Cross-subject data security sharing system and method based on multi-party security computing

Abstract

The invention discloses a cross-subject data security sharing system and method based on multi-party security computing, and relates to the technical field of information security, and the method comprises the steps: constructing a trust verification network based on a block chain, deploying a smart contract, setting an access permission rule for each record in a security data record set by using an autonomous access control method, and carrying out the security sharing of the records in the security data record set; the smart contract performs legality verification on the access request according to permission rules in a data authorization rule base, and obtains an access permission response containing an authorization token; and performing multi-party security calculation according to the access permission response, recording a calculation result into a block chain log, and performing data security sharing. According to the invention, by constructing the trust verification network based on the block chain and deploying the smart contract, the establishment of a decentralized trust mechanism is realized, the security and reliability in a multi-party cooperation environment are ensured, and the beneficial effect of enhancing the single-point failure risk resistance is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a cross-subject data security sharing system and method based on multi-party secure computing. Background Art

[0002] With the widespread application of data elements in finance, healthcare, government affairs and other fields, the demand for cross-party data collaboration is growing. To ensure the security and compliance of data circulation, existing technologies generally adopt a centralized permission management mechanism combined with encrypted storage methods to achieve data sharing. The data provider uploads the desensitized data to a trusted third-party platform, which verifies the identity of the requester and assigns permissions based on preset access control policies. After authorization is completed, the system ensures the security of the data transmission process through secure communication protocols or basic encryption algorithms. This method achieves a certain degree of controllable data sharing and is suitable for application scenarios within a single trust domain.

[0003] However, in data collaboration scenarios involving multiple parties and across organizational boundaries, the above approach has two key problems: first, due to the lack of a decentralized trust mechanism, permission verification relies on central nodes, posing a single point of failure risk; second, traditional permission rules are mostly focused on static configuration, making it difficult to support dynamic auditing and on-chain traceability. Summary of the Invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a cross-subject data security sharing method based on multi-party secure computing to solve the problems of permission verification relying on central nodes and the untraceability of the authorization process in cross-organizational data collaboration.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, the present invention provides a cross-subject data security sharing method based on multi-party secure computing, which includes deploying a smart contract and building a trust verification network based on a blockchain based on an initialization information set; based on the initialization information set, preprocessing the source data in the database to generate a data fingerprint, and entering it into the smart contract together with the data description information to generate a secure data record set; using an autonomous access control method to set access permission rules for each record in the secure data record set, deploying the access permission rules on the blockchain through a smart contract, and generating a data authorization rule library; when the subject initiating the access request submits an access request to the trust verification network, the smart contract verifies the legitimacy of the access request according to the permission rules in the data authorization rule library, and obtains an access permission response containing an authorization token; performing multi-party secure computing based on the access permission response, and recording the computing results in the blockchain log and performing data security sharing.

[0007] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, the specific steps of deploying the smart contract are: Use multi-criteria decision analysis to select blockchain architecture and consensus mechanism and generate blockchain configuration plan; use automated deployment and configuration management to deploy multiple blockchain nodes in the local data center and generate blockchain node deployment information; Based on the blockchain configuration plan and blockchain node deployment information, multiple core smart contracts are deployed on the blockchain network through the smart contract compilation and deployment method to generate a set of smart contract interface addresses.

[0008] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, wherein: a trust verification network based on blockchain is constructed according to the initialization information set, and the specific steps are: Participants register their identities in the blockchain network and obtain a set of identity identification information; Use the configuration information integration method to integrate blockchain node deployment information, smart contract interface address set and identity information set to generate an initialization information set; The initialization information set is written into the blockchain ledger through the genesis block to form a trust verification network based on the blockchain.

[0009] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, wherein: based on the initialization information set, the source data in the database is preprocessed to generate a data fingerprint, and is entered into the smart contract together with the data description information to generate a secure data record set. The specific steps are: Perform data cleaning and data desensitization on the source data, and use the hash algorithm to perform data fingerprint operation on the pre-processed source data to generate data fingerprint; Use JSON metadata binding method to associate metadata and structurally encapsulate the fingerprint value of each data in the data fingerprint to generate a data description information set; Through the interactive call of the smart contract, the metadata record and the corresponding fingerprint value in the data description information set are passed into the smart contract to form the on-chain transaction certificate; The multi-source data fusion method is used to integrate the fingerprint value, data description information set and on-chain transaction certificate in the data fingerprint to generate a secure data record set.

