Data circulation method and device in trusted data space, equipment and medium

Abstract

The invention discloses a data circulation method and device in a trusted data space, equipment and a medium, and relates to the technical field of data security sharing, and the method comprises the steps: obtaining a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node; responding to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that the data provider transmits to-be-transmitted target data to the data demander through the data flow path; wherein the data provider accesses the trusted data space through the second connector node. According to the invention, secure transmission and sharing of data in a trusted data space are realized.

Description

Technical Field

[0001] The present application relates to the technical field of data security sharing, and in particular to a method, apparatus, device and medium for data circulation in a trusted data space. Background Art

[0002] Trusted Data Space (TDS) is a new data management and interaction model designed to create a secure, transparent, and controllable environment between data providers and data demanders. It allows participants to share and utilize data on a basis of mutual trust while ensuring data security, privacy, and integrity.

[0003] As data becomes a key production factor, the demand for cross-organizational data circulation has surged. However, data connectors in existing technologies mostly use point-to-point data circulation methods, do not support cross-node data circulation methods, and are unable to meet the needs of scenarios with central nodes. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a data circulation method, device, equipment and medium in a trusted data space, which supports cross-node data circulation and realizes the secure transmission and sharing of data in a trusted data space. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a data circulation method in a trusted data space, which is applied to a registration center in a trusted data space. The data transmission layer of the trusted data space includes multiple connector nodes, and the data transmission layer transmits data through the connector nodes and data pipelines between the connector nodes. The method includes:

[0006] Obtaining a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node;

[0007] Responding to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that a data provider transmits target data to be transmitted to the data requester through the data flow path; wherein the data provider accesses the trusted data space through the second connector node;

[0008] Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

[0009] Optionally, if the data flow mode between the current data demander and the data provider is a point-to-point flow mode, responding to the node instance request to determine the data flow path between the first connector node and the second connector node in the trusted data space includes:

[0010] When receiving the node instance request, checking whether the first connector node corresponding to the data demander meets the preset identity legitimacy conditions and whether there is an available data flow channel between the first connector node and the connector node corresponding to the data provider;

[0011] If the first connector node meets the preset identity legitimacy condition and an available data flow channel exists between the first connector node and the connector node corresponding to the data provider, a target node instance is returned to the first connector node, so that the first connector node sends a first data access request for the target data to the target connector node corresponding to the target node instance, so that the target connector node determines whether the node code of the second connector node in the trusted data space carried in the first data access request is consistent with its own node code, and sends a first target verification request to the registration center;

[0012] A target verification is performed on the first target verification request and the first target verification result is returned to the target connector node, so that when the target node code carried in the first data access request is consistent with the node code of the target connector node and the first target verification result indicates that the verification is successful, the target connector node is determined to be the second connector node to obtain the data flow path between the first connector node and the second connector node.

[0013] Optionally, if the data flow mode between the current data demander and the data provider is a cross-node flow mode, obtaining a node instance request sent by the data demander through the first connector node in the trusted data space, responding to the node instance request to determine a data flow path between the first connector node and the second connector node in the trusted data space, includes:

[0014] Obtaining a current node instance request sent by a current data circulation connector node, and if the current data circulation connector node meets a preset identity legitimacy condition and an available data circulation pipeline exists between the current data circulation connector node and a connector node corresponding to a data provider, determining a next data circulation connector node of the current data circulation connector node from the trusted data space based on the current node instance request;

[0015] Wherein, the first connector node in the trusted data space is the first data circulation connector node;

[0016] Sending the target node instance corresponding to the next data circulation connector node to the current data circulation connector node, so that the current data circulation connector node sends a second data access request for the target data to the next data circulation connector node determined based on the target node instance; wherein, after receiving the second data access request, the next data circulation connector node determines whether its own node code is consistent with the node code of the second connector node in the trusted data space carried in the second data access request, and obtains a corresponding code determination result;

[0017] If the encoding judgment result represents inconsistency, the next data circulation connector node is determined as the new current data circulation connector node, and the process jumps to the step of obtaining the current node instance request sent by the current data circulation connector node, until the node encoding of the next data circulation connector node is consistent with the node encoding carried in the second data access request, so as to obtain the final data circulation connector nodes; the data circulation connector nodes include the first connector node, the second connector node, and several intermediate connector nodes located between the first connector node and the second connector node;

[0018] A data flow path formed by the first connector node, the intermediate connector node, and the second connector node is determined.

[0019] Optionally, obtaining the final data flow connector nodes includes:

[0020] Obtaining a second target verification request sent by the next data circulation connector node;

[0021] A target verification is performed on the second target verification request and the second target verification result is returned to the next data circulation connector node, so that when the second target verification result indicates that the verification is successful, the next data circulation connector node is determined to be the second connector node to obtain the first connector node, the second connector node and the intermediate connector node.

[0022] Optionally, the node instance includes the IP address and port number corresponding to the node instance, pipeline information and an encrypted private key; the pipeline information includes a pipeline communication protocol and an encryption algorithm; the encrypted private key is used by the data demander to decrypt the received target data.

