Data processing method and device for data governance in the steel industry

Abstract

The present application discloses a data processing method and device for data governance in the steel industry, belonging to the field of big data technology. The method and device determine whether the data provider has successfully registered by performing a first composite hash operation based on a copy of a first password, a first security parameter, and a public key through a shared control unit. When it is determined that the data provider has successfully registered, based on the data provider's upload request for target data, the shared control unit determines whether the data provider has been authenticated by performing a second composite hash operation based on a copy of a first identity identifier, a first security parameter, and a public key. When it is determined that the data provider has been authenticated, the target data is further symmetric encrypted a predetermined number of times based on multiple subkeys derived from the public key, and the encrypted data of the target data is sent to a distributed storage unit for storage. The present application can improve the security of multi-source data sharing between different data entities in the data governance system of a steel enterprise and reduce the risk of enterprise privacy data leakage.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and more specifically, to a data processing method and device for data governance in the steel industry. Background Art

[0002] With the application and development of informatization in the steel industry, steel companies usually include multiple business systems involving production, logistics, energy, supply chain, etc. Various data are scattered in different departments or business systems, with inconsistent standards and lack of unified integration, resulting in uneven data quality and serious data silos. In this context, effective data governance for steel companies has become a key factor in fully tapping the value of enterprise data and improving enterprise production efficiency. Data governance for steel companies requires standardized integration of the company's multi-source data based on unified data standards, and secure sharing between various business systems and departments. However, when faced with massive and complex multi-source data from enterprises, existing methods still face challenges in data integration, secure sharing, and preventing the leakage of enterprise privacy data. Therefore, an improved method is urgently needed to solve the above problems. Summary of the Invention

[0003] In view of this, this application proposes a data processing method and device for data governance in the steel industry to improve the security of multi-source data sharing between different data entities in the data governance system of steel enterprises and reduce the risk of enterprise privacy data leakage.

[0004] In the first aspect, this application proposes a data processing method for data governance in the steel industry, the method comprising:

[0005] Based on a first registration request from a data provider carrying a first identity and a first password, the shared control unit locally stores a copy of the first identity and the first password, and performs a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider has been successfully registered;

[0006] When it is determined that the data provider has been successfully registered, based on the data provider's request to upload the target data, the shared control unit performs a second composite hash operation based on the copy of the first identity identifier, the first security parameter, and the public key to determine whether the data provider has been authenticated;

[0007] When it is determined that the data provider is authenticated, the shared control unit performs block symmetrical encryption on the target data for a predetermined number of times based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit for storage.

[0008] Optionally, the performing of a first composite hash operation based on a copy of the first password, a first security parameter, and a public key to determine whether the data provider is successfully registered includes:

[0009] The shared control unit generates a first registration message based on a first composite hash operation of a copy of the first password, a first security parameter and a public key, receives a second registration message generated by the data provider based on a first composite hash operation of the first password, a first security parameter and a public key, compares the first registration message with the second registration message, and determines that the data provider has successfully registered when the first registration message is identical to the second registration message.

[0010] Optionally, the shared control unit determines whether the data provider is authenticated based on the copy of the first identity identifier, the first security parameter, and the second composite hash operation of the public key, comprising:

[0011] The shared control unit generates a first authentication message based on a copy of the first identity identifier, a first security parameter and a second composite hash operation of a public key, and receives a second authentication message generated by the data provider based on a second composite hash operation of the first identity identifier, the first security parameter and the public key, compares the first authentication message with the second authentication message, and determines that the data provider authentication is successful when the first authentication message is identical to the second authentication message.

[0012] Optionally, the shared control unit performs block-wise symmetric encryption on the target data for a predetermined number of times based on multiple subkeys derived from the public key, comprising:

[0013] Evenly dividing the target data into four data blocks with the same number of binary bits from low to high according to the number of binary bits of the target data, in each block symmetric encryption process, performing an XOR operation on the first data block and the fourth data block with corresponding subkeys from the multiple subkeys to obtain a first intermediate data block and a fourth intermediate data block respectively, performing an XOR operation on the first transformed data of the first intermediate data block processed by the key transformation function and the third data block to obtain a second intermediate data block, and performing an XOR operation on the second transformed data of the fourth intermediate data block processed by the key transformation function and the second data block to obtain a third intermediate data block;

[0014] The second intermediate data block, the first intermediate data block, the fourth intermediate data block and the third intermediate data block are respectively used as the first data block, the second data block, the third data block and the fourth data block for the next block symmetric encryption, and the block symmetric encryption process is repeatedly performed until the predetermined number of times is reached; the four intermediate data blocks obtained from the last block symmetric encryption are connected to obtain the encrypted data of the target data.

[0015] Secondly, this application also proposes a data processing method for data governance in the steel industry, the method comprising:

[0016] Based on a second registration request from a data accessor carrying a second identity identifier and a second password, the shared control unit locally stores a copy of the second identity identifier and the second password, and determines whether the data accessor has successfully registered based on a third composite hash operation of the copy of the second password, a second security parameter, and a public key;

[0017] When it is determined that the data accessor has been successfully registered, based on the data accessor's access request to the target data, the shared control unit performs a fourth composite hash operation based on the copy of the second identity identifier, the second security parameter, and the public key to determine whether the data accessor has been authenticated;

[0018] When it is determined that the data accessor has passed the authentication, the shared control unit generates a session key based on a copy of the second identity identifier, a copy of the second password and a fifth composite hash operation of the first security parameter, and sends the session key to the distributed storage unit for verification. After the verification is passed, the encrypted data of the target data is received from the distributed storage unit, and the target data after the encrypted data is symmetrically decrypted a predetermined number of times in blocks is sent to the data accessor.

[0019] Optionally, the performing of a third composite hash operation based on the copy of the second password, the second security parameter and the public key to determine whether the data accessor has successfully registered includes:

[0020] The shared control unit generates a third registration message based on a third composite hash operation of a copy of the second password, a second security parameter, and a public key, receives a fourth registration message generated by the data accessor based on a third composite hash operation of the second password, a second security parameter, and a public key, compares the third registration message with the fourth registration message, and determines that the data accessor has successfully registered when the third registration message is identical to the fourth registration message.