[0010] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, wherein: the autonomous access control method is used to set access permission rules for each record in the security data record set, and the specific steps are as follows: According to the DID of the data owner and combined with business needs, set access permission configuration for each data in the security data record set and generate an access authorization set; Encapsulate each rule in the access authorization set according to the JSON structure to generate access permission rules.

[0011] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, wherein: the access permission rules are deployed on the blockchain through the smart contract interface to generate a data authorization rule library, and the specific steps are as follows: Through smart contracts, access rights rules are deployed one by one on the blockchain to complete on-chain confirmation and form an on-chain authorized operation record; The structured data aggregation method is used to integrate access permission rules and on-chain authorization operation records to generate a data authorization rule library.

[0012] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, when the subject initiating the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request based on the permission rules in the data authorization rule library. The specific steps are as follows: receiving an access request submitted by a subject initiating the access request from the trust verification network; Use the field extraction method to extract the hash value from the access request, and search the permission rule record corresponding to the hash value in the data authorization rule library to generate a matching permission rule set.

[0013] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, the access permission response containing the authorization token is obtained by using the ternary verification method to compare the verification elements of the access request with the verification elements in the matching permission rule set one by one to generate an access permission response containing the authorization token.

[0014] As a preferred solution of the cross-subject data security sharing method based on multi-party secure computing described in the present invention, wherein: the multi-party secure computing is performed according to the access permission response, and the computing results are recorded in the blockchain log and the data is securely shared. The specific steps are: Use the secure computation initiation method to perform authorization parsing on the access permission response and generate a multi-party secure computation intermediate result; Use hash summary generation to extract audit summary information from the intermediate results of multi-party secure computation, combine it with the metadata in the access request, and submit it to the blockchain network in the form of an event log; Based on the authorization information in the access permission response, the multi-party secure computation results are shared with the authorized party through encrypted distribution, forming secure data sharing.

[0015] In a second aspect, the present invention provides a cross-subject data security sharing system based on multi-party secure computing, including a construction module for deploying smart contracts and building a blockchain-based trust verification network based on an initialization information set; The preprocessing module is used to preprocess the source data in the database based on the initialization information set, generate data fingerprints, and enter them into the smart contract together with the data description information to generate a secure data record set; The deployment module is used to set access rights rules for each record in the security data record set using the autonomous access control method, deploy the access rights rules to the blockchain through smart contracts, and generate a data authorization rule library; Verification module: When the subject who initiates the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request according to the permission rules in the data authorization rule library and obtains the access permission response containing the authorization token; The data security sharing module performs multi-party secure computation based on access permission responses, records the computation results in the blockchain log, and securely shares the data.

[0016] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the cross-subject data security sharing method based on multi-party secure computing as described in the first aspect of the present invention.

[0017] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the cross-subject data security sharing method based on multi-party secure computing as described in the first aspect of the present invention.

[0018] The present invention has the following beneficial effects: by building a blockchain-based trust verification network and deploying smart contracts, and outputting an initialization information set, a decentralized trust mechanism is established, ensuring security and reliability in a multi-party collaborative environment, and achieving the beneficial effect of enhancing resistance to single point failure risks. By utilizing autonomous access control methods to set access permission rules for each record in a secure data record set, and deploying these permission rules to the blockchain via smart contracts, a data authorization rule library is generated, enabling dynamic permission configuration and on-chain traceability. This makes permission management more flexible and highly transparent, thereby improving compliance and audit capabilities in the cross-subject data sharing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 The flowchart of the cross-subject data security sharing method based on multi-party secure computing.

[0021] Figure 2 Schematic diagram of a cross-subject data security sharing system based on multi-party secure computing.

[0022] Figure 3 Constructing a flow chart for a trust proof-of-trust network.

[0023] Figure 4 Flowchart for access request verification. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0025] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0026] Secondly, the term "one embodiment" or "embodiment" herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in various places throughout this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive of other embodiments.

[0027] Reference Figures 1 to 4 , is an embodiment of the present invention, which provides a cross-subject data security sharing method based on multi-party secure computing, including the following steps: S1. Deploy smart contracts and build a blockchain-based trust verification network based on the initialization information set.

