Data encapsulation processing method and device, equipment, storage medium and program product
By introducing access control and polymorphic control engines, the behavior of data capsules is dynamically adjusted, solving the problem of insufficient dynamic adaptability in existing technologies and improving the flexibility and security of data encapsulation.
Patent Information
- Application Number
- CN202511055456.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-29
- Publication Date
- 2025-10-31
AI Technical Summary
Existing data encapsulation technologies lack dynamic adaptability and have low policy flexibility, making it difficult to meet the needs of dynamic security and flexible use in complex business scenarios.
By introducing an access control engine and a polymorphic control engine, the behavior of data capsules can be dynamically adjusted to achieve dynamic adaptability and policy flexibility in data encapsulation.
It improves the dynamic adaptability and policy flexibility of data encapsulation, meeting the needs of dynamic security and flexible use in complex business scenarios.
Smart Images
Figure CN120874084A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to a data encapsulation processing method, apparatus, device, storage medium, and program product. Background Technology
[0002] In the wave of digitalization, the value of data as a core production factor is becoming increasingly prominent, but the risks such as data breaches are also intensifying. A data capsule is a data container that encrypts and encapsulates data, along with access policies, encryption keys, and other information, ensuring data security and controllability.
[0003] A data capsule is a data container that encrypts and encapsulates data, along with access policies, encryption keys, and other information. It converts raw data into encrypted form for storage and transmission, and only data consumers who meet the access policies can decrypt and retrieve the data.
[0004] However, existing data encapsulation lacks dynamic adaptability and has low policy flexibility, making it difficult to meet the needs of dynamic security and flexible use in complex business scenarios. Summary of the Invention
[0005] This application provides a data encapsulation processing method, apparatus, device, storage medium, and program product to address the problems of insufficient dynamic adaptability, low policy flexibility, and difficulty in meeting the dynamic security and flexible use requirements of complex business processes in existing data encapsulation.
[0006] Firstly, this application provides a data encapsulation processing method, including:
[0007] In response to a data consumer's request to use the target data capsule, the data consumer is subjected to security authentication.
[0008] If the security authentication is successful, the access control engine of the target data capsule is invoked to determine the response status of the target data capsule;
[0009] The polymorphic control engine of the target data capsule is invoked to determine the state of the target data capsule;
[0010] Invoke the interface call engine of the target data capsule to open the interface of the target data capsule;
[0011] Based on the response status, the associated status, and the interface, the usage request is executed to generate a request result, which is then sent to the data consumer.
[0012] In one possible implementation, before performing security authentication on the data consumer in response to a usage request for the target data capsule sent by the data consumer, the method further includes: obtaining an encrypted data block to be encapsulated; adding an access control engine to the encrypted data block to be encapsulated; wherein the access control engine is used to determine the response status of the encrypted data block to be encapsulated; adding a polymorphic control engine to the encrypted data block to be encapsulated; wherein the polymorphic control engine is used to determine the status of the target data capsule corresponding to the encrypted data block to be encapsulated; adding an interface call engine to the encrypted data block to be encapsulated; wherein the interface call engine is used to determine the interface of the target data capsule; and performing data capsule encapsulation processing based on the encrypted data block to be encapsulated, the access control engine, the polymorphic control engine, and the interface call engine to obtain the target data capsule.
[0013] In one possible implementation, the use request includes a consumer request attribute for the encrypted data block to be encapsulated.
[0014] In one possible implementation, invoking the access control engine of the target data capsule to determine the response status of the target data capsule includes: invoking the access control engine of the target data capsule to obtain a preset access policy table; performing a query process in the preset access policy table according to the consumer request attributes to obtain the access policy corresponding to the encrypted data block to be encapsulated; and determining the response status of the target data capsule according to the access policy.
[0015] In one possible implementation, the access policy table includes a policy identifier and the corresponding visitor type, request type, policy conditions, and response status. The response status includes decryption fields, encrypted calculations, rejection, and multiple records in the audit.
[0016] In one possible implementation, the step of invoking the polymorphic control engine of the target data capsule to determine the state to which the target data capsule belongs includes: invoking the polymorphic control engine of the target data capsule to obtain a preset first correspondence table between response states and states to which the target data capsule belongs; and determining the state to which the target data capsule belongs based on the first correspondence table.
[0017] In one possible implementation, the step of invoking the interface invocation engine of the target data capsule to open the interface of the target data capsule includes: invoking the interface invocation engine of the target data capsule to obtain a preset second correspondence table between the state and interface information; determining the interface of the target data capsule based on the state and the second correspondence table; and opening the interface of the target data capsule.
