Data management method and device and electronic equipment

Abstract

The invention provides a data management method and device and electronic equipment, and the method comprises the steps: binding a data use strategy: binding a data asset and a limited application strategy into a contract, and generating a random character string; an encryption step: acquiring a public key of the limited application and encrypting the random character string; and a data use step in which the limited application decrypts the encrypted random character string according to a private key corresponding to the public key to use the data. Through the mode, the data use of the data provider is limited by using the limited application strategy, the data is prevented from being acquired by other non-limited application subjects, and the data sovereignty of the data provider is ensured.

Description

Technical Field

[0001] The present invention relates to the field of trusted data space, and in particular to a data management method, device and electronic equipment. Background Art

[0002] The International Data Space (IDS) is a virtual data space that leverages existing standards and technologies, along with widely recognized governance models within the digital economy, to facilitate secure and standardized data exchange and linkage within a trusted business ecosystem. It lays the foundation for creating intelligent service scenarios and driving innovative cross-company business processes, while safeguarding data sovereignty for data owners.

[0003] Data sovereignty refers to the exclusive and autonomous right of natural or legal persons to make decisions regarding the use of their data as an economic asset. Data sovereignty is a core element of the international data space. It can be defined as the ability of natural or legal entities to make fully autonomous decisions regarding their own data. The International Data Space Initiative proposes a reference architecture model for this specific capability and related aspects, which includes requirements for secure and trusted data exchange within business ecosystems. Data sovereignty is a critical capability. As data becomes a strategic resource and businesses increasingly collaborate within business ecosystems, a key characteristic of the digital economy has arisen: a fundamental conflict of objectives: on the one hand, businesses increasingly need to exchange data within business ecosystems; on the other hand, given the vastly increased importance of data, they feel a greater need than ever to protect their own data. This conflict of objectives intensifies the more business ecosystems a business participates in and the greater the value that data contributes to the overall success of the collaboration. Data sovereignty aims to balance the need to protect one's own data with the need to share it with others. It can be considered a key capability that businesses need to cultivate for success in the data economy.

[0004] At the system level, to achieve data sovereignty, distributed networks like the International Data Space rely on connections between different participants, who host IDS connectors or other core components. (An IDS connector consists of one or more data endpoints, which are attributes of data assets and, in effect, register data assets with the connector.) The IDS connector is responsible for initiating data exchange between participating organizations' internal data resources and enterprise systems and the International Data Space. It provides metadata to the metadata broker, as specified in the IDS connector's self-description, such as technical interface descriptions, authentication mechanisms, and relevant data usage policies.

[0005] The International Data Space network consists of all its IDS Connectors. Each IDS Connector allows data exchange through its exposed data endpoints. An IDS Connector must be accessible to all other organizations' IDS Connectors. IDS Connectors can run on-premises or in cloud environments.

[0006] At the information level, achieving data sovereignty through connectors relies on contracts based on usage control policies. A legally binding contract is the foundation of any business transaction. IDS provides a technical framework for technically enforcing agreements. A usage contract consists of a set of usage policies. Each policy describes specific rights or obligations for IDS resources. The usage contract is written in a machine-readable format (based on the IDS Usage Policy Language) and must be interpreted according to the definitions at the process level. In any case, the usage contract should always be considered an extension of the existing legal agreement between the two parties to the IDS and can be overturned by the parties.

[0007] The IDS Usage Control Policy Language is an extension of the World Wide Web Consortium (W3C) standard, the Open Digital Rights Language (ODRL). The Usage Control Module of the information model uses this language to provide machine-readable usage control policy specifications. These specifications define the actions that a party is prohibited or permitted to perform on a specific data asset. They also codify any potential obligations.

[0008] The above is the definition of the IDS reference architecture model. The usage policy specifications are defined within International Data Spaces Global (IDS-G). The usage policy specifications currently define 25 usage control policies.

[0009] The third usage control policy defined by IDS-G is the application-restricted data usage policy, which restricts data usage to specific applications. In other words, the data provider specifies that only applications with a specific Uniform Resource Identifier (URI) can use the data, and queries the application's interface and other information through a Policy Information Point (PIP).

