, the authorized data ciphertext is obtained based on the initial ciphertext and the encryption key ciphertext.

[0098] If the data provider adopts a public key-based hierarchical encryption method, the authorized data is first encrypted using the public key of the data provider to obtain the first authorized data ciphertext, and then the first authorized data ciphertext is encrypted using the public key of the data requester to obtain the authorized data ciphertext.

[0099] If the data provider adopts a public-key-based collaborative encryption method, then the collaborative public key is determined based on the public key of the data provider and the public key of the data requester, and the authorized data is encrypted using the collaborative public key to obtain the authorized data ciphertext.

[0100] The specific process for determining the collaborative public key is as follows: The data provider generates a random number d1 as its private key based on its own public key P1=[d1]G. The data requester generates a random number d2 as its private key based on its own public key P2=[d2]G. The data provider calculates the collaborative public key P=[d1]P2 based on its private key d1 and its public key P2.

[0101] In practical applications, the public key of the data processing end can also be added to determine the collaborative public key. The specific process of determining the collaborative public key is as follows: The data request end generates a random number d2 as its private key based on its own public key P2=[d2]G. The data processing end generates a random number d3 as its private key based on its own public key P3=d3[G] and calculates the elliptic curve point P4=[d3]P2. The data provider generates a random number d1 as its private key based on its own public key P1=[d1]G and calculates the collaborative public key P=[d1]P4 based on the private key d1 of the data provider and the elliptic curve point P4 of the data processing end.

[0102] It should be noted that G represents the base point of the elliptic curve, d1, d2 and d3 ∈ [1, n-1], and n represents the order of the elliptic curve.

[0103] This can be achieved using elliptic curve cryptography algorithms, such as the SM2 algorithm, to encrypt the authorization data M using the collaborative public key P, resulting in the authorization data ciphertext C, as detailed below:

[0104] (1) Generate the first random number k, where k∈[1,n-1], n is the order of the elliptic curve, and perform scalar multiplication operation based on the first random number k and the base point G of the elliptic curve to obtain the first bit string C1= [k]G;

[0105] (2) Perform scalar multiplication based on the first random number k and the collaborative public key P to obtain the first elliptic curve point [k]P=(x1,y1);

[0106] (3) Based on the predefined key derivation function, determine the first security key t=KDF(x1||y1, klen) according to the first elliptic curve point (x1,y1), where klen is the bit length of the authorized data M;

[0107] (4) If the first security key t is a string of all zero bits, report an error and exit;

[0108] (5) If the first security key t is not a string of all zero bits, the authorized data M is encrypted according to the first security key t to obtain the second bit string C2=M⊕t, where ⊕ represents the bitwise XOR operation;

[0109] (6) Perform a hash operation based on the first elliptic curve point (x1, y1) and the authorized data M to obtain the third bit string C3=Hash(x1||M||y1);

[0110] (7) Based on the first bit string C1, the second bit string C2 and the third bit string C3, the authorized data ciphertext C = C1||C3||C2 is obtained.

[0111] If the data provider adopts a hierarchical encryption method based on encryption keys, the process is as follows: First, the authorized data is encrypted using the encryption key of the data provider to obtain the initial data ciphertext. Then, the encryption key is encrypted using the public key of the data provider to obtain the first encryption key ciphertext. Next, the first encryption key ciphertext is encrypted using the public key of the data requester to obtain the encryption key ciphertext. Finally, the authorized data ciphertext is obtained based on the initial data ciphertext and the encryption key ciphertext.

[0112] If the data provider adopts a collaborative encryption method based on encryption keys, the process is as follows: First, the authorized data is encrypted using the encryption key of the data provider to obtain the initial data ciphertext. Then, a collaborative public key is determined based on the public key of the data provider and the public key of the data requester, and the encryption key is encrypted using the collaborative public key to obtain the encryption key ciphertext. Finally, the authorized data ciphertext is obtained based on the initial data ciphertext and the encryption key ciphertext.

[0113] In practical applications, the data provider can concatenate the initial data ciphertext and the encryption key ciphertext to obtain the authorized data ciphertext.

[0114] In practical applications, the encryption key can be a temporary symmetric key.

[0115] After obtaining the encrypted authorized data, the data provider can return the encrypted authorized data to the data requester, who can then forward it to the data processing end. Alternatively, the data requester can directly send the encrypted authorized data to the data processing end.

[0116] This application embodiment involves the data requester sending its public key to the data provider. The data provider then selects a hierarchical encryption method based on the public key, a collaborative encryption method based on the public key, a hierarchical encryption method based on the encryption key, or a collaborative encryption method based on the encryption key to jointly encrypt the authorized data, thereby obtaining the encrypted authorized data. This allows for the flexible selection of multiple encryption methods to jointly encrypt the authorized data, effectively ensuring the security of the authorized data.

[0117] In an optional embodiment of this example, before performing hierarchical encryption or collaborative encryption on the authorized data based on the public key of the data provider and the public key of the data requester to obtain the authorized data ciphertext, or before encrypting the authorized data based on the encryption key of the data provider to obtain the initial data ciphertext, the method further includes: obtaining key holding proof information from the data requester through the data provider, and determining that the key holding proof information has been verified.