[0018] In one possible implementation, obtaining the encrypted data block to be encapsulated includes: obtaining data to be processed; splitting the data to be processed into multiple data blocks to be processed; sending an encryption request to a key management center based on the data blocks to be processed, so that the key management center distributes subkeys for the data blocks to be processed according to the encryption request; receiving the subkeys sent by the key management center; and encrypting the data blocks to be processed according to the subkeys to obtain the encrypted data block to be encapsulated.
[0019] Secondly, this application provides a data encapsulation processing apparatus, comprising:
[0020] The authentication processing module is used to perform security authentication on the data consumer in response to the data consumer's request to use the target data capsule;
[0021] The first processing module is used to call the access control engine of the target data capsule if the security authentication is successful, so as to determine the response status of the target data capsule.
[0022] The second processing module is used to invoke the polymorphic control engine of the target data capsule to determine the state of the target data capsule;
[0023] The third processing module is used to call the interface call engine of the target data capsule to open the interface of the target data capsule;
[0024] The sending module is configured to execute the usage request based on the response status, the belonging status, and the interface, to generate a request result, and send the request result to the data consumer.
[0025] Thirdly, this application provides an electronic device, including: a memory and a processor;
[0026] The memory stores computer-executed instructions;
[0027] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.
[0028] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible embodiments of the first aspect.
[0029] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.
[0030] The data encapsulation processing method, apparatus, device, storage medium, and program product provided in this application determine the response status of the target data capsule by calling the access control engine of the target data capsule; determine the state of the target data capsule by calling the polymorphic control engine of the target data capsule; open the interface of the target data capsule by calling the interface call engine of the target data capsule; and execute the usage request through the interface to generate the request result, so that the target data capsule exhibits different behavior forms under different usage requests. This can improve the dynamic adaptability and policy flexibility of data encapsulation and meet the needs of dynamic security and flexible use in complex business. Attached Figure Description
[0031] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0032] Figure 1 A schematic diagram illustrating a data encapsulation processing method provided in an embodiment of this application;
[0033] Figure 2 A flowchart illustrating a data encapsulation processing method provided in one embodiment of this application;
[0034] Figure 3 A schematic diagram of the interaction flow of a data capsule encapsulation method provided in an embodiment of this application;
[0035] Figure 4 A schematic diagram of the interaction flow of a data capsule usage method provided in an embodiment of this application;
[0036] Figure 5 A schematic diagram of the data encapsulation processing apparatus provided in the embodiments of this application;
[0037] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.
[0038] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0039] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0040] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.
[0041] Currently, existing data security and privacy protection technologies, such as static data capsule encapsulation, trusted execution environment computing, and homomorphic encryption sharing models, are widely used in cross-domain data computing and protection scenarios. However, existing data encapsulation methods are mostly static structures with fixed authorization rules. Once a capsule is generated, its behavior (decryptable / computable / inaccessible) cannot be dynamically adjusted based on the calling scenario and access identity, lacking the polymorphic capability for policy responses. The insufficient dynamic adaptability and low policy flexibility of data encapsulation make it difficult to meet the dynamic security and flexible usage requirements of complex business scenarios.
[0042] The data encapsulation processing method provided in this application introduces an access control engine and a polymorphic control engine, enabling the target data capsule to exhibit different behaviors under different access conditions, thereby improving the flexibility of access strategies and meeting the needs of dynamic security and flexible use in complex business scenarios.
[0043] Figure 1 A schematic diagram of a scenario for the data encapsulation processing method provided in the embodiments of this application, such as... Figure 1 As shown, the specific application scenarios of this application include: data provider 101, key management center 102, and data consumer 103.
[0044] The data provider 101 can be a server. Optionally, it can be a single server or a cluster of multiple servers.
[0045] Among them, the data consumer 103 can be a mobile phone or a computer.
[0046] Specifically, data provider 101 sends an encryption request to key management center 102; key management center 102 sends a subkey to data provider 101 according to the encryption request; data provider 101 obtains the encrypted data block to be encapsulated according to the subkey; data provider 101 encapsulates the encrypted data block to be encapsulated to obtain the target data capsule; data consumer 103 sends a usage request for the target data capsule to data provider 101; data provider 101 processes the usage request to obtain the request result and sends the request result to data consumer 103.