[0028] S1.1. Use multi-criteria decision analysis to select blockchain architecture and consensus mechanism and generate blockchain configuration plan; Specifically, based on the actual application scenario requirements of the cross-subject data security sharing method, multiple evaluation criteria that affect the selection of blockchain architecture and consensus mechanism are determined, including node scale, security requirements, energy consumption, and on-chain data traceability capabilities; for candidate blockchain architecture types, such as consortium chain, private chain, and consensus mechanism type, a multi-dimensional evaluation index system is established, and the hierarchical analysis method is used to determine the weight distribution of each criterion; actual application scenario requirements refer to the specific requirements for functionality, security, performance, and compliance in the data sharing process in a specific business environment; By comparing historical data, we can quantitatively evaluate the combination of different options of blockchain architecture and consensus mechanism. Calculate the comprehensive score of each combination of blockchain architecture and consensus mechanism, expressed as, Here, i represents the specific blockchain architecture and consensus mechanism combination; i represents the different criteria used to evaluate the combination; represents the comprehensive score of the i-th combination; represents the weight of the jth evaluation criterion; represents the score value of the i-th combination under the j-th criterion; Based on the comprehensive score ranking results, the optimal blockchain architecture and consensus mechanism combination is selected to generate a blockchain configuration plan.

[0029] S1.2. Deploy multiple blockchain nodes in a local data center using automated deployment and configuration management methods to generate blockchain node deployment information; It should be noted that, based on the blockchain architecture type determined in the blockchain configuration plan, the node deployment environment, including network configuration parameters and storage paths, is selected; blockchain node installation, startup, and initialization operations are sequentially executed using scripted deployment tools, and inter-node communication rules and verification roles are configured based on consensus mechanism requirements; unique identification information is assigned to each node, and the IP address and port information of the physical server where the node is located are recorded; and the deployment parameters of all nodes are structured and organized to generate blockchain node deployment information. Consensus mechanism requirements refer to the specific rules and processes that must be followed in a blockchain network to ensure that multiple nodes reach consensus on the data state. These rules determine how nodes verify transactions, how they generate blocks, and how they propagate and confirm data within the network.

[0030] S1.3. Based on the blockchain configuration plan and blockchain node deployment information, deploy multiple core smart contracts on the blockchain network through the smart contract compilation and deployment method to generate a set of smart contract interface addresses; Furthermore, based on the consensus mechanism and blockchain architecture type determined in the blockchain configuration plan, select a smart contract development framework and programming language. For example, Solidity can be used to write permission verification logic and data sharing logic. The written smart contract source code is syntax-checked and optimized, and converted into bytecode files using smart contract compilation tools. Combined with the node communication address and port information recorded in the blockchain node deployment information, the bytecode file is sent to each blockchain node in turn, triggering the node to execute the smart contract deployment operation; after each smart contract is successfully deployed, the blockchain network returns the corresponding on-chain interface address information; the interface address information of all core smart contracts is summarized and organized to generate a smart contract interface address set.

[0031] S1.4. Participants register their identities in the blockchain network and obtain a set of identity identification information; Specifically, an asymmetric encryption key generation method is used to generate a public-private key pair for identity identification, and an identity registration request is constructed based on the identity identification rules defined in the blockchain configuration plan; the identity registration request is submitted to any node in the blockchain network, and the node broadcasts the request content to other nodes; after the blockchain network completes the legitimacy verification according to the consensus mechanism requirements, a unique decentralized identity identifier is assigned to the participating entity, and the identity identifier and the corresponding public key information are recorded in the blockchain ledger; the identity identification information of all participating entities is collected and sorted to obtain an identity identification information collection.

[0032] S1.5. Use the configuration information integration method to integrate the blockchain node deployment information, smart contract interface address set, and identity information set to generate an initialization information set; It should be noted that the IP address, port information, and node role configuration of each blockchain node in the blockchain node deployment information are structured and encoded to form node deployment data entries; the on-chain interface address information of each core smart contract recorded in the smart contract interface address set is classified and labeled according to functional categories, and a mapping relationship is established with the corresponding smart contract name; functional category refers to the classification based on the specific business functions or technical uses implemented by the smart contract in the blockchain network. For example, smart contracts used for permission verification, smart contracts used for data registration, and smart contracts used for secure computing scheduling belong to different functional categories respectively; The identity identifier of each participating entity in the identity identification information set is bound and encapsulated with the corresponding public key information; the three types of information are merged and processed using a unified data format standard to generate an initialization information set containing complete initial configuration parameters.