[0010] If the data consumer's connector and the application used are both in a trusted and controlled environment within the data space, the above policy can be effective. When the data consumer connector in the trusted and controlled environment receives a transfer request, it checks whether the callback address provided by the initiator is a URI in the restricted application list. If not, it will reject the transfer.

[0011] However, if the data consumer's connector is not in a trusted and controlled environment and is controlled by the data consumer themselves, the data consumer can circumvent this check in a variety of ways. The simplest method is address redirection. Although the application URI is correct, it points to a local application. In this case, even if the connector is a certified and legitimate version and passes the relevant usage policy check, it cannot prevent the loss of data sovereignty.

[0012] Therefore, in the scenario where data consumers deploy connectors locally, there is a technical problem that the sovereignty of data providers cannot be guaranteed. It is necessary to adopt technical means to effectively meet the data providers' requirements for data sovereignty. Summary of the Invention

[0013] In response to the above problems, the present invention provides a data management method, device and electronic device to at least solve some of the problems in the prior art.

[0014] The first aspect of the present invention provides a data management method, including: a data usage policy binding step, binding data assets and limited application policies into a contract and generating a random string; an encryption step, obtaining the public key of the limited application and encrypting the random string; and a data usage step, the limited application decrypts the encrypted random string according to the private key corresponding to the public key to use the data.

[0015] Through the above methods, the limited application policy is used to restrict the data provider's data use, preventing the data from being obtained by other non-limited application entities, and ensuring the data sovereignty of the data provider.

[0016] Optionally, the data usage policy binding step further includes: a data registration step of registering the data asset to the connector; and a data usage policy formulation step of formulating the data usage policy as a limited application policy through a policy editor connected to the connector.

[0017] Through the above method, data is registered to the connector in the form of data endpoints through data assets, and the connector and a separate policy editor are used to formulate data usage policies that match the data, thereby improving the flexibility of data usage policy formulation.

[0018] Optionally, the data usage policy binding step further includes: using a policy editor to obtain an application list from an interface of an application market, and selecting an application from the application list as a restricted application corresponding to the restricted application policy.

[0019] In the above manner, a specific application can be selected from the application market as a restricted application using the policy editor, and the restricted application can be bound to the restricted application policy, so that encrypted data can be directedly transmitted to the restricted application and used by the restricted application.

[0020] Optionally, the data management method further includes: an application listing step, wherein the application is listed on an application market, the application market is configured with an application list, and the application list includes an application name and an application ID assigned by the application market to each application;

[0021] In the step of formulating a data usage policy, use the policy editor to select an application from the application list as a restricted application based on the application name and / or application ID.

[0022] Through the above method, the applications in the application market are intuitively displayed in the form of an application list, and the policy editor can select limited applications by application name or application ID, which improves the convenience of limited application selection.

[0023] Optionally, the private key of the restricted application is stored in the key library of the restricted application, and the public key of the restricted application can be accessed through the interface. In the encryption step, the public key of the restricted application is obtained through the interface; in the data usage step, the restricted application obtains the private key corresponding to the public key from the key library.

[0024] Through the above method, the public key can be obtained through the interface, and the private key is only visible to the application itself, ensuring the security of the private key while improving the convenience of obtaining the public key.

[0025] Optionally, the data management method further includes: a data request step, in which the application sends a data asset usage request; and a data encryption step, in which the data is encrypted using a random character string and the encrypted data is sent to the application.

[0026] If the application is a restricted application, the data use step further includes: decrypting the encrypted data based on the decrypted random character string to obtain the data.

[0027] Through the above method, the data provider uses a random string generated by itself to encrypt the data, and the random string can only be decrypted by the restricted application using the private key stored by itself. Other non-restricted applications cannot decrypt the random string to obtain the data. Only restricted applications can obtain the data sent by the data provider, ensuring the data sovereignty of the data provider and the security of data transmission.