[0118] As an example, after determining the authorized data, the data provider can first obtain the key holding proof information of the data requester for verification. Then, if the key holding proof information of the data requester is verified, the provider can choose a public key-based hierarchical encryption method, a public key-based collaborative encryption method, a encryption key-based hierarchical encryption method, or an encryption key-based collaborative encryption method to jointly encrypt the authorized data and obtain the authorized data ciphertext.

[0119] It should be noted that the key holding proof information of the data requester includes proof information that the data requester holds the public key.

[0120] Understandably, if the data provider determines that the key holding proof information of the data requester has been verified, then the public key of the data requester is considered valid. In this case, the following encryption methods are supported: hierarchical encryption based on public key, collaborative encryption based on public key, hierarchical encryption based on encryption key, and collaborative encryption based on encryption key. Otherwise, the public key of the data requester is considered invalid, and the following encryption methods are not supported: hierarchical encryption based on public key, collaborative encryption based on public key, hierarchical encryption based on encryption key, and collaborative encryption based on encryption key.

[0121] In practical applications, to improve the efficiency of data authorization processing, the data provider can first verify the key holding certificate information of the data requester. If the key holding certificate information of the data requester passes verification, the provider can then authorize the target data requested by the data requester according to the data usage permissions requested by the data requester, obtain authorized data, and then jointly encrypt the authorized data using one of the following methods: public key-based hierarchical encryption, public key-based collaborative encryption, encryption key-based hierarchical encryption, or encryption key-based collaborative encryption, to obtain the encrypted authorized data. If the key holding certificate information of the data requester fails verification, the provider can directly return a data authorization failure response to the data requester.

[0122] By having the data provider verify the key holding certificate information of the data requester during the data authorization phase, and only using the public key of the data requester to encrypt the authorized data if the key holding certificate information of the data requester is verified, the effective encryption of the authorized data can be guaranteed, further improving the security of the authorized data.

[0123] In an optional implementation of this embodiment, the target data authorization request includes the public key of the data requester.

[0124] As an example, in addition to sending its public key to the data provider separately, the data requester can also send a target data authorization request containing the data requester's public key to the data provider.

[0125] In an optional implementation of this embodiment, the target data authorization request includes the public key and key holding proof information of the data requester.

[0126] As an example, in addition to sending its key holding proof information to the data provider separately, the data requester can also send a target data authorization request to the data provider that includes the public key and the data requester's key holding proof information.

[0127] For example, a data flow diagram for negotiating target data authorization between the data demand side and the data provider side is as follows: Figure 2 As shown.

[0128] In an optional embodiment, the joint decryption of the authorized data ciphertext by the data requester and the data provider to obtain the authorized data plaintext includes: generating a first decryption request and a second decryption request for the authorized data ciphertext based on the data authorization information corresponding to the authorized data ciphertext; sending the first decryption request to the data requester and obtaining a first decryption result returned by the data requester; sending the second decryption request to the data provider and obtaining a second decryption result returned by the data provider; and determining the authorized data plaintext based on the first decryption result and the second decryption result.

[0129] As an example, after receiving an authorization data usage request sent by the data requester, the data processing end responds to the authorization data usage request, generates a first decryption request and a second decryption request for the authorization data ciphertext based on the data authorization information corresponding to the previously obtained authorization data ciphertext, sends the first decryption request to the data requester, obtains a first decryption result returned by the data requester, and sends the second decryption request to the data provider, obtains a second decryption result returned by the data provider, and determines the authorization data plaintext based on the first decryption result and the second decryption result.

[0130] In practical applications, the encrypted authorized data and the corresponding data authorization information can be received by the data requesting end from the data providing end and forwarded to the data processing end, or the data processing end can receive it directly from the data providing end.

[0131] In one optional implementation of this embodiment, the data authorization information includes the identity information of the data provider, the identity information of the data requester, and the association information of the authorized data.

[0132] As an example, the data processing end responds to the authorized data usage request, retrieves the encrypted authorized data and the corresponding data authorization information, extracts the identity information of the data provider, the identity information of the data requester, and the associated information of the authorized data from the data authorization information. For example, the associated information of the authorized data includes the encryption method selected by the data provider for the authorized data. Based on the identity information of the data provider, the data provider is identified; based on the identity information of the data requester, the data requester is identified; and based on the associated information of the authorized data, a joint decryption request generation strategy is determined. Based on the joint decryption request generation strategy, a first decryption request and a second decryption request for the encrypted authorized data are generated. The first decryption request is sent to the data requester to obtain a first decryption result returned by the data requester, and the second decryption request is sent to the data provider to obtain a second decryption result returned by the data provider. Based on the first decryption result and the second decryption result, the plaintext authorized data is determined.

[0133] Specifically, if the data provider encrypts the authorized data using the aforementioned public-key-based hierarchical encryption method, the data processing end first generates a first decryption request containing the authorized data ciphertext, sends the first decryption request to the data requesting end, and causes the data requesting end to respond to the first decryption request to decrypt the authorized data ciphertext according to the data requesting end's private key and return the obtained second authorized data ciphertext. Then, the processing end receives the second authorized data ciphertext, generates a second decryption request containing the second authorized data ciphertext, sends the second decryption request to the data provider, and causes the data provider to respond to the second decryption request to decrypt the second authorized data ciphertext according to the data provider's private key and return the obtained authorized data plaintext. Finally, the processing end receives the authorized data plaintext.