[0047] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0048] Figure 2 This is a flowchart illustrating a data encapsulation processing method provided in one embodiment of this application. The execution entity of this embodiment can be... Figure 1 The data provider 101 shown can also be other computer devices, and this embodiment does not impose any particular limitations on this. Figure 2 As shown, the method includes:
[0049] S201: In response to a data consumer's request to use the target data capsule, perform security authentication on the data consumer.
[0050] The usage request includes the consumer request attributes and consumer identity credentials of the encrypted data block to be encapsulated.
[0051] Among them, the consumer's identity credentials include identity identifiers, digital signatures, Internet Protocol addresses, and requesting devices.
[0052] Among them, the consumer request attributes include at least one of the following: visitor type, request type, request time, and policy identifier.
[0053] Among them, the consumer's request attributes also include the consumer's historical behavior.
[0054] Specifically, the process involves parsing the consumer's identity credentials and request attributes in the usage request; verifying the identity of the data consumer based on the consumer's identity credentials; and validating the usage request based on the request attributes.
[0055] Specifically, if both identity verification and legitimacy verification are successful, then the security authentication is considered successful.
[0056] S202: If the security authentication is successful, the access control engine of the target data capsule is invoked to determine the response status of the target data capsule.
[0057] Optionally, S202 specifically includes S2021 to S2023:
[0058] S2021: Invoke the access control engine of the target data capsule to obtain the preset access policy table.
[0059] The access policy table includes a policy identifier and the corresponding visitor type, request type, policy conditions, and response status, as shown in Table 1.
[0060] The response status includes decrypted fields, encrypted calculations, rejection, and multiple records in the audit.
[0061] Table 1
[0062]
[0063] It should be noted that the contents of the access policy table can be set according to the actual situation, and this application does not impose any restrictions.
[0064] It should be noted that the access policy table can grant authorization at the field, behavior, and context-aware levels for data capsules. For example, the policy condition "limit fields, do not export the original text" can enable data consumers to access only a small number of fields.
[0065] S2022: Based on the consumer's request attributes, perform a query in the preset access policy table to obtain the access policy corresponding to the encrypted data block to be encapsulated.
[0066] Specifically, the consumer request attributes are parsed to obtain at least one of the following: policy identifier, visitor type, and request type; a query is performed in the preset access policy table based on at least one of the policy identifier, visitor type, and request type to obtain the corresponding access policy; the policy conditions of the access policy are obtained; if it is determined that the use request meets the policy conditions, the access policy is determined to be the access policy corresponding to the encrypted data block to be encapsulated.
[0067] Optionally, if a usage request is determined not to meet the policy conditions, the request can be automatically rejected, destroyed, or audited and recorded on the blockchain. This can improve the security, flexibility, and compliance of data during its circulation.
[0068] For example, if the access policy condition is "with an organization signature and the request time is a working day", then the consumer identity credentials and consumer request attributes of the use request are obtained, and it is determined whether there is an organization signature in the consumer identity credentials and whether the request time in the consumer request attributes is a working day.
[0069] S2023: Determine the response status of the target data capsule based on the access policy.
[0070] Specifically, the response status in the access policy is obtained, and the response status is determined to be the response status of the target data capsule.
[0071] By using the access control engine, access policies are determined based on the attributes of the consumer's request, thereby determining the response status that matches the attributes of the consumer's request, which improves the dynamic adaptability of data encapsulation and the flexibility of policies.
[0072] S203: Invoke the polymorphic control engine of the target data capsule to determine the state of the target data capsule.
[0073] Optionally, S203 specifically includes S2031 to S2032:
[0074] S2031: Invoke the polymorphic control engine of the target data capsule to obtain the first correspondence table between the preset response state and its corresponding state.
[0075] Among them, the state is used to determine a unique state identifier, and the response state is used to determine the state description.
[0076] The first correspondence table is shown in Table 2.
[0077] Table 2
[0078]
[0079] The status description in the first correspondence table also includes the visibility of some fields, and typical actions include restricted reading and automatic revocation.
[0080] It should be noted that the contents of the first correspondence table can be set according to the actual situation, and this application does not impose any restrictions.
[0081] It should be noted that the polymorphic control engine enables data capsules to exhibit different behaviors under different usage requests, ensuring privacy protection and flexible use of data during cross-domain and cross-organizational circulation.
[0082] S2032: Determine the state of the target data capsule based on the first correspondence table.
[0083] Specifically, the status description is determined based on the response status; based on the status description, a query is performed from the first correspondence table to obtain the status identifier number of the status and the corresponding typical action.