[0021] Optionally, the shared control unit determines whether the data accessor is authenticated based on a fourth composite hash operation of the copy of the second identity identifier, the second security parameter, and the public key, comprising:

[0022] The shared control unit generates a third authentication message based on a fourth composite hash operation of a copy of the second identity identifier, a second security parameter and a public key, and receives a fourth authentication message generated by the data accessor based on a fourth composite hash operation of the second identity identifier, a second security parameter and a public key, compares the third authentication message with the fourth authentication message, and determines that the data accessor is authenticated when the third authentication message is identical to the fourth authentication message.

[0023] Optionally, the shared control unit generates a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password, and the first security parameter, and sends the session key to the distributed storage unit for verification, including:

[0024] The distributed storage unit generates a fifth authentication message based on the sixth composite hash operation of the copy of the session key and the timestamp, sends the timestamp to the shared control unit, and receives a sixth authentication message generated by the shared control unit based on the sixth composite hash operation of the session key and the timestamp, compares the fifth authentication message with the sixth authentication message, and confirms that the verification is successful when the fifth authentication message is identical to the sixth authentication message.

[0025] In a third aspect, the present application proposes a data processing device for data governance in the steel industry, the device comprising:

[0026] a first registration module, configured to, based on a first registration request from a data provider carrying a first identity identifier and a first password, cause the shared control unit to locally store a copy of the first identity identifier and the first password, and perform a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider has been successfully registered;

[0027] a first authentication module configured to, upon determining that the data provider has successfully registered, determine, by a shared control unit, based on a request by the data provider to upload target data, whether the data provider has been authenticated by performing a second composite hash operation based on a copy of the first identity identifier, a first security parameter, and a public key;

[0028] The encryption storage module is used to, when it is determined that the data provider has passed the authentication, the shared control unit performs a predetermined number of block symmetrical encryption on the target data based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit for storage.

[0029] Fourthly, the present application also proposes a data processing device for data governance in the steel industry, the device comprising:

[0030] a second registration module, configured to, based on a second registration request from a data accessor carrying a second identity identifier and a second password, cause the shared control unit to locally store a copy of the second identity identifier and the second password, and perform a third composite hash operation based on the copy of the second password, a second security parameter, and a public key to determine whether the data accessor has successfully registered;

[0031] a second authentication module, configured to, upon determining that the data accessor has successfully registered, determine, by a shared control unit, based on a request by the data accessor to access target data, whether the data accessor has been authenticated by performing a fourth composite hash operation based on a copy of the second identity identifier, a second security parameter, and a public key;

[0032] A shared access module is used to, when it is determined that the data accessor has passed the authentication, generate a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password and a first security parameter by a shared control unit, and send the session key to a distributed storage unit for verification, and after the verification is passed, receive the encrypted data of the target data from the distributed storage unit, and send the target data after the encrypted data has been symmetrically decrypted a predetermined number of times in blocks to the data accessor.

[0033] This application can at least achieve the following beneficial effects:

[0034] The embodiments of the present application can be based on the secure identity authentication of different data entities in the data governance system of the steel enterprise and the multiple block symmetric encryption of privacy data to improve the security of multi-source data sharing between different data entities in the data governance system of the steel enterprise and reduce the risk of enterprise privacy data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only illustrate certain embodiments of the present application and should not be regarded as limiting the scope of the present application.

[0036] Figure 1 This is a schematic diagram of a system architecture applicable to the data processing method for data governance in the steel industry according to an embodiment of the present application;

[0037] Figure 2 This is a flowchart of a data processing method for data governance in the steel industry according to the first embodiment of the present application;

[0038] Figure 3 This is a partial flow chart of a data processing method for data governance in the steel industry according to the first embodiment of the present application;

[0039] Figure 4 2 is a flow chart of a data processing method for data governance in the steel industry according to the second embodiment of the present application;

[0040] Figure 5 This is a structural diagram of a data processing device for data management in the steel industry according to the first embodiment of the present application;

[0041] Figure 6 This is a partial structural diagram of a data processing device for data management in the steel industry according to the first embodiment of the present application;

[0042] Figure 7 It is a structural diagram of a data processing device for data governance in the steel industry according to the second embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings of the embodiments of the present application. However, it should be understood that the described embodiments are only some exemplary embodiments of the present application, not all embodiments, and therefore the following detailed description of the embodiments of the present application is not intended to limit the scope of protection claimed in this application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of this application.

[0044] It should be noted that the terms "first", "second", etc. in the description and claims of this application are only used to distinguish and describe similar objects, rather than to describe a specific order or sequence, and cannot be understood as indicating or implying relative importance.

[0045] As previously mentioned, existing methods for data governance in steel enterprises still face challenges in data integration, secure sharing, and preventing the leakage of enterprise privacy data when faced with massive, complex, and multi-source data. Therefore, this application proposes a data processing method and device for data governance in the steel industry to improve the security of multi-source data sharing between different data entities in the data governance system of steel enterprises and reduce the risk of enterprise privacy data leakage.

[0046] Figure 1This is a schematic diagram of the system architecture applicable to the data processing method for data governance in the steel industry according to an embodiment of the present application. The system includes a data provider 110, a data accessor 120, a sharing control unit 130, and a distributed storage unit 140. Among them, the data provider 110 represents the data source provider in the network infrastructure of the data governance system of the steel enterprise, and can be the data output node of different data entities in the steel enterprise. The data accessor 120 represents the data source requester in the network infrastructure of the data governance system of the steel enterprise, and can be the data access node of different data entities in the steel enterprise. The sharing control unit 130 is used to register and authenticate the data provider 110 and the data accessor 120, and to encrypt and decrypt the target data provided by the data provider 110, control the access sharing of the target data by the data accessor 120, and can be implemented as a server node in the network infrastructure of the data governance system of the steel enterprise. The distributed storage unit 140 is used to perform decentralized distributed secure storage of the encrypted data of the target data provided by the data provider 110 to ensure that the data cannot be tampered with and is traceable.

[0047] Figure 2 This is a flow chart of a data processing method for data governance in the steel industry according to the first embodiment of this application. Figure 2 As shown, this method is applied to Figure 1 The system shown comprises the following steps:

[0048] Step S210: Based on a first registration request from the data provider 110 that includes a first identity and a first password, the shared control unit 130 locally stores a copy of the first identity and the first password, and performs a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider 110 has successfully registered.

[0049] Step S220: When it is determined that the data provider 110 has successfully registered, based on the data provider 110's request to upload the target data, the sharing control unit 130 performs a second composite hash operation based on the copy of the first identity, the first security parameter, and the public key to determine whether the data provider 110 has been authenticated.