[0134] If the data provider encrypts the authorized data using the aforementioned public-key-based collaborative encryption method, the data processing end first generates a first decryption request and sends it to the data requesting end, causing the data requesting end to respond to the first decryption request and return an intermediate decryption result. Then, it generates a second decryption request and sends it to the data provider, causing the data provider to respond to the second decryption request and return an intermediate decryption result. Finally, it decrypts the authorized data ciphertext based on the intermediate decryption result to obtain the authorized data plaintext.

[0135] Among these methods, elliptic curve cryptography algorithms, such as the SM2 algorithm, can be used to decrypt the authorized data ciphertext, as detailed below:

[0136] (1) The data processing end extracts the first bit string C1 from the authorized data ciphertext C, verifies whether C1 is a point on the elliptic curve, if so, proceeds to (2), otherwise reports an error and exits;

[0137] (2) The data processing end calculates the elliptic curve point S = [h]C1. If S is not at infinity, proceed to (3). If S is at infinity, report an error and exit. The cofactor h refers to the ratio of the order of the entire elliptic curve group to the order of the subgroup generated by the selected base point.

[0138] (3) The data processing end generates a second random number k'∈[1,n-1], calculates Q=C1-[k']G, and calculates Q3= d3Q;

[0139] (4) The data processing end sends Q3 to the data request end, the data request end calculates Q2 = d2Q3, and returns Q2 to the data processing end;

[0140] (5) The data processing end sends Q2 to the data providing end, the data providing end calculates Q1 = d1Q2, and returns Q1 to the data processing end;

[0141] (6) The data processing end calculates (x2,y2) =Q1+k'P;

[0142] (7) Calculate t=KDF(x2||y2,klen). If t is not a string of all zero bits, proceed to (8). If t is a string of all zero bits, report an error and exit.

[0143] (8) Extract the second bit string C2 from the authorized data ciphertext C, and calculate M'=C2⊕t;

[0144] (9) Calculate u=Hash(x2||M'||y2), take the third bit string C3 from C. If u=C3, then proceed to (10). If u ≠C3, then report an error and exit.

[0145] (10) Output the plaintext authorization data M'.

[0146] If the data provider encrypts the authorized data using the aforementioned hierarchical encryption method based on the encryption key, the data processing end first determines the initial data ciphertext and the encryption key ciphertext based on the authorized data ciphertext. Then, it generates a first decryption request including the encryption key ciphertext and sends it to the data requesting end. The data requesting end responds to the first decryption request to decrypt the encryption key ciphertext using its private key and returns the obtained third encryption key ciphertext. Next, it receives the third encryption key ciphertext, generates a second decryption request including the third encryption key ciphertext, and sends it to the data provider. The data provider responds to the second decryption request to decrypt the third encryption key ciphertext using its private key and returns the obtained encryption key. Finally, it receives the encryption key and decrypts the initial data ciphertext using the encryption key to obtain the authorized data plaintext.

[0147] If the data provider encrypts the authorized data using the aforementioned collaborative encryption method based on the encryption key, the data processing end first determines the initial data ciphertext and the encryption key ciphertext based on the authorized data ciphertext, then generates a first decryption request and sends it to the data requesting end, causing the data requesting end to respond to the first decryption request and return an intermediate decryption result. Next, it generates a second decryption request and sends it to the data provider, causing the data provider to respond to the second decryption request and return an intermediate decryption result. Then, it decrypts the encryption key ciphertext based on the intermediate decryption result to obtain the encryption key. Finally, it decrypts the initial data ciphertext based on the encryption key to obtain the authorized data plaintext.

[0148] In one optional implementation of this embodiment, the data authorization information carries the digital signature of the data provider.

[0149] As an example, since the data authorization information corresponding to the encrypted data carries the digital signature of the data provider, after receiving the data authorization information corresponding to the encrypted data, the data processing end needs to verify the digital signature of the data provider carried in the data authorization information, and only allows the response to the authorized data usage request sent by the data requesting end after confirming that the digital signature of the data provider has been verified.

[0150] In another optional embodiment of this example, sending a second decryption request to the data provider and obtaining a second decryption result returned by the data provider includes: sending a second decryption request to the data provider through the data request end; obtaining a second decryption result returned by the data provider through the data request end; wherein the second decryption request includes the public key of the data processing end, and the second decryption result is obtained by the data provider through encryption based on the public key of the data processing end.

[0151] As an example, to reduce the communication pressure on the data processing end, the data processing end can also send a second decryption request containing its own public key to the data request end. The data request end then sends the second decryption request to the data provider end, causing the data provider end to respond to the second decryption request and perform the corresponding decryption processing. Based on the public key of the data processing end, the data provider end encrypts the obtained decryption result and returns the obtained second decryption result to the data request end, which then receives the second decryption result.