[0023] Optionally, the target verification process for the target verification request includes:

[0024] Verify whether the first connector node corresponding to the data demander meets the preset identity legitimacy condition. If the first connector node corresponding to the data demander meets the preset identity legitimacy condition, send an access permission verification request to a preset access control module so that the preset access control module verifies whether the data demander has the authority to access the target data;

[0025] Obtaining a permission verification result returned by the preset access control module, and if the permission verification result indicates that the data requester has permission to access the target data, determining the target verification result as verification success;

[0026] Accordingly, after the preset access control module verifies whether the data requester has the authority to access the target data, it further includes:

[0027] The preset access control module returns the permission verification result to the registration center, and stores the permission verification result and the permission verification process in the blockchain.

[0028] Optionally, after determining the target verification result as verification success, the method further includes:

[0029] Returning data flow pipeline information to the second connector node; the data flow pipeline information includes pipeline information and an encrypted public key; wherein the encrypted public key is used by the data provider to encrypt data to be sent; the pipeline information includes a pipeline communication protocol and an encryption algorithm;

[0030] Accordingly, transmitting the target data to be transmitted to the data requester through the data flow path includes:

[0031] The data to be sent is converted into a message using the pipeline communication protocol in the pipeline information, and the message is encrypted according to the encrypted public key and the encryption algorithm in the pipeline information to obtain the target data, and the target data is sent to the data demander based on the data flow path.

[0032] In a second aspect, the present application provides a data circulation device in a trusted data space, which is applied to a registration center in a trusted data space. The data transmission layer of the trusted data space includes multiple connector nodes. The data transmission layer transmits data through the connector nodes and the data pipelines between the connector nodes. The device includes:

[0033] a request acquisition module, configured to acquire a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node;

[0034] a data transmission module, configured to respond to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that a data provider transmits target data to be transmitted to the data requester through the data flow path; wherein the data provider accesses the trusted data space through the second connector node;

[0035] Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

[0036] In a third aspect, the present application provides an electronic device, comprising:

[0037] Memory, used to store computer programs;

[0038] The processor is used to execute the computer program to implement the aforementioned data circulation method in the trusted data space.

[0039] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned data circulation method in a trusted data space.

[0040] In the present application, a node instance request is obtained from a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node; responds to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that the data provider transmits the target data to be transmitted to the data demander through the data flow path; wherein the data provider accesses the trusted data space through the second connector node; wherein, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes and the second connector node located in the trusted data space. As can be seen from the above, the present application constructs a cross-node data flow path based on the first connector node, several intermediate connector nodes and the second connector node located in the trusted data space, so that the data provider transmits the target data to be transmitted to the data demander through the data flow path. By introducing intermediate nodes to achieve data forwarding, complex full-network direct connections are converted into controllable multi-hop paths. While ensuring security and compliance, the efficiency and management issues of large-scale data circulation are solved, enabling the trusted data space to adapt to scenarios with high regulatory and security requirements, and promoting the secure sharing and value release of cross-organizational data. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0042] Figure 1 This is a flow chart of a data circulation method in a trusted data space disclosed in this application;

[0043] Figure 2 This is a schematic diagram of a data flow architecture in a trusted data space disclosed in this application;

[0044] Figure 3 A schematic diagram of a peer-to-peer data circulation method in a trusted data space disclosed in this application;

[0045] Figure 4This is a schematic diagram of a cross-node data flow method in a trusted data space disclosed in this application;

[0046] Figure 5 This is a schematic diagram of the structure of a data circulation device in a trusted data space disclosed in this application;

[0047] Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0049] As data becomes a key production factor, the demand for cross-organizational data circulation has surged. However, data connectors in existing technologies mostly use point-to-point data circulation methods, which do not support cross-node data circulation methods and are difficult to meet the needs of scenarios with central nodes. To this end, this application provides a data circulation method in a trusted data space, which supports cross-node data circulation methods and realizes the secure transmission and sharing of data in a trusted data space.

[0050] See also Figure 1 As shown, an embodiment of the present application discloses a data circulation method in a trusted data space, which is applied to a registration center in a trusted data space. The data transmission layer of the trusted data space includes multiple connector nodes, and the data transmission layer transmits data through the connector nodes and the data pipelines between the connector nodes; wherein the method includes:

[0051] Step S11: Obtain a node instance request sent by a data demander through a first connector node in the trusted data space; wherein, the data demander accesses the trusted data space through the first connector node.

[0052] This embodiment describes two data circulation methods in a trusted data space, namely, point-to-point circulation and cross-node circulation. In a trusted data space, point-to-point data circulation is the simplest and most common data circulation method. By setting up a circulation pipeline between two connector nodes, data circulation between the two connector nodes can be achieved. As the number of connector nodes in the trusted data space increases, some business scenarios require the setting of business intermediate nodes. Other nodes are not allowed to transmit data directly, and data must be forwarded through intermediate nodes to meet the controllability of business logic.