[0084] By determining the state of the target data capsule through a polymorphic control engine, the data capsule can enter different states under different usage requests, improving the dynamic adaptability of data encapsulation and meeting the needs of dynamic security and flexible use in complex business scenarios.
[0085] S204: Call the target data capsule's interface call engine to expose the target data capsule's interface.
[0086] Optionally, S204 specifically includes S2041 to S2043:
[0087] S2041: Call the interface call engine of the target data capsule to obtain the second correspondence table of preset status and interface information.
[0088] The interface information includes the interface name and its function.
[0089] The second correspondence table is shown in Table 3.
[0090] Table 3
[0091]
[0092] S2042: Determine the interface of the target data capsule based on its state and the second correspondence table.
[0093] Specifically, the state is determined based on the state identifier number; and a query is performed from the second correspondence table based on the state to determine the interface of the target data capsule.
[0094] S2043: Interface for Open Target Data Capsule.
[0095] The API call engine can open different interfaces of the target data capsule according to different usage requests, realize interface security isolation, improve the security of data in the circulation process, enhance the dynamic adaptability of data encapsulation, and meet the needs of dynamic security and flexible use in complex business.
[0096] S205: Based on the response status, the state to which it belongs, and the interface, execute the usage request to generate the request result and send the request result to the data consumer.
[0097] Specifically, the state of the target data capsule is switched according to the response status and the state to which it belongs; a usage request is executed through the interface to generate a request result, and the request result is sent to the data consumer.
[0098] The data encapsulation processing method provided in this application embodiment determines the response status of the target data capsule by calling the access control engine of the target data capsule; determines the state of the target data capsule by calling the polymorphic control engine of the target data capsule; opens the interface of the target data capsule by calling the interface call engine of the target data capsule; and executes the usage request through the interface to generate the request result, so that the target data capsule exhibits different behavior forms under different usage requests. This can improve the dynamic adaptability and policy flexibility of data encapsulation and meet the needs of dynamic security and flexible use in complex business.
[0099] In one embodiment of this application, based on the above embodiments, before step S201, a process for obtaining a target data capsule is further included, as detailed below:
[0100] S206: Obtain the encrypted data block to be encapsulated.
[0101] Specifically, S206 includes S2061 to S2065:
[0102] S2061: Obtain the data to be processed.
[0103] S2062: Split the data to be processed to obtain multiple data blocks to be processed.
[0104] Specifically, the security level of the data to be processed is obtained; the data to be processed is split according to the security level to obtain multiple data blocks to be processed.
[0105] S2063: Based on the data block to be processed, send an encryption request to the key management center so that the key management center can distribute a subkey for the data block to be processed according to the encryption request.
[0106] Specifically, iterate through all data blocks to be processed, and for each data block to be processed, perform the following operations: send an encryption request to the key management center so that the key management center can distribute a subkey for the data block to be processed according to the encryption request.
[0107] S2064: Receive the subkey sent by the key management center.
[0108] In this system, there is a one-to-one correspondence between the subkey and the data block to be processed.
[0109] S2065: Based on the subkey, encrypt the data block to be processed to obtain the encrypted data block to be encapsulated.
[0110] Specifically, a subkey is used according to the correspondence to encrypt the data block to be processed, so as to obtain the encrypted data block to be encapsulated.
[0111] S207: Add an access control engine to the encrypted data block to be encapsulated; wherein the access control engine is used to determine the response status of the encrypted data block to be encapsulated.
[0112] S208: Add a polymorphic control engine to the encrypted data block to be encapsulated; wherein, the polymorphic control engine is used to determine the state of the target data capsule corresponding to the encrypted data block to be encapsulated.
[0113] S209: Add an interface call engine to the encrypted data block to be encapsulated; wherein, the interface call engine is used to determine the interface of the target data capsule.
[0114] S210: Based on the encrypted data block to be encapsulated, the access control engine, the polymorphic control engine, and the interface call engine, perform data capsule encapsulation processing to obtain the target data capsule.
[0115] It should be noted that, in another embodiment of this application, when adding an access control engine, a polymorphic control engine, and an interface call engine to the encrypted data block to be encapsulated, these can be added separately according to different access strategies. Correspondingly, data capsule encapsulation processing can be performed based on the encrypted data block to be encapsulated and different access control engines, polymorphic control engines, and interface call engines according to different access strategies, resulting in target data capsules under different access strategies. When the data consumer sends a usage request, the corresponding access strategy is matched from the access strategy table according to the usage request, the target data capsule under the corresponding access strategy is obtained, the usage request is executed, and the request result is obtained.