[0033] S1.6. Write the initialization information set into the blockchain ledger via the genesis block, forming a blockchain-based trust verification network; Furthermore, according to the initial block structure specifications defined in the blockchain configuration plan, a block header is constructed, containing a version number, timestamp, Merkle root, and difficulty target value. The defined initial block structure specifications refer to a set of predefined formats and rules that the genesis block must follow in a blockchain network. The block body contains the specific contents of the initialization information set, such as blockchain node deployment information, smart contract interface address sets, and identity information sets, after serialization. This ensures that the genesis block can be correctly parsed and verified by all participating nodes, providing a trusted starting point for the entire blockchain network.

[0034] The blockchain node deployment information, smart contract interface address set, and identity information set in the initialization information set are serialized and encoded, and embedded into the block body as the payload content of the genesis block; the hash value of the genesis block is calculated, and the initialization consensus process is executed by the first startup node in the network; the genesis block is recorded in the blockchain ledger, generating a blockchain-based trust verification network.

[0035] S2. Based on the initialization information set, the source data in the database is preprocessed to generate a data fingerprint, which is then entered into the smart contract together with the data description information to generate a secure data record set.

[0036] S2.1. Clean and desensitize the source data to generate pre-processed source data; Specifically, the data entries to be processed are obtained from the database, and missing values, outliers, and duplicate records are identified and corrected according to the field type, such as replacing null values ​​with preset default values ​​or adjusting values ​​that exceed the reasonable range to within the threshold range; Use data desensitization strategies to perform masking on sensitive fields. For example, partially hide the ID number to retain the first six and last four digits, replace the middle eight digits with asterisks, or reduce the precision of geographic coordinate information; output pre-processed source data with a complete structure that meets protection requirements.

[0037] S2.2. Use a hash algorithm to perform data fingerprinting on the pre-processed source data to generate a data fingerprint; It should be noted that each piece of pre-processed source data is read in sequence according to the unique identification field of the data record, and converted into a standardized string representation using a unified character encoding format; a secure hash algorithm is applied to perform a one-way calculation on the content of each piece of data to generate a fixed-length hexadecimal hash value as the data fingerprint of the data; The unique identifier of each piece of data and the corresponding data fingerprint are aggregated to form a structured data fingerprint. For example, after a piece of data is hashed, the output is a unique data fingerprint with a length of 256 bits, represented as a hexadecimal string.

[0038] S2.3. Use the JSON metadata binding method to associate and structurally encapsulate the metadata of each data value in the data fingerprint to generate a data description information set; Furthermore, a unique data identifier is assigned to each piece of data in the data fingerprint, and the corresponding data fingerprint value is extracted, and the data fingerprint value is associated with the meta-information field of each piece of data; the meta-information field includes the data creation time, data format type, decentralized identity identifier of the data owner, and data update timestamp; according to the predefined JSON structure template, the data identifier, data fingerprint value and associated meta-information field are combined into a key-value pair form, and a nested structure is used to hierarchically organize multi-field information; the predefined JSON structure template refers to a standardized data format rule set in advance during the data organization process, which is used to standardize how to combine data identifiers, data fingerprint values ​​and related meta-information fields into JSON format content in a structured manner to ensure that the generated data description information is consistent in syntax and semantics; Aggregate the structured content of all entries to generate a data description information set. For example, the metadata field of a piece of data is represented in the JSON structure as "data_format_type":"CSV".

[0039] S2.4. The metadata record and corresponding fingerprint value in the data description information set are transferred to the smart contract through smart contract interaction to form an on-chain transaction certificate; It should be noted that the on-chain interface address of the permission registration smart contract is selected from the smart contract interface address set, each metadata record in the data description information set is read in sequence, and the data registration metadata field is extracted; the fields are encapsulated into a complete function call parameter list according to the predefined parameter order. The predefined parameter order refers to the parameter arrangement rules set in advance before calling the smart contract function. It is used to clarify the order and format of the parameters required to be passed in each function call, ensuring that the fields in each data registration metadata field set are arranged in sequence according to a unified structure; The remote procedure call protocol is used to send a function call request to any node in the blockchain network, and the initiator's digital signature is attached to verify the legitimacy of the identity. After receiving the call request, the blockchain node verifies the transaction content according to the consensus mechanism requirements, including checking the validity of the initiator's signature and the compliance of the parameter format; after the verification is passed, the smart contract execution data registration logic is triggered, and the metadata record and data fingerprint value are written to the on-chain storage space; after the transaction is successful, the blockchain network returns an on-chain transaction certificate containing the transaction hash value, block number and execution status code.