[0053] As shown in Figure 2, the trusted data space mainly includes the following modules:

[0054] 1. Connector: The core component for data transmission and sharing in the trusted data space. It is the entry point for all parties to access the trusted data space. Its main responsibilities are:

[0055] Trusted data space access portal: All parties, including data providers, developers, and data demanders, need to access the trusted data space through connectors.

[0056] Data sender and receiver: In a trusted data space, data requests between nodes can only be sent and received through connectors, and the legitimacy of the connector identity is verified through unified identity recognition;

[0057] Data and service gateway: Data providers and developers use connectors to open up their data resources and services to the outside world, and push data products to portal management;

[0058] Reverse proxy: The connector acts as a proxy for the data and services within its node. When a data demander requests data, they do not know the actual address of the data, but forward it through the connector.

[0059] Active registration: After the connector is started, it will automatically register its node information with the registration center. The connector will not start working until the registration is successful;

[0060] Heartbeat maintenance: After the connector is registered, it sends a heartbeat request to the registration center at regular intervals to prove its survival.

[0061] 2. Registration Center: The registration center is responsible for the unified management of each node connector in the trusted data space and the data flow pipeline between nodes. Its main responsibilities are:

[0062] Node management: After the node connector is started, it will automatically register its node information with the registration center, and the registration center will check the legitimacy of the connector identity. After successful registration, the registration center will centrally manage the entire life cycle of the node;

[0063] Heartbeat check: The registration center periodically checks whether each connector maintains its heartbeat. If a connector does not receive a heartbeat request for a certain period of time, the registration center marks it as inactive and kicks it out.

[0064] Node discovery: Before requesting data, the demander connector first requests an available target node instance from the registration center. The registration center assigns the demander connector an available node instance based on the node's survival status and instance weight; the connector may be deployed in multiple instances, and each instance can be set with a weight value, which defaults to 1. The larger the weight value, the greater the possibility of being called. If the weight values of all instances are consistent and are all 1, the probability of calling is uniform. If some instances are located on servers with better performance, more CPU cores, and larger memory, the response weight value can be set larger, so that the probability of being called is high and resources can be repeated. Conversely, the weight of poor performance is set lower;

[0065] Pipeline management: Data can only be transmitted after two connectors have established a data flow pipeline. The registration center is responsible for unified management of pipeline establishment and destruction.

[0066] Path planning: There may be multiple pipeline routes available between two connectors in a trusted data space. The registration center will automatically provide the shortest path for data transmission.

[0067] 3. Distribution pipeline: The distribution pipeline is not a real software entity, but a business logic concept used to represent the route and direction of data circulation. Its main responsibilities are:

[0068] Pipeline direction: Flow pipelines are divided into unidirectional pipelines and bidirectional pipelines. Unidirectional pipelines only allow data to flow in one direction, while bidirectional pipelines allow data to flow in both directions;

[0069] Data encryption: The circulation pipeline defines the encryption method of data during circulation, and currently supports RSA and SM2 encryption algorithms;

[0070] Transport Protocol: The transport pipeline defines the protocol used to transport data during its flow. Currently, it supports protocols such as HTTP (Hypertext Transfer Protocol), MQTT (Message Queuing Telemetry Transport), and CoAP (Constrained Application Protocol). Furthermore, it allows users to develop their own proprietary protocols, enabling the use of private protocols for data flow.

[0071] 4. Access control: used to manage access permissions between connectors to ensure that only authorized connectors can access specific data resources.

[0072] 5. Blockchain: It realizes decentralized storage, transmission and verification of data through encryption algorithms, consensus mechanisms and peer-to-peer networks. Its core features are transparency, immutability and security.

[0073] 6. Encryption service: The original information (plain text) is converted into cipher text through encryption algorithm, making it difficult for unauthorized third parties to interpret the information. It is used to protect the information transmitted in the pipeline.

[0074] Regardless of whether it is a point-to-point circulation method or a cross-node circulation method, it is first necessary to obtain a node instance request sent by the data demander through the first connector node in the trusted data space; wherein, the node instance request includes the node code corresponding to the data provider.

[0075] In this way, the data demander connector requests an available data supplier node instance from the registration center through the data supplier node code, so as to obtain the target data from the available data supplier node instance.

[0076] Step S12: respond to the node instance request to determine the data flow path between the first connector node and the second connector node in the trusted data space, so that the data provider transmits the target data to be transmitted to the data demander through the data flow path; wherein, the data provider accesses the trusted data space through the second connector node.

[0077] Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

[0078] In a specific embodiment, if the data flow mode between the current data demander and the data provider is a point-to-point flow mode, responding to a node instance request to determine the data flow path between the first connector node and the second connector node in the trusted data space may include: upon receiving a node instance request, checking whether the first connector node corresponding to the data demander meets the preset identity legitimacy conditions and whether there is an available data flow channel between the first connector node and the connector node corresponding to the data provider. If the first connector node meets the preset identity legitimacy conditions and there is an available data flow channel between the first connector node and the connector node corresponding to the data provider, then returning the target node instance to the first connector node so that the first connector node sends a first data access request for the target data to the target connector node corresponding to the target node instance, so that the target connector node determines whether the node code of the second connector node in the trusted data space carried in the first data access request is consistent with its own node code, and sends a first target verification request to the registration center. A target verification is performed on the first target verification request and the first target verification result is returned to the target connector node, so that when the target node code carried in the first data access request is consistent with the node code of the target connector node and the first target verification result indicates that the verification is successful, the target connector node is determined as the second connector node to obtain the data flow path between the first connector node and the second connector node.