[0152] By forwarding a second decryption request containing the public key of the data processing end from the data requester to the data provider, and forwarding the second decryption result obtained by the data provider through encryption based on the public key of the data processing end to the data processing end, the communication pressure on the data processing end can be reduced while effectively preventing the data requester from obtaining the relevant decryption result, thus ensuring that the data requester uses the authorized data within the authorized scope.

[0153] This application embodiment generates a first decryption request and a second decryption request for the authorized data ciphertext based on the data authorization information corresponding to the authorized data ciphertext. The first decryption request is sent to the data request end, and a first decryption result is returned by the data request end. The second decryption request is sent to the data provider end, and a second decryption result is returned by the data provider end. Based on the first decryption result and the second decryption result, the authorized data plaintext is determined. This can efficiently trigger the data request end and the data provider end to jointly decrypt the authorized data ciphertext, ensuring accurate acquisition of the authorized data plaintext.

[0154] In an optional embodiment, the first decryption request includes first remote authentication information from the data processing end, and the second decryption request includes second remote authentication information from the data processing end. The first decryption result and the second decryption result are obtained in the following ways: the data requesting end responds to the first decryption request, verifies the first remote authentication information, and decrypts the authorized data ciphertext if the first remote authentication information is verified, to obtain the first decryption result; the data providing end responds to the second decryption request, verifies the second remote authentication information, and decrypts the authorized data ciphertext if the second remote authentication information is verified, to obtain the second decryption result.

[0155] As an example, during the generation of the first decryption request, the data processing terminal adds its first remote authentication information to the first decryption request, making the first decryption request include the data processing terminal's first remote authentication information. Similarly, during the generation of the second decryption request, the data processing terminal adds its second remote authentication information to the second decryption request, making the second decryption request include the data processing terminal's second remote authentication information.

[0156] It should be noted that the first and second remote authentication information of the data processing terminal includes information used to prove the identity of the data processing terminal.

[0157] Upon receiving the first decryption request from the data processing end, the data requesting end responds to the first decryption request, extracts the first remote authentication information of the data processing end from the first decryption request, and verifies the first remote authentication information of the data processing end. If the first remote authentication information of the data processing end passes the verification, it is considered that the identity information of the data processing end is correctly identified, and the corresponding decryption processing is performed on the authorized data ciphertext to obtain the first decryption result. If the first remote authentication information of the data processing end fails the verification, it is considered that the identity information of the data processing end is incorrectly identified, and a data usage failure response is returned to the data requesting end.

[0158] Similarly, after receiving the second decryption request from the data processing end, the data provider responds to the second decryption request, extracts the second remote authentication information of the data processing end from the second decryption request, verifies the second remote authentication information of the data processing end, and if the second remote authentication information of the data processing end passes the verification, it is considered that the identity information of the data processing end is correctly identified, and continues to perform corresponding decryption processing on the authorized data ciphertext to obtain the second decryption result. If the second remote authentication information of the data processing end fails the verification, it is considered that the identity information of the data processing end is incorrectly identified, and a data use failure response is returned to the data request end.

[0159] This application embodiment, by having the data processing end add first remote authentication information of the data processing end to the first decryption request and second remote authentication information of the data processing end to the second decryption request, ensures that the data requesting end only decrypts the authorized data ciphertext after confirming that the first remote authentication information of the data processing end has been verified, and that the data providing end only decrypts the authorized data ciphertext after confirming that the second remote authentication information of the data processing end has been verified. This effectively guarantees the secure and reliable communication environment among the data processing end, the data requesting end, and the data providing end, thereby further ensuring the secure and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0160] In an optional embodiment, verifying the first remote authentication information includes: comparing the first remote authentication information with locally stored standard remote authentication information via the data request end; if the first remote authentication information matches the standard remote authentication information via the data request end, then the first remote authentication information is determined to have passed verification; otherwise, the first remote authentication information is determined to have failed verification. Verifying the second remote authentication information includes: comparing the second remote authentication information with locally stored standard remote authentication information via the data provider end; if the second remote authentication information matches the standard remote authentication information via the data provider end, then the second remote authentication information is determined to have passed verification; otherwise, the second remote authentication information is determined to have failed verification. The standard remote authentication information is obtained by the data request end and the data provider end through a trusted channel.

[0161] As an example, the data demander and the data provider obtain standard remote verification information from trusted channels for local storage in advance.

[0162] During the generation of the first decryption request, the data processing terminal adds its first remote authentication information to the first decryption request, making the first decryption request include the data processing terminal's first remote authentication information. Similarly, during the generation of the second decryption request, the data processing terminal adds its second remote authentication information to the second decryption request, making the second decryption request include the data processing terminal's second remote authentication information.

[0163] It should be noted that the standard remote authentication information, the first remote authentication information, and the second remote authentication information of the data processing end are used to remotely prove that the operating environment of the data processing end is secure and trustworthy, and that the execution function meets expectations.

[0164] After receiving the first decryption request from the data processing end, the data request end responds to the first decryption request, extracts the first remote authentication information of the data processing end from the first decryption request, retrieves the standard remote authentication information of the data processing end stored locally, and compares the first remote authentication information of the data processing end with the standard remote authentication information of the data processing end. If the first remote authentication information of the data processing end and the standard remote authentication information of the data processing end are consistent, it is determined that the first remote authentication information of the data processing end has passed the verification; otherwise, it is determined that the first remote authentication information of the data processing end has failed the verification.