[0050] In step S230, when it is determined that the data provider 110 has passed the authentication, the shared control unit 130 performs block symmetric encryption on the target data for a predetermined number of times based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit 140 for storage.

[0051] In an embodiment of the present application, the data provider 110 has an associated first identity and a first password. When the data provider 110 needs to share target data in its data source with a data accessor 120 in an enterprise network, it needs to register its identity with the sharing control unit 130. Based on the first registration request from the data provider 110 carrying the first identity and the first password, the sharing control unit 130 will locally store a copy of the first identity and the first password to authenticate the data provider 110 in the subsequent data access control process. Subsequently, the sharing control unit 130 determines whether the data provider 110 has successfully registered based on a copy of the first password of the data provider 110, a first security parameter, and a first composite hash operation of the public key. The first security parameter and the public key are security configuration information pre-set by the sharing control unit 130 during the system initialization process and can be used for composite hash operations for the identity registration and authentication of the data provider 110 and data security sharing control, thereby improving the security of identity registration and authentication, as well as data sharing control. The first security parameter can be an m-bit binary random number, where m is an integer greater than 1.

[0052] In the embodiments of the present application, a compound hash operation is a combination of a hash operation with a concatenation operation and / or a logical operation. The logical operation may include an XOR operation and an XOR operation. During the compound hash operation process for identity registration and authentication of data provider 110 and data accessor 120, as well as for secure data sharing control, various combinations of hash operations with concatenation operations and / or logical operations may be employed to enhance the security of identity registration and authentication, as well as data sharing control. This will be explained in further detail below.

[0053] In one embodiment, in step S210, the first composite hash operation based on the copy of the first password, the first security parameter, and the public key to determine whether the data provider 110 is successfully registered may include:

[0054] The shared control unit 130 generates a first registration message based on a first composite hash operation of a copy of the first password, a first security parameter and a public key, and receives a second registration message generated by the data provider 110 based on a first composite hash operation of the first password, the first security parameter and the public key, compares the first registration message with the second registration message, and determines that the data provider 110 has successfully registered when the first registration message is identical to the second registration message.

[0055] Assume that the first identity identifier and the first password associated with the data provider 110 are respectively represented as and , the copies of the first identity and the first password stored by the sharing control unit 130 are respectively represented as and , the first safety parameter is expressed as , the public key is represented as PK, then the shared control unit 130 generates a first registration message based on a first composite hash operation of a copy of the first password, a first security parameter and the public key It can be expressed as the following formula:

[0056] .

[0057] In the above formula, The hash function representing the exclusive-OR operation of the copy of the first password and the first security parameter, the meaning of the first composite hash operation presented in the above formula is to concatenate the hash function value of the exclusive-OR operation of the copy of the first password and the first security parameter with the public key PK.

[0058] Similarly, the data provider 110 generates a second registration message based on the first composite hash operation of the first password, the first security parameter and the public key. It can be expressed as follows:

[0059] .

[0060] In the above formula, The hash function represents the XOR operation of the first password and the first security parameter. The meaning of the first composite hash operation presented in the above formula is to concatenate the hash function value of the XOR operation of the first password and the first security parameter with the public key PK.

[0061] After the shared control unit 130 generates a first registration message based on a first composite hash operation of a copy of the first password, the first security parameter, and the public key, and receives a second registration message generated by the data provider 110 based on the first composite hash operation of the first password, the first security parameter, and the public key, the shared control unit 130 may compare the first registration message with the second registration message to determine whether the data provider 110 has successfully registered. If the shared control unit 130 determines that the first registration message and the second registration message are identical, the data provider 110 is determined to have successfully registered; otherwise, the registration is unsuccessful.

[0062] In step S220 of this embodiment, after determining that the data provider 110 has successfully registered, if the sharing control unit 130 receives a request from the data provider 110 to upload the target data, it further determines whether the data provider 110 has been authenticated based on a copy of the first identity identifier, the first security parameter, and a second composite hash operation of the public key, so as to ensure that the identity authentication of the data provider 110 has been passed, thereby ensuring the authenticity and reliability of the source of the data to be shared.

[0063] In one embodiment, in step S220, the sharing control unit 130 determines whether the data provider 110 is authenticated based on the copy of the first identity, the first security parameter, and the second composite hash operation of the public key, including:

[0064] The shared control unit 130 generates a first authentication message based on a second composite hash operation of a copy of the first identity identifier, the first security parameter and the public key, and receives a second authentication message generated by the data provider 110 based on the second composite hash operation of the first identity identifier, the first security parameter and the public key, compares the first authentication message with the second authentication message, and determines that the data provider 110 has passed the authentication when the first authentication message is identical to the second authentication message.

[0065] The shared control unit 130 generates a first authentication message based on a second composite hash operation of the copy of the first identity identifier, the first security parameter and the public key. It can be expressed as the following formula:

[0066] .

[0067] In the above formula, The hash function representing the concatenation operation of the copy of the first identity identifier and the first security parameter, the meaning of the second composite hash operation presented in the above formula is to perform an XOR operation on the hash function value of the concatenation operation of the copy of the first identity identifier and the first security parameter with the public key PK.

[0068] Similarly, the data provider 110 generates a second authentication message based on a second composite hash operation of the first identity identifier, the first security parameter and the public key. It can be expressed as follows:

[0069] .

[0070] In the above formula, The hash function representing the concatenation operation of the first identity identifier and the first security parameter, the second composite hash operation presented in the above formula means performing an XOR operation on the hash function value of the concatenation operation of the first identity identifier and the first security parameter and the public key PK.

[0071] After the shared control unit 130 generates the first authentication message based on the second composite hash operation of the copy of the first identity identifier, the first security parameter and the public key, and receives the second authentication message generated by the data provider 110 based on the second composite hash operation of the first identity identifier, the first security parameter and the public key, the shared control unit 130 can compare the first authentication message with the second authentication message. When it is determined that the first authentication message is the same as the second authentication message, it is determined that the data provider 110 has passed the authentication; otherwise, the authentication has failed.

[0072] In step S230 of this embodiment, when the sharing control unit 130 determines that the data provider 110 has passed authentication, the sharing control unit 130 may further perform a predetermined number of block-wise symmetric encryption on the target data based on multiple subkeys derived from the public key PK, and send the encrypted target data to the distributed storage unit 140 for storage. In one embodiment, a predetermined number of subkeys may be derived from the public key PK based on a key derivation function (KDF), where the predetermined number of subkeys corresponds to the predetermined number of block-wise symmetric encryptions performed on the target data.