[0040] S2.5. Use multi-source data fusion to integrate the fingerprint value, data description information set, and on-chain transaction credentials in the data fingerprint to generate a secure data record set; Specifically, the data identifier of each piece of data is used as the associated primary key, and the corresponding data fingerprint value in the data fingerprint, the metadata record encapsulated in the data description information set, and the transaction hash value and timestamp information in the on-chain transaction voucher are matched in sequence; the three types of information are spliced ​​according to a unified data organization structure, and serialized and encapsulated in a structured data format; an integrity check is performed on each integrated record to ensure that the content of each field complies with the preset data format specifications; all verified records are collected to generate a secure data record set.

[0041] S3. Use the autonomous access control method to set access permission rules for each record in the security data record set, deploy the access permission rules to the blockchain through the smart contract interface, and generate a data authorization rule library.

[0042] S3.1. Based on the data owner's DID and business needs, set access permission configuration for each piece of data in the security data record set and generate an access authorization set; Furthermore, the decentralized identity identifier of each data owner is obtained from the identity information set, and the identifier is associated with the corresponding data identifier in the security data record set based on the data ownership relationship; combined with the access control strategy in the actual business scenario, such as role-based access restrictions or time window-based authorization period, the subject type, operation type and validity period allowed to access each data are set; The set access control conditions are organized according to a predefined rule structure to generate access rights entries containing data identifiers, access control conditions, and a list of authorized subjects. A predefined rule structure refers to a standardized data organization format specified before access rights are configured, which is used to uniformly describe the composition and field arrangement of each access right entry. All access rights entries are aggregated to form an access authorization set. For example, the access rights entry set for data with the data identifier "DID-20250401-001" includes the subject type permitted access as "medical institution", the operation type as "read", and the validity period from "2025-04-01T00:00:00Z to 2026-04-01T00:00:00Z".

[0043] S3.2. Encapsulate each rule in the access authorization set according to the JSON structure to generate access permission rules; It should be noted that the data identifier in each access permission entry is used as an index to sequentially extract the corresponding fields of the subject type, operation type, and validity period of permitted access; the above contents are organized into key-value pairs according to the field names and hierarchical relationships specified in the predefined rule structure, and a nested structure is used to classify the multi-level information; the predefined rule structure refers to a standardized data organization form that is set in advance before the access permission entry is encapsulated in JSON format, and is used to uniformly specify the field names, data types, hierarchical relationships, and expressions that each access permission rule should contain; Verify the data format of each field to ensure compliance with JSON standards, such as unifying the time format to ISO 8601 notation; summarize all structured permission entries to generate access permission rules in a unified format.

[0044] S3.3. Deploy access rights rules one by one to the blockchain through smart contracts to complete on-chain confirmation and form an on-chain authorized operation record; Specifically, based on the on-chain interface address of the permission registration smart contract recorded in the smart contract interface address set, a function call instruction for permission writing is constructed; each rule entry in the access permission rule is read in sequence, and the data identifier, the subject type allowed to access, the operation type, and the validity period fields therein are encapsulated into a function call parameter list according to a predefined parameter order; the predefined parameter order refers to a set of parameter arrangement rules set in advance before the access permission rule is deployed through the smart contract, which is used to clarify the passing order and format requirements of each parameter in each function call; A transaction request is submitted to the blockchain network through the remote procedure call protocol. After receiving the transaction, the blockchain node verifies the transaction content and executes the smart contract logic according to the consensus mechanism, and writes the access permission rules into the on-chain storage space; after the transaction is successfully executed, an on-chain authorization operation record containing the transaction hash value and timestamp information is generated.

[0045] S3.4. Use structured data aggregation to integrate access permission rules and on-chain authorization operation records to generate a data authorization rule library. Furthermore, using the data identifier in each access permission rule as the associated primary key, the corresponding transaction hash value, timestamp, and execution status information are searched in the on-chain authorization operation record. The subject type, operation type, and validity period fields in the access permission rule are then concatenated with the transaction metadata in the on-chain authorization operation record to form a complete permission deployment evidence entry. Perform format verification and integrity verification on each integrated entry to ensure compliance with unified data expression standards; generate a data authorization rule library by collecting all verified entries.