[0165] Similarly, after receiving the second decryption request sent by the data processing end, the data provider responds to the second decryption request, extracts the second remote authentication information of the data processing end from the second decryption request, retrieves the standard remote authentication information of the data processing end stored locally, and compares the second remote authentication information of the data processing end with the standard remote authentication information of the data processing end. If the second remote authentication information of the data processing end and the standard remote authentication information of the data processing end are consistent, it is determined that the second remote authentication information of the data processing end has passed the verification; otherwise, it is determined that the second remote authentication information of the data processing end has failed the verification.

[0166] This application embodiment achieves this by having the data requester and data provider pre-obtain standard remote authentication information from a trusted channel for local storage. The data processing end adds its first remote authentication information to the first decryption request and its second remote authentication information to the second decryption request. This ensures that the data requester only decrypts the authorized data ciphertext if it confirms that the first remote authentication information and the standard remote authentication information of the data processing end are consistent, and the data provider only decrypts the authorized data ciphertext if it confirms that the second remote authentication information and the standard remote authentication information of the data processing end are consistent. This effectively guarantees the secure and reliable communication environment and the effective and reliable execution functions among the three ends: the data processing end, the data requester, and the data provider. This further ensures the secure and efficient flow of transaction data and promotes the healthy trading and flow of data assets.

[0167] In an optional embodiment, before decrypting the authorized data ciphertext to obtain a second decryption result, the method includes: determining, through the data provider, that the data processing strategy conforms to the data usage rules.

[0168] As an example, after receiving the second decryption request sent by the data processing end, the data provider responds to the second decryption request, extracts the second remote authentication information of the data processing end from the second decryption request, verifies the second remote authentication information of the data processing end, and if the second remote authentication information of the data processing end passes the verification, it continues to determine whether the data processing strategy of the data processing end conforms to the data usage rules of the local storage. If the data processing strategy of the data processing end conforms to the data usage rules, it is considered that the data operation performed by the data processing end according to the data processing strategy is restricted to the scope of the target data's usage permissions. At this time, the authorized data ciphertext can be decrypted accordingly to obtain the second decryption result. If the data processing strategy of the data processing end does not conform to the data usage rules, it is considered that the data operation performed by the data processing end according to the data processing strategy exceeds the scope of the target data's usage permissions. At this time, a data usage failure response can be directly returned to the data request end.

[0169] This application embodiment allows the data provider to decrypt the encrypted authorized data only after verifying the second remote authentication information of the data processing terminal and confirming that the data processing terminal's data processing strategy complies with the data usage rules. This results in a second decryption result, enabling the data provider to review the data processing terminal's processing strategy for authorized data. This ensures that the data processing terminal processes authorized data within the scope of its data usage permissions, thereby further guaranteeing the secure and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0170] In an optional embodiment, determining that the data processing strategy conforms to the data usage rules includes: comparing the description data of the data processing strategy with the description data of the data usage rules stored locally through the data provider; and determining that the data processing strategy conforms to the data usage rules if the description data of the data processing strategy matches the description data of the data usage rules through the data provider.

[0171] As an example, the data processing end sends a description of the data processing strategy to the data providing end.

[0172] In practical applications, in addition to sending the description data of the data processing strategy to the data provider separately, the data processing end can also add the description data of the data processing strategy to the second decryption request during the generation of the second decryption request, so that the second decryption request includes the description data of the data processing strategy.

[0173] Upon receiving the second decryption request from the data processing end, the data provider responds by extracting the second remote authentication information from the request and verifying it. If the verification is successful, the provider retrieves the previously obtained description data of the data processing strategy and compares it with the description data of the locally stored data usage rules. If the description data matches, the data processing strategy is considered to be within the scope of the target data's usage permissions, and the data processing strategy is deemed to comply with the data usage rules. The authorized data ciphertext can then be decrypted to obtain the second decryption result. If the description data does not match, the data processing strategy is considered to be exceeding the scope of the target data's usage permissions, and the data processing strategy is deemed to be inconsistent with the data usage rules. The provider can then directly return a data usage failure response to the data requesting end.

[0174] In practical applications, the descriptive data of a data processing strategy includes one or more of the following: data usage method and data usage time. For example, the data provider can determine whether the descriptive data of the data processing strategy is consistent with the descriptive data of the data usage rules by comparing whether the data usage method in the data processing strategy is consistent with the data usage method in the data usage rules, and by comparing whether the data usage time in the data processing strategy is within the data usage time limit in the data usage rules.

[0175] This application embodiment determines whether a data processing strategy complies with data usage rules by having the data provider use a descriptive data comparison method. This ensures that the data provider can quickly and accurately determine whether a data processing strategy complies with data usage rules, thereby further ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0176] For example, a data flow diagram showing the negotiation and authorization of data usage between the data processing end, the data demand end, and the data provider end is as follows: Figure 3 As shown.