[0073] In one embodiment, Figure 3 As shown, in step S230, the shared control unit 130 performs a predetermined number of block-wise symmetric encryption on the target data based on multiple subkeys derived from the public key, including:

[0074] Step S310: The target data is evenly divided into four data blocks with the same number of binary bits from low to high according to the number of binary bits of the target data. In each block symmetric encryption process, the first data block and the fourth data block are respectively subjected to an XOR operation with corresponding subkeys from the multiple subkeys to obtain a first intermediate data block and a fourth intermediate data block, respectively. The first transformed data of the first intermediate data block processed by the key transformation function is subjected to an XOR operation with the third data block to obtain a second intermediate data block. The second transformed data of the fourth intermediate data block processed by the key transformation function is subjected to an XOR operation with the second data block to obtain a third intermediate data block.

[0075] Step S320: Use the second intermediate data block, the first intermediate data block, the fourth intermediate data block and the third intermediate data block as the first data block, the second data block, the third data block and the fourth data block for the next block symmetric encryption respectively, and repeat the block symmetric encryption process until the predetermined number of times is reached; perform a concatenation operation on the four intermediate data blocks obtained from the last block symmetric encryption to obtain the encrypted data of the target data.

[0076] In this embodiment, the sharing control unit 130 performs a predetermined number of block-based symmetric encryption on the target data using multiple subkeys derived from the public key. This block-based symmetric encryption is a further optimization and improvement of traditional symmetric encryption algorithms, achieving higher security when sharing enterprise private data across organizations or business systems while minimizing resource usage. The specific implementation of this block-based symmetric encryption is described in detail below.

[0077] Assume that the target data is represented as OD, and the multiple subkeys derived from the public key PK are represented as , n represents the number of subkeys, which is equal to the predetermined number of block symmetric encryption of the target data. First, the target data OD is evenly divided into four data blocks with the same number of bits from low to high according to the number of binary bits of the target data. 、 、 、 For example, assuming that the target data OD is a 16-bit binary number, the 16-bit binary number is evenly divided into four 4-bit binary numbers in order from the low bit to the high bit, that is, bits 0-3 correspond to data blocks , bits 4-7 correspond to data blocks , bits 8-11 correspond to data blocks , bits 12-15 correspond to data blocks In the first block symmetric encryption process, the first data block , the fourth data block respectively with the first subkey of the plurality of subkeys Perform XOR operation to obtain the first intermediate data block and the fourth intermediate data block , the first intermediate data block and the fourth intermediate data block They are respectively processed by a predefined key transformation function KG, which is used to enhance the confidentiality of data by performing bit swapping and position permutation on intermediate data blocks.

[0078] Then, the first intermediate data block The first transformed data after being processed by the key transformation function With the third data block Perform XOR operation to obtain the second intermediate data block , the fourth intermediate data block The second transformed data after being processed by the key transformation function With the second data block Perform XOR operation to obtain the third intermediate data block .

[0079] Then, the first intermediate data blocks are exchanged respectively , the second intermediate data block The order and the third intermediate data block and the fourth intermediate data block The second intermediate data block , the first intermediate data block , the fourth intermediate data block and the third intermediate data block Each block is used as the first data block for the next symmetric encryption. , the second data block , the third data block , the fourth data block , based on the second subkey The block symmetric encryption process is repeated, and so on, until the predetermined number n is reached.

[0080] Finally, based on the last subkey The four intermediate data blocks obtained from the last block symmetric encryption 、 、 、 Perform a concatenation operation to obtain the encrypted data EOD of the target data.

[0081] The above algorithm can be expressed as follows using data expressions:

[0082] ;

[0083] In the above formula, represents the jth intermediate data block generated during the i-th block symmetric encryption process; represents the jth data block to be encrypted in the i-th block symmetric encryption process; represents the j+1th data block to be encrypted in the i-th block symmetric encryption process; represents the j-1th data block to be encrypted in the i-th block symmetric encryption process; represents the i-th subkey; represents the transformed data after the j-1th intermediate data block generated in the i-th block symmetric encryption process is processed by the key transformation function; It represents the transformed data after the j+1th intermediate data block generated in the i-th block symmetric encryption process is processed by the key transformation function. Indicates that when j=1 or 4, and Perform the XOR operation, Indicates that when j=2, and Perform an XOR operation, Indicates that when j=3, and Performs an exclusive OR operation.

[0084] The final encrypted data EOD can be expressed by the following formula:

[0085] .

[0086] Figure 4 FIG. 1 is a flow chart of a data processing method for data governance in the steel industry according to the second embodiment of the present application. Figure 4 As shown, this method is applied to Figure 1 The system shown comprises the following steps:

[0087] Step S410: Based on a second registration request from the data accessor 120 carrying a second identity identifier and a second password, the shared control unit 130 locally stores a copy of the second identity identifier and the second password, and performs a third composite hash operation based on the copy of the second password, the second security parameter, and the public key to determine whether the registration of the data accessor 120 is successful.

[0088] Step S420: When it is determined that the data accessor 120 has successfully registered, based on the data accessor 120's access request to the target data, the sharing control unit 130 performs a fourth composite hash operation based on the copy of the second identity identifier, the second security parameter, and the public key to determine whether the data accessor 120 has been authenticated.

[0089] In step S430, when it is determined that the data accessor 120 has passed the authentication, the shared control unit 130 generates a session key based on a copy of the second identity identifier, a copy of the second password and a fifth composite hash operation of the first security parameter, and sends the session key to the distributed storage unit 140 for verification. After the verification is passed, the encrypted data of the target data is received from the distributed storage unit 140, and the target data after the encrypted data is symmetrically decrypted for a predetermined number of times is sent to the data accessor 120.