[0046] S4. When the subject initiating the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request based on the permission rules in the data authorization rule library and obtains an access permission response containing an authorization token.

[0047] S4.1. Receive an access request submitted by a subject initiating the access request from the trust verification network; It should be noted that the entity initiating the access request constructs an access request containing the data identifier, the requested operation type, and its own decentralized identity identifier through the local client, and digitally signs the request content using a private key generated by an asymmetric encryption key generation method; the signed access request is sent to any blockchain node in the trust verification network via the remote procedure call protocol; the blockchain node that receives the request performs basic format verification on the request; after completing multi-node consistency verification within the network, the access request is submitted to the on-chain interface address of the permission verification smart contract, completing the formal receipt of the access request. For example, the data identifier contained in an access request is "DID-20250401-001", the requested operation type is "read", and the initiator's decentralized identity identifier is "DID-ORG-001".

[0048] S4.2. Use the field extraction method to extract the hash value from the access request, and search the data authorization rule library for the permission rule record corresponding to the hash value to generate a matching permission rule set; Specifically, the key fields in the access request are parsed according to the predefined request structure, including the data identifier, the request operation type, and the initiator's decentralized identity identifier; the corresponding data fingerprint value is searched in the data fingerprint based on the data identifier, and the data fingerprint value is used as the query keyword to perform a matching retrieval operation in the data authorization rule library; the predefined request structure refers to a standardized data format specification specified before the access request is submitted, which is used to clarify the field content, data type, and arrangement order that must be included in each access request, ensuring that all entities initiating access requests construct the request data in a unified manner; According to the search results, all permission rule records associated with the data fingerprint value are filtered out, and the permission rule records are sorted and integrated according to the permission priority to generate a matching permission rule set.

[0049] S4.3. Use the ternary verification method to compare the verification factors of the access request with the verification factors in the matching permission rule set one by one, and generate an access permission response including the authorization token; Furthermore, the initiator's decentralized identity identifier, requested operation type, and data fingerprint value are extracted from the access request and used as the first set of verification factors. The subject type, operation type, and validity period information of each permission rule record in the matching permission rule set are obtained and used as the second set of verification factors. The three groups of elements are compared in sequence, including: verifying whether the initiator's decentralized identity identifier belongs to the scope of the subject type allowed to access, whether the requested operation type matches the operation type in the permission rule, and whether the current time is within the validity period of the permission rule; after completing the verification of all three conditions, if they are all met, an access permission response containing an authorization token is generated.

[0050] S5. Perform multi-party secure computation based on the access permission response, record the computation results in the blockchain log, and share the data securely.

[0051] S5.1. Use the secure computation initiation method to perform authorization parsing on the access permission response and generate a multi-party secure computation intermediate result. It should be noted that, based on the data identifier, the corresponding fingerprint value in the security data record set and the metadata record in the data description information set are searched to generate the input parameter set for multi-party secure computation; the corresponding computation protocol configuration is loaded according to the definition of the operation type, such as selecting a secret sharing scheme or homomorphic encryption algorithm as the computation basis; the definition of the operation type refers to the specification of the execution rules and processing procedures pre-set at the technical implementation level for the operation behavior declared in the access request; A secure communication channel is established between the participants, and a multi-party secure computation process is initiated, generating an intermediate multi-party secure computation result containing the intermediate computation results and the identities of the participants. For example, if the homomorphic encryption algorithm used in a computation is the Paillier algorithm, the generated intermediate multi-party secure computation result will contain a portion of the computation output in an encrypted state and the decentralized identity identifier "DID-ORG-001" of the participant.

[0052] S5.2. Use the hash summary generation method to extract audit summary information from the intermediate results of the multi-party secure computation, combine it with the metadata in the access request, and submit it to the blockchain network in the form of an event log; Specifically, the computation output fragments, the decentralized identity identifiers of the participating parties, and the operation type fields in the intermediate results of the multi-party secure computation are structured and concatenated to generate a data string; a secure hash algorithm is used to perform a one-way hash operation on the string to generate a hexadecimal digest value of a fixed length; The summary value is associated with the metadata record in the access request, encapsulated as a log entry in the event log format, and submitted to any node in the blockchain network through the remote procedure call protocol.