[0079] In another specific embodiment, if the data flow between the current data demander and the data provider is a cross-node flow, obtaining a node instance request sent by the data demander via a first connector node in a trusted data space, and responding to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space may include: first obtaining a current node instance request sent by the current data flow connector node; if the current data flow connector node meets a preset identity validity condition and an available data flow channel exists between the current data flow connector node and the connector node corresponding to the data provider, then determining a next data flow connector node of the current data flow connector node from the trusted data space based on the current node instance request; wherein the first connector node in the trusted data space is the first data flow connector node; and then sending a target node instance corresponding to the next data flow connector node to the current data flow connector node, so that the current data flow connector node sends a second data access request for the target data to the next data flow connector node determined based on the target node instance; wherein, after receiving the second data access request, the next data flow connector node determines whether its own node code is consistent with the node code of the second connector node in the trusted data space carried in the second data access request, and obtains a corresponding code determination result. If the encoding determination result indicates inconsistency, the next data circulation connector node is determined as the new current data circulation connector node, and the process proceeds to the step of obtaining the current node instance request sent by the current data circulation connector node, until the node encoding of the next data circulation connector node matches the node encoding carried in the second data access request, thereby obtaining the final data circulation connector nodes. Each data circulation connector node includes a first connector node, a second connector node, and several intermediate connector nodes located between the first connector node and the second connector node. Finally, the data circulation path formed by the first connector node, the intermediate connector nodes, and the second connector node is determined.

[0080] The above-mentioned obtaining of the final data circulation connector nodes may include: first obtaining a second target verification request sent by the next data circulation connector node, then performing a target verification on the second target verification request and returning the second target verification result to the next data circulation connector node, so that when the second target verification result indicates a successful verification, the next data circulation connector node is determined as the second connector node, thereby obtaining the first connector node, the second connector node, and the intermediate connector node.

[0081] In the cross-node circulation mode, the process of using the registration center to initially return an intermediate node instance for a first connector node corresponding to a data requester may include: determining each data circulation pipeline path between the first connector node and the connector node corresponding to the data provider, and determining a target shortest path with the fewest intermediate nodes between the first connector node and the connector node corresponding to the data provider from each data circulation pipeline path using a preset shortest path algorithm. Then, determining the intermediate node closest to the first connector node in the target shortest path, and returning the intermediate node instance corresponding to the intermediate node to the first connector node.

[0082] It should be noted that the node instances mentioned in the above two implementations include but are not limited to the IP address and port number corresponding to the node instance, pipeline information and the encrypted private key; wherein, the pipeline information includes but is not limited to the pipeline communication protocol and encryption algorithm; the above encrypted private key can be used by the data demander to decrypt the received target data.

[0083] Meanwhile, the process of performing target verification on a target verification request in the above two embodiments may include: first verifying whether the first connector node corresponding to the data requester satisfies a preset identity legitimacy condition; if so, sending an access permission verification request to a preset access control module so that the preset access control module verifies whether the data requester has permission to access the target data; then obtaining a permission verification result returned by the preset access control module; and if the permission verification result indicates that the data requester has permission to access the target data, determining the target verification result as verification success.

[0084] Correspondingly, after the preset access control module verifies whether the data requester has the authority to access the target data, it can also include: the preset access control module returns the authority verification result to the registration center, and stores the authority verification result and the authority verification process in the blockchain.

[0085] Furthermore, after the target verification result is determined as a successful verification, the above-mentioned process may also include: returning the data flow pipeline information to the second connector node; the data flow pipeline information includes pipeline information and an encrypted public key; wherein the encrypted public key is used by the data provider to encrypt the data to be sent; the pipeline information includes a pipeline communication protocol and an encryption algorithm.

[0086] Accordingly, after determining the data flow path, transmitting the target data to be transmitted to the data demander through the data flow path may include: using the pipeline communication protocol in the pipeline information to convert the data to be sent into a message, and encrypting the message according to the encrypted public key and the encryption algorithm in the pipeline information to obtain the target data, and sending the target data to the data demander based on the data flow path.

[0087] For example, see Figure 3 The request chain for peer-to-peer circulation is shown:

[0088] 1. The data demander connector node requests an available data provider node instance from the registration center through the data provider node code.

[0089] 2. The registration center checks whether the data demander connector node meets the identity legitimacy and whether there is a flow channel between the data demander connector node and the data supplier connector node. If all are met, the registration center returns an available data supplier node instance based on the data supplier connector node's survival status, weight ratio, etc., which specifically includes the following information:

[0090] IP address and port number of the node instance;

[0091] Pipeline information such as pipeline communication protocol and encryption algorithm;

[0092] If the data needs to be encrypted and transmitted within the pipeline, an encrypted private key will also be included.