[0090] In an embodiment of the present application, the data accessor 120 has an associated second identity identifier and a second password. When the data accessor 120 needs to share access to the target data provided by the data provider 110, it is also necessary to register its identity with the sharing control unit 130. Based on the second registration request of the data accessor 120 carrying the second identity identifier and the second password, the sharing control unit 130 will locally store a copy of the second identity identifier and the second password so as to authenticate the data accessor 120 in the subsequent data access control process. Subsequently, the sharing control unit 130 determines whether the data accessor 120 has been successfully registered based on a third composite hash operation of the copy of the second password of the data accessor 120, the second security parameter, and the public key. As mentioned above, the second security parameter is also security configuration information pre-set by the sharing control unit 130 during the system initialization process, which can be used for the composite hash operation of the identity registration and authentication of the data accessor 120 and the data security sharing control, thereby improving the security of identity registration and authentication and data sharing control. Similarly, the second security parameter can also be an m-bit binary random number.

[0091] In one embodiment, the third composite hash operation based on the copy of the second password, the second security parameter, and the public key in step S410 to determine whether the data accessor 120 has successfully registered may include:

[0092] The shared control unit 130 generates a third registration message based on a third composite hash operation of the copy of the second password, the second security parameter, and the public key, and receives a fourth registration message generated by the data accessor 120 based on the third composite hash operation of the second password, the second security parameter, and the public key, compares the third registration message with the fourth registration message, and determines that the data accessor 120 has successfully registered when the third registration message is identical to the fourth registration message.

[0093] Assume that the second identity identifier and the second password associated with the data accessor 120 are represented as and The copies of the second identity and the second password stored by the shared control unit 130 are respectively represented as and , the second safety parameter is expressed as , the public key is represented as PK, then the shared control unit 130 generates a third registration message based on a third composite hash operation of the copy of the second password, the second security parameter and the public key It can be expressed as the following formula:

[0094] .

[0095] In the above formula, The hash function representing the concatenation operation of the copy of the second password and the second security parameter, the meaning of the third composite hash operation presented in the above formula is to perform an XOR operation on the hash function value of the concatenation operation of the copy of the second password and the second security parameter with the public key PK.

[0096] Similarly, the data accessor 120 generates a fourth registration message based on a third composite hash operation of the second password, the second security parameter and the public key. It can be expressed as follows:

[0097] .

[0098] In the above formula, The hash function representing the concatenation operation of the second password and the second security parameter, the meaning of the third composite hash operation presented in the above formula is to perform an XOR operation on the hash function value of the concatenation operation of the second password and the second security parameter and the public key PK.

[0099] After the shared control unit 130 generates a third registration message based on a third composite hash operation of the copy of the second password, the second security parameter, and the public key, and receives a fourth registration message generated by the data accessor 120 based on the third composite hash operation of the second password, the second security parameter, and the public key, the shared control unit 130 may compare the third registration message with the fourth registration message to determine whether the registration of the data accessor 120 is successful. If the shared control unit 130 determines that the third registration message is identical to the fourth registration message, it is determined that the registration of the data accessor 120 is successful; otherwise, the registration is unsuccessful.

[0100] In step S420 of this embodiment, after determining that the data accessor 120 has successfully registered, if the shared control unit 130 receives an access request to the target data from the data accessor 120, it further determines whether the data accessor 120 has been authenticated based on a fourth composite hash operation of a copy of the second identity identifier, a second security parameter, and a public key, to ensure that the identity authentication of the data accessor 120 has been passed, thereby ensuring that the entity identity and authority to access the data are reliable.

[0101] In one embodiment, in step S420, the sharing control unit 130 determines whether the data accessor 120 is authenticated based on the copy of the second identity identifier, the second security parameter, and the fourth composite hash operation of the public key, which may include:

[0102] The shared control unit 130 generates a third authentication message based on a fourth composite hash operation of a copy of the second identity identifier, a second security parameter and a public key, and receives a fourth authentication message generated by the data accessor 120 based on a fourth composite hash operation of the second identity identifier, a second security parameter and a public key, compares the third authentication message with the fourth authentication message, and determines that the data accessor 120 has passed the authentication when the third authentication message is identical to the fourth authentication message.

[0103] The third authentication message generated by the shared control unit 130 based on the fourth composite hash operation of the copy of the second identity identifier, the second security parameter and the public key It can be expressed as the following formula:

[0104] .

[0105] In the above formula, The hash function representing the XOR operation of the copy of the second identity identifier and the second security parameter, the meaning of the fourth composite hash operation presented in the above formula is to concatenate the hash function value of the XOR operation of the copy of the second identity identifier and the second security parameter with the public key PK.

[0106] Similarly, the data accessor 120 generates a fourth authentication message based on a fourth composite hash operation of the second identity identifier, the second security parameter and the public key. It can be expressed as follows:

[0107] .

[0108] In the above formula, The hash function representing the exclusive OR operation of the second identity identifier and the second security parameter, the fourth composite hash operation presented in the above formula means concatenating the hash function value of the exclusive OR operation of the second identity identifier and the second security parameter with the public key PK.

[0109] After the shared control unit 130 generates a third authentication message based on a fourth composite hash operation of a copy of the second identity identifier, the second security parameter and the public key, and receives a fourth authentication message generated by the data accessor 120 based on a fourth composite hash operation of the second identity identifier, the second security parameter and the public key, the shared control unit 130 may compare the third authentication message with the fourth authentication message. When it is determined that the third authentication message is identical to the fourth authentication message, it is determined that the data accessor 120 has passed the authentication; otherwise, the authentication has failed.

[0110] In step S430 of this embodiment, when it is determined that the data accessor 120 has passed authentication, the sharing control unit 130 further generates a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password, and the first security parameter, and sends the session key to the distributed storage unit 140 for verification. This is to further verify the security of the data transmission session between the sharing control unit 130 and the distributed storage unit 140, further ensuring that enterprise private data is not leaked to unauthorized entities.

[0111] In one embodiment, the shared control unit 130 generates a session key based on a fifth composite hash operation of a copy of the second identity, a copy of the second password, and the first security parameter. , which can be expressed as:

[0112] .

[0113] The fifth composite hash operation presented in the above formula means performing an exclusive OR operation on the hash function value of the exclusive OR operation of the copy of the second identity identifier and the copy of the second password and the first security parameter.

[0114] In one embodiment, in step S430, the sharing control unit 130 generates a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password, and the first security parameter, and sends the session key to the distributed storage unit 140 for verification, including:

[0115] The distributed storage unit 140 generates a fifth authentication message based on the sixth composite hash operation of the copy of the session key and the timestamp, and sends the timestamp to the shared control unit 130, and receives the sixth authentication message generated by the shared control unit 130 based on the sixth composite hash operation of the session key and the timestamp, compares the fifth authentication message with the sixth authentication message, and confirms that the verification is successful when the fifth authentication message is identical to the sixth authentication message.