[0053] S5.3. Based on the authorization information in the access permission response, the multi-party secure computation results are shared with the authorized party through encrypted distribution, thereby achieving secure data sharing. Furthermore, the validity and scope of this sharing are confirmed based on the authorization token; an asymmetric encryption key generation method is used to generate an encryption key pair for the multi-party secure computation result; the encrypted computation result is transmitted to the data receiving endpoint designated by the authorized party via a secure communication protocol, and a digital signature is attached during the transmission process; the authorized party uses the private key to complete the decryption operation, obtain the multi-party secure computation result, and complete the secure data sharing. For example, during a certain sharing process, the elliptic curve encryption algorithm ECDSA is used to encrypt the computation result. The resulting encrypted data packet can only be successfully decrypted by the authorized party "DID-ORG-001" who holds the corresponding private key.

[0054] This embodiment also provides a cross-subject data security sharing system based on multi-party secure computing, including: Building modules for deploying smart contracts and building a blockchain-based trust verification network based on the initialization information set; The preprocessing module is used to preprocess the source data in the database based on the initialization information set, generate data fingerprints, and enter them into the smart contract together with the data description information to generate a secure data record set; The deployment module is used to set access rights rules for each record in the security data record set using the autonomous access control method, deploy the access rights rules to the blockchain through smart contracts, and generate a data authorization rule library; Verification module: When the subject who initiates the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request according to the permission rules in the data authorization rule library and obtains the access permission response containing the authorization token; The data security sharing module performs multi-party secure computation based on access permission responses, records the computation results in the blockchain log, and securely shares the data.

[0055] This embodiment also provides a computer device, which is suitable for the cross-subject data security sharing method based on multi-party secure computing, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the cross-subject data security sharing method based on multi-party secure computing proposed in the above embodiment.

[0056] The computer device may be a terminal, comprising a processor, memory, a communication interface, a display, and an input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system and computer programs. The internal memory provides an environment for the operating system and computer programs stored in the non-volatile storage media. The communication interface of the computer device is used to communicate with external terminals via wired or wireless communication. Wireless communication may be achieved via Wi-Fi, a carrier network, NFC (near-field communication), or other technologies. The display of the computer device may be a liquid crystal display or an electronic ink display. The input device may be a touchscreen overlay on the display, buttons, a trackball, or a touchpad on the computer device housing, or an external keyboard, touchpad, or mouse.

[0057] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the cross-subject data secure sharing method based on multi-party secure computing proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0058] In summary, the present invention establishes a decentralized trust mechanism by constructing a blockchain-based trust verification network and deploying smart contracts, outputting an initialization information set, and ensuring security and reliability in a multi-party collaborative environment, thereby achieving the beneficial effect of enhancing resistance to single-point failure risks. By utilizing autonomous access control methods to set access permission rules for each record in a secure data record set, and deploying these permission rules to the blockchain through smart contracts, a data authorization rule library is generated, achieving dynamic permission configuration and on-chain traceability, making permission management more flexible and highly transparent, thereby improving compliance and audit capabilities in the cross-subject data sharing process.

[0059] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A cross-subject data security sharing method based on multi-party secure computing, characterized by: include, Deploy smart contracts and build a blockchain-based trust verification network based on the initialization information set; Based on the initialization information set, the source data in the database is preprocessed to generate a data fingerprint, which is then entered into the smart contract along with the data description information to generate a secure data record set. Use autonomous access control to set access rights rules for each record in the secure data record set, deploy the access rights rules to the blockchain through smart contracts, and generate a data authorization rule library; When the subject who initiates the access request submits an access request to the trust verification network, the smart contract verifies the legitimacy of the access request based on the permission rules in the data authorization rule library and obtains an access permission response containing an authorization token; Multi-party secure computation is performed based on the access permission response, and the computation results are recorded in the blockchain log and data is shared securely.

2. The cross-agent data secure sharing method based on multi-party secure computing according to claim 1, characterized in that: The specific steps of deploying the smart contract are as follows: Use multi-criteria decision analysis to select blockchain architecture and consensus mechanism and generate blockchain configuration solutions; Use automated deployment and configuration management methods to deploy multiple blockchain nodes in the local data center and generate blockchain node deployment information; Based on the blockchain configuration plan and blockchain node deployment information, multiple core smart contracts are deployed on the blockchain network through the smart contract compilation and deployment method to generate a set of smart contract interface addresses.