[0177] In an optional embodiment, the data processing terminal is a terminal that includes a program running in a trusted execution environment or a service built on a trusted execution environment.

[0178] As an example, depending on the actual application requirements, a program running in a Trusted Execution Environment (TEE) or a service built on a TEE can be configured on any terminal. This terminal can be used as a data processing end, enabling the data processing end to perform trusted authentication with both the data requester and the data provider, thereby establishing communication connections with both parties respectively.

[0179] By selecting a terminal configured with programs running in a trusted execution environment or services built on a trusted execution environment as the data processing end, a trusted third-party terminal that is trusted by both the data requester and the data provider can be introduced. This not only provides the data requester with data processing capabilities authorized by the data provider, but also transfers the core operations in the authorized data usage process to the data processing end, effectively reducing the processing pressure on the data provider.

[0180] In practical applications, programs running in a trusted execution environment or services built on a trusted execution environment can also be configured directly on the data demand side / data provider side.

[0181] This application embodiment selects a terminal that includes a program running in a trusted execution environment or a service built on a trusted execution environment as the data processing terminal, which can introduce a third-party trusted terminal to participate in the authorized data use process, thereby further ensuring the safe and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0182] To more clearly illustrate the data flow method provided in the first embodiment of this application, the data flow diagram of the data flow method is as follows: Figure 4 As shown.

[0183] Please refer to Figure 5 , Figure 5This is a schematic diagram of a data circulation system provided in the second embodiment of this application. The second embodiment of this application provides a data circulation system including a data processing terminal 201; the data processing terminal 201 is communicatively connected to a data demand terminal and a data provider terminal; the data processing terminal 201 is used for: obtaining authorized data ciphertext; wherein, the authorized data ciphertext is obtained by the data demand terminal and the data provider terminal jointly encrypting authorized data, and the authorized data is determined by the data provider terminal based on the target data range and data usage permissions requested by the data demand terminal; responding to an authorized data usage request sent by the data demand terminal, triggering the data demand terminal and the data provider terminal to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext; and, if the data processing strategy of the data processing terminal 201 conforms to the data usage rules of the data provider terminal, performing calculations on the authorized data plaintext according to the data processing strategy to obtain the calculation result, and returning the calculation result to the data demand terminal; wherein, the data usage rules are generated by the data provider terminal based on data usage permissions.

[0184] In an optional embodiment, the system further includes a data requester and a data provider, with the data requester and data provider communicating with each other; the authorized data is obtained through the following methods:

[0185] The data request side is used to send a target data authorization request to the data provider side; the target data authorization request includes the target data scope and data usage permissions;

[0186] The data provider is used to respond to the target data authorization request, determine the target data according to the target data range, and determine the target data as authorized data if the data requesting party is allowed to use the target data according to the data usage permissions.

[0187] In an optional embodiment, the system further includes a data requester and a data provider, which are communicatively connected. The data requester is used to send its public key to the data provider. The data provider is used to perform hierarchical encryption or collaborative encryption on the authorized data based on the public key of the data provider and the public key of the data requester to obtain authorized data ciphertext. Alternatively, the data requester is used to send its public key to the data provider. The data provider is used to encrypt the authorized data based on its encryption key to obtain initial data ciphertext. The data provider is used to perform hierarchical encryption or collaborative encryption on the encryption key based on the public key of the data provider and the public key of the data requester to obtain encryption key ciphertext. The data provider is used to obtain authorized data ciphertext based on the initial data ciphertext and encryption key ciphertext.

[0188] In an optional embodiment, the joint decryption of the authorized data ciphertext by the data requester and the data provider to obtain the authorized data plaintext includes: generating a first decryption request and a second decryption request for the authorized data ciphertext based on the data authorization information corresponding to the authorized data ciphertext; sending the first decryption request to the data requester and obtaining a first decryption result returned by the data requester; sending the second decryption request to the data provider and obtaining a second decryption result returned by the data provider; and determining the authorized data plaintext based on the first decryption result and the second decryption result.

[0189] In an optional embodiment, the system includes a data request end and a data provider end; the first decryption request includes first remote authentication information from the data processing end, and the second decryption request includes second remote authentication information from the data processing end; the data request end is used to respond to the first decryption request, verify the first remote authentication information, and, if the first remote authentication information passes verification, decrypt the authorized data ciphertext to obtain a first decryption result; the data provider end is used to respond to the second decryption request, verify the second remote authentication information, and, if the second remote authentication information passes verification, decrypt the authorized data ciphertext to obtain a second decryption result.

[0190] In an optional embodiment, the data requester is configured to: compare the first remote authentication information with the locally stored standard remote authentication information; if the first remote authentication information matches the standard remote authentication information, then determine that the first remote authentication information has passed verification; otherwise, determine that the first remote authentication information has failed verification. The data provider is configured to: compare the second remote authentication information with the standard remote authentication information; if the second remote authentication information matches the locally stored standard remote authentication information, then determine that the second remote authentication information has passed verification; otherwise, determine that the second remote authentication information has failed verification. The standard remote authentication information is obtained by the data requester and the data provider through a trusted channel.