[0116] The distributed storage unit 140 is based on the copy of the session key The sixth composite hash operation of the timestamp T generates the fifth authentication message , which can be expressed as follows:

[0117] .

[0118] The meaning of the sixth composite hash operation presented in the above formula is a copy of the session key The hash function value of the concatenation operation with the timestamp T.

[0119] The shared control unit 130 is based on the session key and the timestamp T to generate a sixth authentication message , which can be expressed as follows:

[0120] .

[0121] The meaning of the sixth composite hash operation presented in the above formula is the session key The hash function value of the concatenation operation with the timestamp T.

[0122] Finally, the distributed storage unit 140 compares the fifth authentication message with the sixth authentication message. When it is determined that the fifth authentication message is the same as the sixth authentication message, it indicates that the shared control unit 130's session request for the target data has been verified successfully. After the verification is successful, the shared control unit 130 receives the encrypted data of the target data from the distributed storage unit 140, and sends the target data after the encrypted data has been symmetrically decrypted a predetermined number of times in blocks to the data accessor 120. The process of block symmetrical decryption of the encrypted data by the shared control unit 130 constitutes the inverse process of the aforementioned predetermined number of block symmetrical encryptions, that is, first splitting the encrypted data into four intermediate data blocks, and sequentially executing the inverse process of each block symmetrical encryption in reverse order, so as to restore the decrypted target data, which will not be described in detail here.

[0123] It should be noted that any of the aforementioned embodiments, including the first embodiment and the second embodiment, can be implemented separately or in a complete embodiment.

[0124] Figure 5 This is a structural diagram of a data processing device for steel industry data management according to the first embodiment of the present application. Figure 5 As shown, the device includes the following modules:

[0125] A first registration module 510 is configured to, based on a first registration request from a data provider 110 that includes a first identity and a first password, cause the shared control unit 130 to locally store a copy of the first identity and the first password, and perform a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider 110 has successfully registered;

[0126] The first authentication module 520 is configured to, upon determining that the data provider 110 has successfully registered, determine whether the data provider 110 has been authenticated by performing a second composite hash operation based on the copy of the first identity, the first security parameter, and the public key based on the data provider's 110 request to upload target data;

[0127] The encryption storage module 530 is used to, when it is determined that the data provider 110 has passed the authentication, the shared control unit 130 performs a predetermined number of block symmetrical encryption on the target data based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit 140 for storage.

[0128] In one embodiment, the first registration module 510 may also be used to:

[0129] The shared control unit 130 generates a first registration message based on a first composite hash operation of a copy of the first password, a first security parameter and a public key, and receives a second registration message generated by the data provider 110 based on a first composite hash operation of the first password, the first security parameter and the public key, compares the first registration message with the second registration message, and determines that the data provider 110 has successfully registered when the first registration message is identical to the second registration message.

[0130] In one embodiment, the first authentication module 520 may also be used to:

[0131] The shared control unit 130 generates a first authentication message based on a second composite hash operation of a copy of the first identity identifier, the first security parameter and the public key, and receives a second authentication message generated by the data provider 110 based on the second composite hash operation of the first identity identifier, the first security parameter and the public key, compares the first authentication message with the second authentication message, and determines that the data provider 110 has passed the authentication when the first authentication message is identical to the second authentication message.

[0132] In one embodiment, Figure 6 As shown, the encryption storage module 530 may include:

[0133] The first encryption submodule 610 is configured to evenly divide the target data into four data blocks with the same number of binary bits from low to high according to the number of binary bits of the target data; in each block symmetric encryption process, perform an exclusive OR operation on the first data block and the fourth data block with corresponding subkeys from the multiple subkeys to obtain a first intermediate data block and a fourth intermediate data block, respectively; perform an exclusive OR operation on first transformed data of the first intermediate data block processed by a key transformation function and the third data block to obtain a second intermediate data block; and perform an exclusive OR operation on second transformed data of the fourth intermediate data block processed by the key transformation function and the second data block to obtain a third intermediate data block;

[0134] The second encryption submodule 620 is used to use the second intermediate data block, the first intermediate data block, the fourth intermediate data block and the third intermediate data block as the first data block, the second data block, the third data block and the fourth data block for the next block symmetric encryption respectively, and repeat the block symmetric encryption process until the predetermined number of times is reached; the four intermediate data blocks obtained from the last block symmetric encryption are connected to obtain the encrypted data of the target data.

[0135] Figure 7 This is a structural diagram of a data processing device for steel industry data management according to the second embodiment of the present application. Figure 7 As shown, the device includes the following modules:

[0136] The second registration module 710 is configured to, based on a second registration request from the data accessor 120 carrying a second identity identifier and a second password, cause the shared control unit 130 to locally store a copy of the second identity identifier and the second password, and perform a third composite hash operation based on the copy of the second password, a second security parameter, and a public key to determine whether the data accessor 120 has been successfully registered;

[0137] The second authentication module 720 is configured to, upon determining that the data accessor 120 has successfully registered, determine whether the data accessor 120 has been authenticated by performing a fourth composite hash operation based on the copy of the second identity identifier, the second security parameter, and the public key by the sharing control unit 130 based on the data accessor 120's access request to the target data;

[0138] The shared access module 730 is used to generate a session key based on a copy of the second identity identifier, a copy of the second password and a fifth composite hash operation of the first security parameter when it is determined that the data accessor 120 has passed the authentication, and send the session key to the distributed storage unit 140 for verification. After the verification is passed, the encrypted data of the target data is received from the distributed storage unit 140, and the target data after the encrypted data is symmetrically decrypted a predetermined number of times in blocks is sent to the data accessor 120.

[0139] In one embodiment, the second registration module 710 may also be used to:

[0140] The shared control unit 130 generates a third registration message based on a third composite hash operation of the copy of the second password, the second security parameter, and the public key, and receives a fourth registration message generated by the data accessor 120 based on the third composite hash operation of the second password, the second security parameter, and the public key, compares the third registration message with the fourth registration message, and determines that the data accessor 120 has successfully registered when the third registration message is identical to the fourth registration message.