[0093] 3. The data consumer connector node initiates a data access request to the data provider connector node based on the IP address and port number of the returned data provider node instance. This request carries the data provider node code. During pipeline transmission, the request is converted into a corresponding message according to the communication protocol in the pipeline.

[0094] 4. After receiving the data access request, the data supplier connector node first performs the following verification:

[0095] The legitimacy of the identity of the data demander's connector node;

[0096] Whether the data provider node code carried in the data access request is consistent with the data provider connector node;

[0097] Whether there is an available data flow channel between the data demander connector node and the data supplier connector node;

[0098] Whether the data demander has the authority to access this data resource.

[0099] 5. The registration center does not verify access rights to data resources, but rather verifies them through access control. Access control performs the following verification process:

[0100] Query the access policies that can be executed based on the data demander and the accessed resources;

[0101] Execute access policies. For multiple access policies, the permission intersection problem needs to be resolved based on the execution policies.

[0102] Return the permission verification results to the registration center and save the verification results and verification process to the blockchain to ensure the traceability of the process;

[0103] In access control, there is at least one ABAC (Attribute-Based Access Control) access policy between a subject (here, the data demander) and a resource. Only when this policy is met can the subject access the resource.

[0104] 6. Access control returns the permission verification result to the registration center to indicate whether the data demander has the permission to access this resource.

[0105] 7. The registration center returns the verification results of steps 4 and 5 above to the data supplier connector node. If the verification is successful, the registration center also returns the distribution channel information. The distribution channel information is as follows:

[0106] Pipeline information such as pipeline communication protocol and encryption algorithm;

[0107] If the data needs to be encrypted for transmission within the pipeline, an encrypted public key will also be included.

[0108] 8. The data supplier connector node processes the resource data that needs to be returned to the data consumer connector node within the pipeline and returns the target data to the data consumer connector node. The pipeline processing includes:

[0109] Convert resource data into messages according to the pipeline communication protocol;

[0110] The data to be transmitted is encrypted according to the pipeline encryption algorithm and the provided public key to obtain the target data.

[0111] See also Figure 4 The cross-node circulation request chain shown:

[0112] 1. The data demander connector node requests an available data provider node instance from the registration center through the data provider node code.

[0113] 2. The registration center checks whether the data demander connector node meets the identity legitimacy and whether there is a circulation channel between the data demander connector node and the data supplier connector node. If all are met, the registration center queries all pipeline paths between the data demander connector node and the data supplier connector node. The shortest path algorithm is used to determine the shortest path between the data demander connector node and the data supplier connector node with the fewest intermediate nodes. The registration center returns an available intermediate node instance corresponding to the intermediate node closest to the data demander connector node in the shortest path to the data demander connector node. The intermediate node instance contains the following information:

[0114] IP address and port number of the node instance;

[0115] Pipeline information such as pipeline communication protocol and encryption algorithm.

[0116] If the data needs to be encrypted and transmitted within the pipeline, an encrypted private key will also be included.

[0117] 3. The data demander's connector node, based on the obtained IP address and port number of the intermediate node instance, initiates a data access request to the intermediate node to request the target data. The request carries the data provider node's code. During pipeline transmission, the request is converted into a corresponding message based on the communication protocol within the pipeline.

[0118] 4. After receiving a data access request, the intermediate node first determines whether the node code carried in the data access request is consistent with its own. If so, it indicates that it is the target node of the request. It then performs the corresponding verification and returns the data to the data demander connector node. If not, it forwards the request and requests an available data provider node instance from the registration center.

[0119] 5. Similar to step 2, the registration center checks whether the intermediate node meets the identity legitimacy and whether there is a circulation channel between the data demander connector node and the data supplier connector node. If both are met, the registration center queries all the pipeline paths between the intermediate node and the data supplier connector node and calculates the shortest path. The registration center returns to the intermediate node the available data supplier node instance corresponding to the data supplier node closest to the data demander connector node in the shortest path. The data supplier node instance contains the following information:

[0120] IP address and port number of the node instance;

[0121] Pipeline information such as pipeline communication protocol and encryption algorithm;

[0122] If the data needs to be encrypted and transmitted within the pipeline, an encrypted private key will also be included.

[0123] 6. Based on the IP address and port number of the data provider node instance, the intermediate node forwards a data access request to the data provider connector node. The request carries the data provider node ID. During pipeline transmission, the request is converted into a corresponding message according to the communication protocol in the pipeline.

[0124] 7. As in step 4, after receiving the request, the data supplier connector node first determines whether the node code carried in the request is consistent with its own. If it is consistent, the data supplier connector node performs a verification based on the registration center. The verification includes the following:

[0125] The legitimacy of the identity of the data demander's connector node;

[0126] Whether there is an available data flow channel between the data demander connector node and the data supplier connector node;

[0127] Whether the data demander has permission to access this resource.