[0191] In an optional embodiment, the data provider is further configured to determine that the data processing strategy conforms to the data usage rules before the authorized data ciphertext is decrypted to obtain the second decryption result.

[0192] In an optional embodiment, the data provider is configured to: compare the description data of the data processing strategy with the description data of the data usage rules stored locally; and determine that the data processing strategy conforms to the data usage rules if the description data of the data processing strategy matches the description data of the data usage rules.

[0193] In an optional embodiment, the data processing terminal is a terminal that includes a program running in a trusted execution environment or a service built on a trusted execution environment.

[0194] The implementation process of the functions and roles of the data processing terminal 201 in the above system is detailed in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0195] Please refer to Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in the third embodiment of this application. The third embodiment of this application provides an electronic device 30, including a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, it implements the method described in the first embodiment of this application and can achieve the same beneficial effects.

[0196] When the processor 301 reads a computer program from the memory 302 via the bus 303 and executes the computer program, it can implement any of the methods described in the first embodiment of this application.

[0197] Processor 301 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 301 may be a microprocessor.

[0198] The memory 302 can be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 301 of this disclosure embodiment can be used to execute instructions in the memory 302 to implement the method described in the first embodiment of this application. The memory 302 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0199] The fourth embodiment of this application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to perform the method described in the first embodiment of this application, and can achieve the same beneficial effects.

[0200] The fifth embodiment of this application provides a computer program product, the computer program product including instructions, which, when executed by a computer, cause the computer to perform the method described in the first embodiment of this application and achieve the same beneficial effects.

[0201] The method described in the first embodiment of this application can be implemented, in whole or in part, by software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the various embodiments of this application are executed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, a core network device, an OAM (Open Application Model), or other programmable devices.

[0202] The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions may be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium may be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; or an optical medium, such as a digital video optical disc; or a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0203] In summary, embodiments of this application provide a data circulation method, system, electronic device, and storage medium. The data circulation method is applied to a data processing end, which is communicatively connected to both a data request end and a data provider end. The method includes: obtaining authorized data ciphertext; wherein the authorized data ciphertext is obtained by the data request end and the data provider end jointly encrypting authorized data, and the authorized data is determined by the data provider end based on the target data range and data usage permissions requested by the data request end; responding to an authorized data usage request sent by the data request end, triggering the data request end and the data provider end to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext; and, if the data processing strategy of the data processing end conforms to the data usage rules of the data provider end, performing calculations on the authorized data plaintext according to the data processing strategy to obtain the calculation result, and returning the calculation result to the data request end; wherein the data usage rules are generated by the data provider end based on data usage permissions. This application embodiment introduces a trusted third party, namely a data processing terminal, jointly trusted by the data requester and the data provider. The data processing terminal determines the authorized data based on the target data scope and data usage permissions requested by the data requester, as determined by the data provider. After the data requester and data provider jointly encrypt the authorized data to obtain ciphertext, the data processing terminal responds to the authorized data usage request sent by the data requester, triggering joint decryption of the ciphertext to obtain plaintext. If the data processing terminal's data processing strategy conforms to the data provider's data usage rules, the data processing terminal performs calculations on the plaintext according to its data processing strategy and returns the calculation result to the data requester. Firstly, in the data authorization phase, the data provider targets the data requester... The system employs several mechanisms: First, it manages the scope of target data and data usage permissions, effectively ensuring controllable access to authorized data. Second, under the premise of controllable authorization of target data, it collaborates with both the data requester and data provider to encrypt authorized data, effectively guaranteeing the security of authorized data and making it invisible to the data requester. Third, during the data usage phase, the data provider can participate only in the decryption process of the encrypted authorized data, without having to perform a series of complex calculations online throughout the process, effectively improving the feasibility of the data provider providing data externally and enabling the data requester to access the authorized data. Fourth, the data processing end directly performs corresponding calculations on the plaintext of the authorized data, ensuring that plaintext calculations are performed in a secure and trustworthy environment, effectively reducing data computation overhead, thereby ensuring the secure and efficient circulation of transaction data and promoting the healthy trading and flow of data assets.

[0204] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0205] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0206] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0207] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data flow method, characterized by, The method is applied to a data processing end, the data processing end is authenticated with a data demand end and a data providing end respectively, and is connected with the data demand end and the data providing end for communication; the method comprises: obtaining an authorized data ciphertext, wherein the authorized data ciphertext is obtained by joint encryption of the data demand end and the data providing end on authorized data, and the authorized data is determined by the data providing end according to a target data range and a data use permission requested by the data demand end; in response to an authorized data use request sent by the data demand end, triggering the data demand end and the data providing end to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext; in the case that a data processing strategy of the data processing end conforms to a data use rule of the data providing end, performing operation on the authorized data plaintext according to the data processing strategy to obtain an operation result, and returning the operation result to the data demand end; wherein the data use rule is generated by the data providing end according to the data use permission; the data demand end is connected with the data providing end for communication; and the authorized data ciphertext is obtained by the following method: sending a public key of the data demand end to the data providing end through the data demand end; encrypting the authorized data according to a public key of the data providing end and the public key of the data demand end through the data providing end to obtain the authorized data ciphertext; or sending a public key of the data demand end to the data providing end through the data demand end; encrypting the authorized data according to an encryption key of the data providing end through the data providing end to obtain an initial data ciphertext; encrypting the encryption key according to the public key of the data providing end and the public key of the data demand end through the data providing end to obtain an encryption key ciphertext; obtaining the authorized data ciphertext according to the initial data ciphertext and the encryption key ciphertext through the data providing end.