[0141] In one embodiment, the second authentication module 720 may also be used to:

[0142] The shared control unit 130 generates a third authentication message based on a fourth composite hash operation of a copy of the second identity identifier, a second security parameter and a public key, and receives a fourth authentication message generated by the data accessor 120 based on a fourth composite hash operation of the second identity identifier, a second security parameter and a public key, compares the third authentication message with the fourth authentication message, and determines that the data accessor 120 has passed the authentication when the third authentication message is identical to the fourth authentication message.

[0143] In one embodiment, the shared access module 730 may also be used to:

[0144] The distributed storage unit 140 generates a fifth authentication message based on the sixth composite hash operation of the copy of the session key and the timestamp, and sends the timestamp to the shared control unit 130, and receives the sixth authentication message generated by the shared control unit 130 based on the sixth composite hash operation of the session key and the timestamp, compares the fifth authentication message with the sixth authentication message, and confirms that the verification is successful when the fifth authentication message is identical to the sixth authentication message.

[0145] In summary, on the one hand, the data processing method and device for data governance in the steel industry of the first embodiment of the present application determines whether the data provider has been successfully registered based on a first composite hash operation of a copy of the data provider's first password, a first security parameter, and a public key through a shared control unit; when it is determined that the data provider has been successfully registered, based on the data provider's upload request for target data, it is further determined whether the data provider has been authenticated based on a second composite hash operation of a copy of the data provider's first identity identifier, a first security parameter, and a public key; when it is determined that the data provider has been authenticated, the target data is symmetrically encrypted a predetermined number of times in blocks based on multiple subkeys derived from the public key, and the encrypted data of the target data is sent to a distributed storage unit for storage.

[0146] On the other hand, the data processing method and device for data governance in the steel industry of the second embodiment of the present application determines whether the data accessor has been successfully registered through a shared control unit based on a third composite hash operation of a copy of the data accessor's second password, a second security parameter, and a public key; when it is determined that the data accessor has been successfully registered, based on the data accessor's access request to the target data, further determines whether the data accessor has been authenticated based on a fourth composite hash operation of a copy of the data accessor's second identity identifier, a second security parameter, and a public key; when it is determined that the data accessor has been authenticated, a session key is generated based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password, and the first security parameter, and the session key is sent to a distributed storage unit for verification, and after the verification is passed, the encrypted data of the target data is received from the distributed storage unit, and the target data after the encrypted data is symmetrically decrypted a predetermined number of times in blocks is sent to the data accessor.

[0147] Therefore, the embodiments of the present application can be based on the secure identity authentication of different data entities in the data governance system of the steel enterprise and the multiple block symmetric encryption of privacy data to improve the security of multi-source data sharing between different data entities in the data governance system of the steel enterprise and reduce the risk of enterprise privacy data leakage.

[0148] It should be noted that those skilled in the art will understand that the different implementation methods described in the method embodiments of the present application and their explanations and technical effects achieved are also applicable to the device embodiments of the present application and will not be repeated here.

[0149] Furthermore, an embodiment of the present application also provides an electronic device, which may include: a processor and a memory. The memory stores computer program instructions, and the processor can call the computer program instructions in the memory to execute all or part of the steps of the method described in any embodiment of the present application. The computer program instructions in the memory can be implemented in the form of a software functional unit and stored in a computer-readable storage medium when sold or used as a standalone product.

[0150] Furthermore, the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer-readable storage medium is connected to a computer device and the computer program is executed by one or more processors of the computer device, it can execute all or part of the steps of the method described in any embodiment of the present application.

[0151] Furthermore, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which can be executed by one or more processors to perform all or part of the steps of the method described in any embodiment of the present application.

[0152] Through the description of the above embodiments, those skilled in the art can clearly understand that the various embodiments of the present application can be implemented by means of software or software combined with the necessary general hardware platform, and of course can also be implemented by hardware functions. Based on this understanding, the technical solution of the present application can be essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device, such as but not limited to a personal computer, a server, or a network device, to execute all or part of the steps of the method described in any embodiment of the present application. The aforementioned storage medium may include: various media that can store computer program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0153] While the exemplary embodiments of the present application have been described above, it should be understood that the exemplary embodiments are illustrative rather than restrictive, and the scope of protection of the present application is not limited thereto. It should be understood that those skilled in the art may modify and alter the embodiments of the present application without departing from the spirit and scope of the present application, and such modifications and alterations are intended to be within the scope of protection of the present application.

Claims

1. A data processing method for data governance in the steel industry, characterized in that: The method comprises: Based on a first registration request from a data provider carrying a first identity and a first password, the shared control unit locally stores a copy of the first identity and the first password, and performs a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider has been successfully registered; When it is determined that the data provider has successfully registered, based on the data provider's request to upload the target data, the shared control unit performs a second composite hash operation based on the copy of the first identity identifier, the first security parameter, and the public key to determine whether the data provider has been authenticated; wherein the composite hash operation is a combination of a hash operation and a concatenation operation and / or a logical operation, and the logical operation includes an exclusive-OR operation and an exclusive-OR operation; When it is determined that the data provider has passed the authentication, the shared control unit performs block symmetric encryption on the target data for a predetermined number of times based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit for storage; wherein, the shared control unit divides the target data into four data blocks with the same number of bits from low to high according to the binary number of the target data, and in each block symmetric encryption process, performs XOR operation on the first data block and the fourth data block with the corresponding subkeys in the multiple subkeys to obtain the first intermediate data block and the fourth intermediate data block respectively, and processes the first intermediate data block through the key transformation function The first transformed data after processing is XORed with the third data block to obtain a second intermediate data block, and the second transformed data of the fourth intermediate data block after processing by the key transformation function is XORed with the second data block to obtain a third intermediate data block; the second intermediate data block, the first intermediate data block, the fourth intermediate data block and the third intermediate data block are respectively used as the first data block, the second data block, the third data block and the fourth data block of the next block symmetric encryption, and the block symmetric encryption process is repeatedly executed until the predetermined number of times is reached; the four intermediate data blocks obtained by the last block symmetric encryption are connected to obtain the encrypted data of the target data.

2. The data processing method for data governance in the steel industry according to claim 1 is characterized in that: The first composite hash operation based on the copy of the first password, the first security parameter and the public key to determine whether the data provider is successfully registered includes: The shared control unit generates a first registration message based on a first composite hash operation of a copy of the first password, a first security parameter and a public key, receives a second registration message generated by the data provider based on a first composite hash operation of the first password, a first security parameter and a public key, compares the first registration message with the second registration message, and determines that the data provider has successfully registered when the first registration message is identical to the second registration message.