[0028] Optionally, the data management method further includes: a data pulling step of pulling data from a data source specified by the data asset; and a data encryption step of encrypting the pulled data using a random string.

[0029] Through the above methods, data providers can obtain data from data sources and encrypt the data to ensure the security of the data providers' data assets.

[0030] Optionally, the data management method further includes: a log sending step, wherein after the application receives the data, the application sends the data usage log to a clearing center.

[0031] Through the above methods, data users can send information such as the current user of the data, the data assets used, and the usage time to the clearing center, so that the clearing center can manage the data assets.

[0032] The second aspect of the present invention provides a data management device, including: a data usage policy binding module, which binds data assets to limited application policies as a contract and generates a random string; an encryption module, which is used to obtain the public key of the limited application and encrypt the random string; and a data usage module, which is used to limit the application to decrypt the encrypted random string according to the private key corresponding to the public key to use the data.

[0033] Through the above method, the data management device can ensure that data is only accessed by limited applications, which is conducive to ensuring the data sovereignty and data security of the data provider.

[0034] A third aspect of the present invention provides an electronic device that applies the above-mentioned data management method or is equipped with the above-mentioned data management device. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 Flowchart of the data management method in an embodiment of the present invention.

[0036] Figure 2 A structural diagram developed for an application in an embodiment of the present invention.

[0037] Figure 3 This is another flow chart of the data management method in an embodiment of the present invention.

[0038] Figure 4 Flowchart for data storage in an embodiment of the present invention.

[0039] Figure 5 2 is an overall structural diagram of the data management method in an embodiment of the present invention.

[0040] Figure 6 Flowchart of data transmission in an embodiment of the present invention.

[0041] Figure 7 Flowchart of data reception in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0043] It should be noted that the data in the embodiments of the present invention can be managed as data assets, and the data assets are the data in the embodiments of the present invention.

[0044] <First embodiment>

[0045] Figure 1 Flowchart of the data management method in the embodiment of the present invention. Figure 1 The present invention provides a data management method, which is applied between a data provider and a limited application, and includes the following steps S110-S130.

[0046] Data usage policy binding step S110: The data provider binds the data asset to the limited application policy and generates a random string. The random string corresponds to the data asset, and the data provider saves the random string as a private attribute of the data asset.

[0047] Encryption step S120: The data provider obtains the public key of the restricted application corresponding to the restricted application policy and encrypts the random string. The data provider saves the encrypted random string as a public attribute of the data asset;

[0048] Data use step S130: limiting the application to obtain the public attributes of the data, decrypting the encrypted random string according to the private key corresponding to the public key, and obtaining the corresponding data according to the decrypted random string, thereby using the data provided by the data provider.

[0049] Through the above method, the restricted application policy is used to restrict the data provider's data use. The data provider uses the public key of the restricted application to encrypt the random string, so that the random string can only be decrypted by the restricted application using its own private key to obtain the data, preventing the random string from being obtained by other non-restricted application entities and preventing the data from being obtained by other non-restricted applications, thereby ensuring the data sovereignty and data security of the data provider.

[0050] Figure 2 A structural diagram of application development in accordance with an embodiment of the present invention. Figure 1 , and refer to Figure 2 The data management method further includes: limiting the application to generate a public-private key pair, storing the private key of the limited application in a key library of the limited application, and accessing the public key of the limited application through an interface.

[0051] Correspondingly, in the encryption step S120, the data provider obtains the public key of the limited application through the public key acquisition interface.

[0052] In the data use step S130 , the application is restricted to obtain the private key corresponding to the public key from the key library.

[0053] Through the above method, the public key of the limited application can be obtained through the interface, and the private key is only visible to the application itself, ensuring the security of the private key while improving the convenience of obtaining the public key.

[0054] <Second embodiment>

[0055] Figure 3 This is another flow chart of the data management method in the embodiment of the present invention. Figure 3 The second embodiment of the present invention provides a data management method, which is applied to a data provider and a data consumer. The data provider and the data consumer are both connected to corresponding connectors, and the data consumer is correspondingly provided with an application. The data management method includes the following steps S210-S240.