[0128] 8. The registration center does not verify access rights to data resources, but rather verifies them through access control. Access control performs the following verification process:

[0129] Query the access policies that can be executed based on the data demander and the accessed resources;

[0130] Execute access policies. For multiple access policies, the permission intersection problem needs to be resolved based on the execution policies.

[0131] The permission verification results are returned to the registration center, and the verification results and verification process are saved in the blockchain to ensure the traceability of the process.

[0132] 9. Access control returns the permission verification result to the registration center to indicate whether the data demander has the permission to access this resource.

[0133] 10. The registration center returns the verification results of steps 7 and 8 above to the data supplier connector node. If the verification is successful, the registration center also returns the distribution channel information. The distribution channel information is as follows:

[0134] Pipeline information such as pipeline communication protocol and encryption algorithm;

[0135] If the data needs to be encrypted for transmission within the pipeline, an encrypted public key will also be included.

[0136] 11. The data supplier connector node processes the resource data that needs to be returned to the data demander connector node within the pipeline and returns the target data to the intermediate node. The pipeline processing includes:

[0137] Convert resource data into messages according to the pipeline communication protocol;

[0138] The data to be transmitted is encrypted according to the pipeline encryption algorithm and the provided public key to obtain the target data.

[0139] 12. After receiving the data, the intermediate node continues to forward the data until the target data is forwarded to the data demander's connector node.

[0140] As can be seen from the above, this embodiment uses a registration center to verify the legitimacy of the demander's identity and pipeline availability before data circulation. The access control module implements fine-grained policies based on the demander's role and target resource type. The circulation pipeline supports encryption algorithms such as RSA and SM2. The registration center dynamically allocates encryption keys based on the data's sensitivity level, ensuring that data remains in ciphertext during transmission, reducing transmission security risks. Furthermore, the access control permission verification results and verification process are stored on-chain, leveraging the blockchain's immutability to form a complete audit trail. Furthermore, whether for point-to-point or cross-node data circulation, the data path is dynamically planned by the registration center using a shortest path algorithm. When circulating across nodes, data must be forwarded through designated intermediate nodes, ensuring controllable data circulation. Furthermore, cross-node data circulation is supported, meeting the needs of scenarios where a central node is present, enabling secure data transmission and sharing within a trusted data space. Thus, this embodiment combines blockchain technology, encryption technology, and access control technology to achieve controllable, secure, and efficient data circulation, providing a complete technical solution for secure data circulation and sharing within a trusted space.

[0141] See also Figure 5 As shown, the embodiment of the present application further discloses a data circulation device in a trusted data space, which is applied to a registration center in a trusted data space. The data transmission layer of the trusted data space includes multiple connector nodes. The data transmission layer transmits data through the connector nodes and the data pipelines between the connector nodes. The device includes:

[0142] A request acquisition module 11 is configured to acquire a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node;

[0143] a data transmission module 12, configured to respond to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that a data provider transmits target data to be transmitted to the data requester via the data flow path; wherein the data provider accesses the trusted data space via the second connector node;

[0144] Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

[0145] As can be seen from the above, this application constructs a cross-node data flow path based on a first connector node, several intermediate connector nodes, and a second connector node located in a trusted data space, so that the data provider can transmit the target data to be transmitted to the data demander through this data flow path. By introducing intermediate nodes to achieve data forwarding, the complex full-network direct connection is converted into a controllable multi-hop path. Under the premise of ensuring security and compliance, it solves the efficiency and management issues of large-scale data circulation, enables the trusted data space to adapt to scenarios with high regulatory and security requirements, and promotes the secure sharing and value release of cross-organizational data.

[0146] In some specific implementations, if the data flow between the current data demander and the data provider is a point-to-point flow, the data transmission module 12 includes:

[0147] a first verification unit configured to, upon receiving the node instance request, check whether the first connector node corresponding to the data demander satisfies a preset identity legitimacy condition and whether there is an available data flow channel between the first connector node and the connector node corresponding to the data provider;

[0148] an instance returning unit, configured to return a target node instance to the first connector node if the first connector node satisfies a preset identity legitimacy condition and an available data flow channel exists between the first connector node and the connector node corresponding to the data provider, so that the first connector node sends a first data access request for target data to the target connector node corresponding to the target node instance, so that the target connector node determines whether the node code of the second connector node in the trusted data space carried in the first data access request is consistent with its own node code, and sends a first target verification request to the registration center;

[0149] A first path determination unit is configured to perform target verification on the first target verification request and return a first target verification result to the target connector node, so that when the target node code carried in the first data access request is consistent with the node code of the target connector node and the first target verification result indicates that the verification is successful, the target connector node is determined to be the second connector node to obtain a data flow path between the first connector node and the second connector node.