2. The method of claim 1, wherein, the data demand end is connected with the data providing end for communication; and the authorized data is obtained by the following method: sending a target data authorization request to the data providing end through the data demand end; wherein the target data authorization request comprises the target data range and the data use permission; in response to the target data authorization request, determining target data according to the target data range through the data providing end, and determining the target data as the authorized data in the case that the data demand end is allowed to use the target data according to the data use permission.

3. The method of claim 1, wherein, the method of triggering the data demand end and the data providing end to jointly decrypt the authorized data ciphertext to obtain authorized data plaintext comprises: generating a first decryption request and a second decryption request for the authorized data ciphertext according to data authorization information corresponding to the authorized data ciphertext; sending the first decryption request to the data demand end to obtain a first decryption result returned by the data demand end; sending the second decryption request to the data providing end to obtain a second decryption result returned by the data providing end; determining the authorized data plaintext according to the first decryption result and the second decryption result.

4. The method of claim 3, wherein, The first decryption request includes first remote proof information of the data processing end, and the second decryption request includes second remote proof information of the data processing end; the first decryption result and the second decryption result are obtained by the following manner: verifying the first remote proof information through the data demand end in response to the first decryption request, and decrypting the authorized data ciphertext to obtain the first decryption result if the first remote proof information passes the verification; verifying the second remote proof information through the data providing end in response to the second decryption request, and decrypting the authorized data ciphertext to obtain the second decryption result if the second remote proof information passes the verification.

5. The method of claim 4, wherein, The verification of the first remote proof information includes: comparing the first remote proof information with standard remote proof information stored locally through the data demand end; if the first remote proof information is consistent with the standard remote proof information, determining that the first remote proof information passes the verification, otherwise determining that the first remote proof information fails the verification through the data demand end; The verification of the second remote proof information includes: comparing the second remote proof information with the standard remote proof information stored locally through the data providing end; if the second remote proof information is consistent with the standard remote proof information, determining that the second remote proof information passes the verification, otherwise determining that the second remote proof information fails the verification through the data providing end; The standard remote proof information is acquired by the data demand end and the data providing end through a trusted channel.

6. The method of claim 4, wherein, Before the decryption of the authorized data ciphertext to obtain the second decryption result, it includes: determining that the data processing strategy conforms to the data use rule through the data providing end.

7. The method of claim 6, wherein, The determination that the data processing strategy conforms to the data use rule includes: comparing description data of the data processing strategy with description data of the data use rule stored locally through the data providing end; if the description data of the data processing strategy is consistent with the description data of the data use rule, determining that the data processing strategy conforms to the data use rule through the data providing end.

8. The method according to any one of claims 1 to 7, characterized in that, The data processing end is a terminal including a program running in a trusted execution environment or a service constructed based on a trusted execution environment.

9. A data flow system, characterized by including a data processing end; the data processing end is respectively authenticated with a data demand end and a data providing end to be connected with the data demand end and the data providing end; the data processing end is configured to: Obtain authorization data ciphertext; wherein the authorization data ciphertext is obtained by joint encryption of authorization data by the data demand side and the data providing side, and the authorization data is determined by the data providing side according to a target data range and data use permission requested by the data demand side for authorization management; In response to an authorization data use request sent by the data demand side, trigger the data demand side and the data providing side to jointly decrypt the authorization data ciphertext to obtain authorization data plaintext; In the case that the data processing strategy of the data processing side conforms to the data use rule of the data providing side, operate the authorization data plaintext according to the data processing strategy to obtain an operation result, and return the operation result to the data demand side; wherein the data use rule is generated by the data providing side according to the data use permission; The data demand side and the data providing side are in communication connection; and the authorization data ciphertext is obtained by the following way: Through the data demand side, send the public key of the data demand side to the data providing side; Through the data providing side, encrypt the authorization data hierarchically or cooperatively according to the public key of the data providing side and the public key of the data demand side to obtain the authorization data ciphertext; or Through the data demand side, send the public key of the data demand side to the data providing side; Through the data providing side, encrypt the authorization data according to the encryption key of the data providing side to obtain initial data ciphertext; Through the data providing side, encrypt the encryption key hierarchically or cooperatively according to the public key of the data providing side and the public key of the data demand side to obtain encryption key ciphertext; Through the data providing side, obtain the authorization data ciphertext according to the initial data ciphertext and the encryption key ciphertext.

10. An electronic device, comprising: A computer readable storage medium includes a computer program stored therein; wherein the computer program controls a device where the computer readable storage medium is located to execute the method according to any one of claims 1 to 8 when the computer program runs.

11. A computer readable storage medium, characterized in that, A computer readable storage medium includes a computer program stored therein; wherein the computer program controls a device where the computer readable storage medium is located to execute the method according to any one of claims 1 to 8 when the computer program runs.

Images