[0056] In the application listing step S210, the data consumer lists its corresponding application on the application market. The application market is configured with an application list (such as Figure 2 The application list includes the application name and application ID assigned by the application market to each application;

[0057] In the data usage policy binding step S220, the data provider puts the data assets on the data provider connector, selects a limited application from the data consumer application in the application list, and formulates and binds a data usage policy for the limited application to the data;

[0058] In the data transmission step S230, the data provider connector sends data to the data consumer connector based on the data usage policy. If the data usage policy is a limited application policy and the data provider chooses to encrypt the data, the data sent is encrypted data.

[0059] In the data use step S240, after receiving the data, the data consumer connector pushes it to the data consumer application or notifies the data consumer application to actively obtain it. If the data is encrypted, the data consumer application decrypts the encrypted data and uses it.

[0060] like Figure 2 As shown, in the application listing step S210, the data consumer application must be able to generate public and private keys for an asymmetric encryption algorithm. This means that the application can generate a public and private key pair at any time based on data usage requests during runtime. The private key is stored in the application's own keystore, while the public key is accessible through an interface. Furthermore, the application must be able to decrypt data using the private key and decrypt symmetrically encrypted data using a password.

[0061] Data consumer applications are listed on the app store. Because other types of applications are listed, to distinguish between them, if an application has the ability to generate public and private keys for the asymmetric encryption algorithm and decrypt data using the private key, it should be marked as having encryption and decryption capabilities. Limited applications are selected from these marked applications; applications without encryption and decryption capabilities cannot be included in the limited application list.

[0062] Data consumer applications can be provided through Software as a Service (SaaS) and managed by an app market, supporting multi-tenancy. When a data consumer application is listed on an app market, it is assigned a name and a unique application ID within the app market. This application ID is written to the data consumer application as an environment variable. When the app market returns an application list, it is returned as the application name and application ID. Data consumer applications can implement other business functions of the application.

[0063] With this setting, the applications in the application market are intuitively displayed in the form of an application list, and the policy editor can select limited applications from the application list by application name or application ID, which improves the convenience of limited application selection.

[0064] Figure 4 Flowchart of data storage in the embodiment of the present invention. Figure 3 , and refer to Figure 4 The data usage policy binding step S220 includes:

[0065] In the data registration step S221 , the data provider registers the data as a data asset in the form of a data endpoint to the data provider connector;

[0066] Formulate data usage policy step S222 , the data provider formulates the data usage policy as a limited application policy through a policy editor connected to the data provider connector;

[0067] In the binding step S223, the data asset is bound to the limited application policy in the data usage policy.

[0068] Through the above methods, data providers use their own connectors and separate policy editors to formulate data usage policies that match the data, thereby improving the flexibility of data usage policy formulation.

[0069] Furthermore, the binding step S223 further includes:

[0070] The data provider uses the policy editor to obtain an application list from an interface of the application market, and selects an application as a restricted application corresponding to the restricted application policy based on the application name and / or application ID in the application list.

[0071] Figure 5 The overall structure diagram of the data management method in the embodiment of the present invention is shown in FIG. Among them, the data consumer application, the clearing center and the application market serve as the platform. Figure 3 , and refer to Figure 4 、 Figure 5 , the binding step S223 includes:

[0072] The data provider has a connector console. On this console, the data provider binds the data asset from step S221 of the data registration process to the restricted application policy. If the restricted application policy selects a restricted application, the data provider generates a random string, which becomes the key for symmetric encryption. This key (i.e., the random string) is stored as a private attribute of the data asset. The data provider then accesses the restricted application's interface to obtain the restricted application's public key, encrypts the random string using the restricted application's public key, and then stores it in the data asset's public attribute, making it available to data consumers.

[0073] Among them, the connector console is a web application with an embedded policy editor. It provides graphical policy editing and an interface for displaying policies in ODRL code format. It has the function of editing policies for limited applications and pulling application lists through the application market interface.