[0150] In some specific implementations, if the data flow between the current data demander and the data provider is a cross-node flow, the data transmission module 12 includes:

[0151] A first request acquisition unit is configured to acquire a current node instance request sent by a current data circulation connector node, and if the current data circulation connector node satisfies a preset identity legitimacy condition and an available data circulation pipeline exists between the current data circulation connector node and a connector node corresponding to a data provider, determine a next data circulation connector node of the current data circulation connector node from the trusted data space based on the current node instance request;

[0152] Wherein, the first connector node in the trusted data space is the first data circulation connector node;

[0153] an instance sending unit, configured to send the target node instance corresponding to the next data circulation connector node to the current data circulation connector node, so that the current data circulation connector node sends a second data access request for the target data to the next data circulation connector node determined based on the target node instance; wherein, after receiving the second data access request, the next data circulation connector node determines whether its own node code is consistent with the node code of the second connector node in the trusted data space carried in the second data access request, and obtains a corresponding code determination result;

[0154] a node determination submodule configured to, if the encoding judgment result characterizes inconsistency, determine the next data circulation connector node as a new current data circulation connector node, and jump to the step of obtaining the current node instance request sent by the current data circulation connector node, until the node encoding of the next data circulation connector node is consistent with the node encoding carried in the second data access request, so as to obtain final data circulation connector nodes; the data circulation connector nodes include the first connector node, the second connector node, and a plurality of intermediate connector nodes located between the first connector node and the second connector node;

[0155] The second path determining unit is configured to determine a data flow path formed by the first connector node, the intermediate connector node, and the second connector node.

[0156] In some specific implementations, the node determination submodule includes:

[0157] A second request obtaining unit, configured to obtain a second target verification request sent by the next data circulation connector node;

[0158] A second verification unit is used to perform target verification on the second target verification request and return the second target verification result to the next data circulation connector node, so that when the second target verification result indicates that the verification is successful, the next data circulation connector node is determined to be the second connector node, so as to obtain the first connector node, the second connector node and the intermediate connector node.

[0159] In some specific embodiments, the node instance includes the IP address and port number corresponding to the node instance, pipeline information and an encrypted private key; the pipeline information includes a pipeline communication protocol and an encryption algorithm; the encrypted private key is used by the data demander to decrypt the received target data.

[0160] In some specific implementations, the process of performing target verification on a target verification request includes:

[0161] a request sending submodule, configured to verify whether the first connector node corresponding to the data demander satisfies a preset identity legitimacy condition; and if so, to send an access permission verification request to a preset access control module, so that the preset access control module can verify whether the data demander has permission to access the target data;

[0162] A result acquisition submodule is configured to obtain the permission verification result returned by the preset access control module, and if the permission verification result indicates that the data requester has the permission to access the target data, the target verification result is determined to be a successful verification;

[0163] Correspondingly, the request sending submodule further includes:

[0164] The result returning unit is used to preset the access control module to return the permission verification result to the registration center, and store the permission verification result and the permission verification process in the blockchain.

[0165] In some specific implementations, the result acquisition submodule further includes:

[0166] An information return unit, configured to return data flow pipeline information to the second connector node; the data flow pipeline information includes pipeline information and an encrypted public key; wherein the encrypted public key is used by the data provider to encrypt data to be sent; the pipeline information includes a pipeline communication protocol and an encryption algorithm;

[0167] Accordingly, the data transmission module 12 includes:

[0168] A data sending unit is used to convert the data to be sent into a message using the pipeline communication protocol in the pipeline information, and encrypt the message according to the encrypted public key and the encryption algorithm in the pipeline information to obtain target data, and send the target data to the data demander based on the data flow path.

[0169] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0170] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the data circulation method in the trusted data space disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0171] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0172] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0173] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, NetWare, Unix, Linux, etc. In addition to including computer programs that can be used to implement the data circulation method in the trusted data space executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs that can be used to perform other specific tasks.

[0174] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned disclosed method for data circulation in a trusted data space. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0175] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0176] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0177] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0178] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0179] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A data circulation method in a trusted data space, characterized in that: A registration center is applied to a trusted data space, wherein the data transmission layer of the trusted data space includes multiple connector nodes, and the data transmission layer transmits data through the connector nodes and data pipelines between the connector nodes; wherein the method includes: Obtaining a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node; Responding to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that a data provider transmits target data to be transmitted to the data requester through the data flow path; wherein the data provider accesses the trusted data space through the second connector node; Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

2. The data circulation method in a trusted data space according to claim 1, characterized in that: If the data flow mode between the current data demander and the data provider is a point-to-point flow mode, responding to the node instance request to determine the data flow path between the first connector node and the second connector node in the trusted data space includes: When receiving the node instance request, checking whether the first connector node corresponding to the data demander meets the preset identity legitimacy conditions and whether there is an available data flow channel between the first connector node and the connector node corresponding to the data provider; If the first connector node meets the preset identity legitimacy condition and an available data flow channel exists between the first connector node and the connector node corresponding to the data provider, a target node instance is returned to the first connector node, so that the first connector node sends a first data access request for the target data to the target connector node corresponding to the target node instance, so that the target connector node determines whether the node code of the second connector node in the trusted data space carried in the first data access request is consistent with its own node code, and sends a first target verification request to the registration center; A target verification is performed on the first target verification request and the first target verification result is returned to the target connector node, so that when the target node code carried in the first data access request is consistent with the node code of the target connector node and the first target verification result indicates that the verification is successful, the target connector node is determined to be the second connector node to obtain the data flow path between the first connector node and the second connector node.