3. The cross-agent data secure sharing method based on multi-party secure computing according to claim 2, characterized in that: The specific steps of building a trust verification network based on blockchain according to the initialization information set are as follows: Participants register their identities in the blockchain network and obtain a set of identity identification information; Use the configuration information integration method to integrate blockchain node deployment information, smart contract interface address set and identity information set to generate an initialization information set; The initialization information set is written into the blockchain ledger through the genesis block to form a trust verification network based on the blockchain.

4. The cross-agent data secure sharing method based on multi-party secure computing according to claim 1, characterized in that: Based on the initialization information set, the source data in the database is preprocessed to generate data fingerprints, which are then entered into the smart contract together with the data description information to generate a secure data record set. The specific steps are as follows: Perform data cleaning and data desensitization on the source data, and use the hash algorithm to perform data fingerprint operation on the pre-processed source data to generate data fingerprint; Use JSON metadata binding method to associate metadata and structurally encapsulate the fingerprint value of each data in the data fingerprint to generate data description information; Through the interactive call of the smart contract, the metadata record and the corresponding fingerprint value in the data description information are passed into the smart contract to form the on-chain transaction certificate; The multi-source data fusion method is used to integrate the fingerprint value, data description information set and on-chain transaction certificate in the data fingerprint to generate a secure data record set.

5. The cross-agent data secure sharing method based on multi-party secure computing according to claim 1, characterized in that: The autonomous access control method is used to set access permission rules for each record in the security data record set. The specific steps are: According to the DID of the data owner and combined with business needs, set access permission configuration for each data in the security data record set and generate an access authorization set; Encapsulate each rule in the access authorization set according to the JSON structure to generate access permission rules.

6. The cross-agent data secure sharing method based on multi-party secure computing according to claim 5, characterized in that: The access permission rules are deployed to the blockchain through the smart contract interface to generate a data authorization rule library. The specific steps are: Deploy access rights rules one by one to the blockchain through smart contracts, forming an on-chain record of authorized operations; The structured data aggregation method is used to integrate access permission rules and on-chain authorization operation records to generate a data authorization rule library.

7. The cross-agent data secure sharing method based on multi-party secure computing according to claim 1, characterized in that: When the subject initiating the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request based on the permission rules in the data authorization rule library. The specific steps are as follows: receiving an access request submitted by a subject initiating the access request from the trust verification network; Use the field extraction method to extract the hash value from the access request, and search the data authorization rule library for the permission rule record corresponding to the hash value to generate a matching permission rule set.

8. The cross-agent data secure sharing method based on multi-party secure computing according to claim 7, characterized in that: The obtaining of the access permission response including the authorization token refers to comparing the verification elements of the access request with the verification elements in the matching authority rule set one by one by using the ternary verification method to generate the access permission response including the authorization token.

9. The cross-agent data secure sharing method based on multi-party secure computing according to claim 1, characterized in that: The multi-party secure computation is performed based on the access permission response, and the computation results are recorded in the blockchain log and data is securely shared. The specific steps are: Use the secure computation initiation method to perform authorization parsing on the access permission response and generate a multi-party secure computation intermediate result; Use hash summary generation to extract audit summary information from the intermediate results of multi-party secure computation, combine it with the metadata in the access request, and submit it to the blockchain network in the form of an event log; Based on the authorization information in the access permission response, the multi-party secure computation results are shared with the authorized party through encrypted distribution, forming secure data sharing.

10. A cross-agent data secure sharing system based on multi-party secure computing, based on the cross-agent data secure sharing method based on multi-party secure computing according to any one of claims 1 to 9, characterized in that: include, Building modules for deploying smart contracts and building a blockchain-based trust verification network based on the initialization information set; The preprocessing module is used to preprocess the source data in the database based on the initialization information set, generate data fingerprints, and enter them into the smart contract together with the data description information to generate a secure data record set; The deployment module is used to set access rights rules for each record in the security data record set using the autonomous access control method, deploy the access rights rules to the blockchain through smart contracts, and generate a data authorization rule library; Verification module: When the subject who initiates the access request submits the access request to the trust verification network, the smart contract verifies the legitimacy of the access request according to the permission rules in the data authorization rule library and obtains the access permission response containing the authorization token; The data security sharing module performs multi-party secure computation based on access permission responses, records the computation results in the blockchain log, and securely shares the data.

Images