[0074] Through the above method, you can use the policy editor to select specific applications from the application market as restricted applications, and bind the restricted applications to the restricted application policy, thereby improving the flexibility of restricted application selection.

[0075] Figure 6 FIG. 1 is a flow chart of data transmission in an embodiment of the present invention. Figure 3 and Figure 5 , and refer to Figure 6 The data transmission step S230 includes:

[0076] In the data request step S231, the data consumer application sends a data usage request to the data provider connector through the data consumer connector. The data usage request carries the callback address and authentication information of the application (i.e., the data consumer application);

[0077] In the data pulling step S232 , the data provider connector pulls data registered as data assets from the data source specified by the data endpoint;

[0078] In the data encryption step S233 , the data provider connector encrypts the pulled data using a random string (i.e., a private attribute of the data asset) and sends the encrypted data to the data consumer connector.

[0079] Through the above method, the data provider connector provides the function of encrypting data during transmission, that is, the data provider connector can obtain data from the data source and encrypt the data to ensure the security of the data provider's data assets.

[0080] Before the data encryption step S233, it also includes: after the data provider connector and the data consumer connector reach a contract negotiation, the data provider connector checks whether the data usage policy bound to the data as the data asset has selected limited application and whether to select encrypted data. If so, the above step S232 is executed; if not, after the data provider connector pulls the data, it directly returns the data to the data consumer connector without executing the data encryption step S232.

[0081] In other words, if the data isn't bound to a restricted application policy and encryption isn't selected, the data provider connector directly returns the data pulled from the data source to the data consumer connector. If the data is bound to a restricted application policy and encryption is selected, the data provider connector encrypts the data pulled from the data source using a random string before returning it to the data consumer connector. This allows data providers to flexibly configure data transmission methods.

[0082] Figure 7 FIG. 1 is a flow chart of data reception in an embodiment of the present invention. Figure 7 As shown, the data using step S240 further includes:

[0083] After receiving the data, the data consumer application checks whether the public attribute of the data asset (i.e., the public attribute of the data asset in the binding step S223) carries the encrypted random string;

[0084] If a data asset is found with an encrypted random string (i.e. Figure 7 The data consumer application searches for the private key corresponding to the public key according to its own application ID, uses the private key to decrypt the encrypted random string, and decrypts the encrypted data based on the decrypted random string to obtain and use the data.

[0085] Through the above method, the data provider uses a random string generated by itself to encrypt the data, and the random string can only be decrypted by the restricted application using the private key stored by itself. Other non-restricted applications cannot decrypt the random string to obtain the data. Only restricted applications can obtain the data sent by the data provider, ensuring the data sovereignty of the data provider and the security of data transmission.

[0086] like Figure 5 As shown, the data management method of the second embodiment of the present invention further includes:

[0087] In step S250, after receiving the data, the data consumer application sends the data usage log to the clearing center. The data usage log includes information such as the current user, the data assets used, and the usage time.

[0088] Through the above methods, data users can send information such as the current user of the data, the data assets used, and the usage time to the clearing center, so that the clearing center can manage the data assets.

[0089] <Third embodiment>

[0090] The third embodiment of the present invention provides a data management device, including: a data usage policy binding module, which binds data to a limited application policy and generates a random string; an encryption module, which is used to obtain a public key of a limited application and encrypt the random string; and a data usage module, which is used to limit the application to decrypt the encrypted random string according to a private key corresponding to the public key to use the data.

[0091] Through the above method, the data management device can ensure that data is only accessed by limited applications, which is conducive to ensuring the data sovereignty and data security of the data provider.

[0092] <Fourth embodiment>

[0093] A fourth embodiment of the present invention provides an electronic device, which applies the above-mentioned data management method or is equipped with the above-mentioned data management device.

[0094] The following describes the workflow of the data management method in the embodiment of the present invention.

[0095] The data consumer application is listed on the app market, which marks the data consumer application with encryption and decryption functions. The app market assigns the data consumer application an application name and a unique application ID within the app market.