3. The data circulation method in a trusted data space according to claim 1, characterized in that: If the data flow mode between the current data demander and the data provider is a cross-node flow mode, the data demander receives a node instance request sent through a first connector node in the trusted data space, and responds to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, including: Obtaining a current node instance request sent by a current data circulation connector node, and if the current data circulation connector node meets a preset identity legitimacy condition and an available data circulation pipeline exists between the current data circulation connector node and a connector node corresponding to a data provider, determining a next data circulation connector node of the current data circulation connector node from the trusted data space based on the current node instance request; Wherein, the first connector node in the trusted data space is the first data circulation connector node; Sending the target node instance corresponding to the next data circulation connector node to the current data circulation connector node, so that the current data circulation connector node sends a second data access request for the target data to the next data circulation connector node determined based on the target node instance; wherein, after receiving the second data access request, the next data circulation connector node determines whether its own node code is consistent with the node code of the second connector node in the trusted data space carried in the second data access request, and obtains a corresponding code determination result; If the encoding judgment result represents inconsistency, the next data circulation connector node is determined as the new current data circulation connector node, and the process jumps to the step of obtaining the current node instance request sent by the current data circulation connector node, until the node encoding of the next data circulation connector node is consistent with the node encoding carried in the second data access request, so as to obtain the final data circulation connector nodes; the data circulation connector nodes include the first connector node, the second connector node, and several intermediate connector nodes located between the first connector node and the second connector node; A data flow path formed by the first connector node, the intermediate connector node, and the second connector node is determined.

4. The data circulation method in a trusted data space according to claim 3, characterized in that: The final data flow connector nodes are obtained, including: Obtaining a second target verification request sent by the next data circulation connector node; A target verification is performed on the second target verification request and the second target verification result is returned to the next data circulation connector node, so that when the second target verification result indicates that the verification is successful, the next data circulation connector node is determined to be the second connector node to obtain the first connector node, the second connector node and the intermediate connector node.

5. The data circulation method in a trusted data space according to any one of claims 2 to 3, characterized in that: The node instance includes the IP address and port number corresponding to the node instance, pipeline information and an encrypted private key; the pipeline information includes the pipeline communication protocol and encryption algorithm; the encrypted private key is used by the data demander to decrypt the received target data.

6. The data circulation method in a trusted data space according to any one of claims 2 to 4, characterized in that: The process of performing target verification for a target verification request includes: Verify whether the first connector node corresponding to the data demander meets the preset identity legitimacy condition. If the first connector node corresponding to the data demander meets the preset identity legitimacy condition, send an access permission verification request to a preset access control module so that the preset access control module verifies whether the data demander has the authority to access the target data; Obtaining a permission verification result returned by the preset access control module, and if the permission verification result indicates that the data requester has permission to access the target data, determining the target verification result as verification success; Accordingly, after the preset access control module verifies whether the data requester has the authority to access the target data, it further includes: The preset access control module returns the permission verification result to the registration center, and stores the permission verification result and the permission verification process in the blockchain.

7. The data circulation method in a trusted data space according to claim 6, characterized in that: After determining the target verification result as verification success, the method further includes: Returning data flow pipeline information to the second connector node; the data flow pipeline information includes pipeline information and an encrypted public key; wherein the encrypted public key is used by the data provider to encrypt data to be sent; the pipeline information includes a pipeline communication protocol and an encryption algorithm; Accordingly, transmitting the target data to be transmitted to the data requester through the data flow path includes: The data to be sent is converted into a message using the pipeline communication protocol in the pipeline information, and the message is encrypted according to the encrypted public key and the encryption algorithm in the pipeline information to obtain the target data, and the target data is sent to the data demander based on the data flow path.

8. A data circulation device in a trusted data space, characterized in that: A registration center is applied to a trusted data space, wherein the data transmission layer of the trusted data space includes multiple connector nodes, and the data transmission layer transmits data through the connector nodes and data pipelines between the connector nodes, wherein the device includes: a request acquisition module, configured to acquire a node instance request sent by a data demander through a first connector node in the trusted data space; wherein the data demander accesses the trusted data space through the first connector node; a data transmission module, configured to respond to the node instance request to determine a data flow path between the first connector node and a second connector node in the trusted data space, so that a data provider transmits target data to be transmitted to the data requester through the data flow path; wherein the data provider accesses the trusted data space through the second connector node; Among them, if the current data flow mode between the data demander and the data provider is a point-to-point flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node and the second connector node; if the current data flow mode between the data demander and the data provider is a cross-node flow mode, then the data flow connector nodes corresponding to the data flow path include the first connector node, several intermediate connector nodes located in the trusted data space, and the second connector node.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the data circulation method in a trusted data space as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that Used to store a computer program, which, when executed by a processor, implements the data circulation method in a trusted data space as described in any one of claims 1 to 7.

Images