3. The data processing method for data governance in the steel industry according to claim 1 is characterized in that: The shared control unit determines whether the data provider is authenticated based on a copy of the first identity, the first security parameter, and a second composite hash operation of the public key, including: The shared control unit generates a first authentication message based on a copy of the first identity identifier, a first security parameter and a second composite hash operation of a public key, and receives a second authentication message generated by the data provider based on a second composite hash operation of the first identity identifier, the first security parameter and the public key, compares the first authentication message with the second authentication message, and determines that the data provider authentication is successful when the first authentication message is identical to the second authentication message.

4. The data processing method for data governance in the steel industry according to claim 1 is characterized in that: The method comprises: Based on a second registration request from a data accessor carrying a second identity identifier and a second password, the shared control unit locally stores a copy of the second identity identifier and the second password, and determines whether the data accessor has successfully registered based on a third composite hash operation of the copy of the second password, a second security parameter, and a public key; When it is determined that the data accessor has been successfully registered, based on the data accessor's access request to the target data, the shared control unit performs a fourth composite hash operation based on the copy of the second identity identifier, the second security parameter, and the public key to determine whether the data accessor has been authenticated; When it is determined that the data accessor has passed the authentication, the shared control unit generates a session key based on a copy of the second identity identifier, a copy of the second password and a fifth composite hash operation of the first security parameter, and sends the session key to the distributed storage unit for verification. After the verification is passed, the encrypted data of the target data is received from the distributed storage unit, and the target data after the encrypted data is symmetrically decrypted a predetermined number of times in blocks is sent to the data accessor.

5. The data processing method for data management in the steel industry according to claim 4 is characterized in that: The third composite hash operation based on the copy of the second password, the second security parameter and the public key to determine whether the data accessor has successfully registered includes: The shared control unit generates a third registration message based on a third composite hash operation of a copy of the second password, a second security parameter, and a public key, receives a fourth registration message generated by the data accessor based on a third composite hash operation of the second password, a second security parameter, and a public key, compares the third registration message with the fourth registration message, and determines that the data accessor has successfully registered when the third registration message is identical to the fourth registration message.

6. The data processing method for data governance in the steel industry according to claim 4 is characterized in that: The shared control unit determines whether the data accessor is authenticated by performing a fourth composite hash operation based on the copy of the second identity identifier, the second security parameter, and the public key, including: The shared control unit generates a third authentication message based on a fourth composite hash operation of a copy of the second identity identifier, a second security parameter and a public key, and receives a fourth authentication message generated by the data accessor based on a fourth composite hash operation of the second identity identifier, a second security parameter and a public key, compares the third authentication message with the fourth authentication message, and determines that the data accessor is authenticated when the third authentication message is identical to the fourth authentication message.

7. The data processing method for data governance in the steel industry according to claim 4 is characterized in that: The shared control unit generates a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password, and the first security parameter, and sends the session key to the distributed storage unit for verification, including: The distributed storage unit generates a fifth authentication message based on the sixth composite hash operation of the copy of the session key and the timestamp, sends the timestamp to the shared control unit, and receives a sixth authentication message generated by the shared control unit based on the sixth composite hash operation of the session key and the timestamp, compares the fifth authentication message with the sixth authentication message, and confirms that the verification is successful when the fifth authentication message is identical to the sixth authentication message.

8. A data processing device for data management in the steel industry, characterized in that: The device comprises: a first registration module, configured to, based on a first registration request from a data provider carrying a first identity identifier and a first password, cause the shared control unit to locally store a copy of the first identity identifier and the first password, and perform a first composite hash operation based on the copy of the first password, a first security parameter, and a public key to determine whether the data provider has been successfully registered; A first authentication module is configured to, upon determining that the data provider has successfully registered, determine, based on the data provider's request to upload target data, whether the data provider has been authenticated by performing a second composite hash operation by a shared control unit based on a copy of the first identity identifier, the first security parameter, and the public key; wherein the composite hash operation is a combination of a hash operation with a concatenation operation and / or a logical operation, wherein the logical operation includes an exclusive-OR operation and an exclusive-OR operation; The encryption storage module is used for, when it is determined that the data provider has passed the authentication, the shared control unit performs a predetermined number of block symmetric encryption on the target data based on multiple subkeys derived from the public key, and sends the encrypted data of the target data to the distributed storage unit for storage; wherein, the shared control unit divides the target data into four data blocks with the same number of bits from low to high according to the binary number of the target data, and in each block symmetric encryption process, performs an XOR operation on the first data block and the fourth data block with the corresponding subkeys in the multiple subkeys to obtain a first intermediate data block and a fourth intermediate data block respectively, and converts the first intermediate data block into a key-transformed block. The first transformed data after being processed by the key transformation function is subjected to an XOR operation with the third data block to obtain a second intermediate data block, and the second transformed data after being processed by the key transformation function of the fourth intermediate data block is subjected to an XOR operation with the second data block to obtain a third intermediate data block; the second intermediate data block, the first intermediate data block, the fourth intermediate data block and the third intermediate data block are respectively used as the first data block, the second data block, the third data block and the fourth data block for the next block symmetric encryption, and the block symmetric encryption process is repeatedly executed until the predetermined number of times is reached; the four intermediate data blocks obtained by the last block symmetric encryption are connected to obtain the encrypted data of the target data.

9. The data processing device for steel industry data management according to claim 8, characterized in that: The device comprises: a second registration module, configured to, based on a second registration request from a data accessor carrying a second identity identifier and a second password, cause the shared control unit to locally store a copy of the second identity identifier and the second password, and perform a third composite hash operation based on the copy of the second password, a second security parameter, and a public key to determine whether the data accessor has successfully registered; a second authentication module, configured to, upon determining that the data accessor has successfully registered, determine, by a shared control unit, based on a request by the data accessor to access target data, whether the data accessor has been authenticated by performing a fourth composite hash operation based on a copy of the second identity identifier, a second security parameter, and a public key; A shared access module is used to, when it is determined that the data accessor has passed the authentication, generate a session key based on a fifth composite hash operation of a copy of the second identity identifier, a copy of the second password and a first security parameter by a shared control unit, and send the session key to a distributed storage unit for verification, and after the verification is passed, receive the encrypted data of the target data from the distributed storage unit, and send the target data after the encrypted data has been symmetrically decrypted a predetermined number of times in blocks to the data accessor.

Images