[0096] The data provider registers data with the data provider connector. The data provider then creates a data usage policy through the policy editor connected to the data provider connector. The data provider can choose to restrict the policy to an application, access the application market to obtain an application list, and select the data consumer application from the application list as the restricted application.

[0097] The data provider binds the data asset to the restricted application policy on the connector console. If the restricted application policy selects restricted application, a random string is generated and saved to the private properties of the data asset (visible only to the data provider). The random string is encrypted using the public key of the restricted application and saved to the public properties of the data asset.

[0098] When the data consumer application initiates a data usage request through the data consumer connector.

[0099] After the data provider connector and the data consumer connector reach a contract negotiation, before starting data transmission, they check whether the data binding limited application policy has selected limited application and whether encrypted data has been selected. If so, the data provider connector pulls data from the data source specified by the data endpoint of the data asset, extracts a random string from the private attribute of the data asset, and uses the random string to encrypt the data, and then pushes the encrypted data to the data consumer connector; if not, the data provider connector pulls data from the data source specified by the data endpoint of the data asset and sends it directly to the data consumer connector.

[0100] After receiving the data, the data consumer connector pushes it to the data consumer application, or notifies the data consumer application to actively obtain it.

[0101] After receiving the data, the data consumer application checks the public attributes of the data asset corresponding to the received data. If an encrypted random string is found, the data consumer application finds the encrypted random string encrypted with its own public key based on its own application ID, decrypts the encrypted random string using the data consumer application's own private key, obtains the decrypted random string, uses the random string to decrypt the data, and then uses the data.

[0102] After receiving usable data, the data consumer application sends the data usage log to the clearing center.

[0103] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data management method, characterized in that: Including steps: The data usage policy binding step binds the data asset and the limited application policy into a contract and generates a random string; An encryption step, obtaining a public key of a limited application and encrypting the random character string; as well as In the data use step, the restricted application decrypts the encrypted random character string using a private key corresponding to the public key to use the data.

2. The data management method according to claim 1, wherein: The data usage policy binding step further includes: A data registration step, registering the data asset to the connector; The step of formulating a data usage policy is to formulate the data usage policy as the limited application policy through a policy editor connected to the connector.

3. The data management method according to claim 2, wherein: The data usage policy binding step further includes: The policy editor is used to obtain an application list from an interface of an application market, and an application is selected from the application list as a restricted application corresponding to the restricted application policy.

4. The data management method according to claim 3, wherein: Also includes: an application listing step, wherein the application is listed on the application market, the application market is configured with the application list, and the application list includes an application name and an application ID assigned by the application market to each application; In the step of formulating a data usage policy, the policy editor is used to select an application from the application list as the restricted application based on the application name and / or the application ID.

5. The data management method according to claim 3, characterized in that: The private key of the restricted application is stored in the key library of the restricted application, and the public key of the restricted application can be accessed through an interface. In the encryption step, the public key of the limited application is obtained through the interface; In the data using step, the restricted application obtains the private key corresponding to the public key from the key library.

6. The data management method according to claim 4, characterized in that: Also includes: Data request step, the application sends a data asset usage request; a data encryption step of encrypting the data using the random character string and sending the encrypted data to the application; If the application is the restricted application, the data using step further includes: decrypting the encrypted data based on the decrypted random character string to obtain the data.

7. The data management method according to claim 6, characterized in that: Also includes: A data pulling step is to pull the data from the data source specified by the data asset; In the data encryption step, the pulled data is encrypted using the random character string.

8. The data management method according to claim 7, characterized in that: Also includes: In the step of sending logs, after receiving the data, the application sends the data usage log to the clearing center.

9. A data management device, characterized in that: include: The data usage policy binding module binds data assets and limited application policies into a contract and generates a random string; An encryption module, used to obtain a public key of a limited application and encrypt the random character string; as well as A data using module is used for the limited application to decrypt the encrypted random character string according to a private key corresponding to the public key to use the data.

10. An electronic device, characterized in that: The data management method according to any one of claims 1 to 8 is applied, or the data management device according to claim 9 is equipped.

Images