[0116] The data encapsulation processing method provided in this application improves the dynamic adaptability and policy flexibility of data encapsulation by adding an access control engine, a polymorphic control engine, and an interface call engine to the encrypted data block to be encapsulated and performing data capsule encapsulation processing to obtain the target data capsule.
[0117] Figure 3 This is a schematic diagram of the interaction flow of a data capsule encapsulation method provided in an embodiment of this application. For example... Figure 3 As shown, the method includes:
[0118] S301: The data provider obtains the data to be processed.
[0119] S302: The data provider splits the data to be processed into multiple data blocks to be processed.
[0120] S303: The data provider sends an encryption request to the key management center based on the data block to be processed.
[0121] S304: The key management center distributes subkeys to the data blocks to be processed based on the encryption request.
[0122] S305: The key management center sends the subkey to the data provider.
[0123] S306: The data provider encrypts the data block to be processed according to the subkey to obtain the encrypted data block to be encapsulated.
[0124] S307: The data provider adds an access control engine to the encrypted data block to be encapsulated.
[0125] S308: The data provider adds a polymorphic control engine to the encrypted data block to be encapsulated.
[0126] S309: The data provider adds an interface call engine to the encrypted data block to be encapsulated.
[0127] S310: The data provider performs data capsule encapsulation processing based on the encrypted data block to be encapsulated, the access control engine, the polymorphic control engine, and the interface call engine to obtain the target data capsule.
[0128] The data capsule encapsulation method provided in this application improves the dynamic adaptability and strategic flexibility of data encapsulation.
[0129] Figure 4 This is a schematic diagram of the interaction flow of a data capsule usage method provided in an embodiment of this application. Figure 4 As shown, the method includes:
[0130] S401: The data consumer sends a usage request to the data provider.
[0131] S402: The data provider performs security authentication based on the usage request.
[0132] S403: If the data provider determines that the security authentication is successful, it calls the access control engine of the target data capsule to determine the response status of the target data capsule.
[0133] For example, if the request includes the visitor type "Company X" and the request type "Computation", then the response status is determined to be "Dense Computation".
[0134] S404: The data provider invokes the polymorphic control engine of the target data capsule to determine the state to which the target data capsule belongs and switches the state of the target data capsule to the state to which it belongs.
[0135] For example, if the response state is dense computation, the data provider will switch the target data capsule state to S2, i.e., dense computation state.
[0136] S405: The data provider calls the interface call engine of the target data capsule to expose the interface of the target data capsule.
[0137] For example, when the target data capsule is in state S2, the data provider opens the / compute interface of the target data capsule.
[0138] S406: The data provider executes the usage request through the interface to obtain the requested result.
[0139] For example, the data provider obtains the computational model requested by the request through the / compute interface, executes the computational model, and obtains the requested result.
[0140] S407: The data provider sends the request result to the data consumer.
[0141] The data capsule usage method provided in this application embodiment can realize the controllability, polymorphism, conditional release or response of data in a dense state, which can improve the dynamic adaptability and policy flexibility of data encapsulation and meet the needs of dynamic security and flexible use in complex business.
[0142] Figure 5 This is a schematic diagram of the data encapsulation processing apparatus provided in the embodiments of this application, as shown below. Figure 5 As shown, the data encapsulation processing device 50 provided in this embodiment includes: an authentication processing module 501, a first processing module 502, a second processing module 503, a third processing module 504, and a sending module 505.
[0143] The authentication processing module 501 is used to perform security authentication on the data consumer in response to the data consumer's request to use the target data capsule.
[0144] The first processing module 502 is used to call the access control engine of the target data capsule if the security authentication is successful, so as to determine the response status of the target data capsule.
[0145] The second processing module 503 is used to call the polymorphic control engine of the target data capsule to determine the state of the target data capsule;
[0146] The third processing module 504 is used to call the interface calling engine of the target data capsule to open the interface of the target data capsule;
[0147] The sending module 505 is used to execute the usage request according to the response status, the belonging status and the interface, to generate a request result and send the request result to the data consumer.
[0148] In one possible implementation, the data encapsulation processing device 50 further includes:
[0149] An acquisition module is used to acquire an encrypted data block to be encapsulated; add an access control engine to the encrypted data block to be encapsulated, wherein the access control engine is used to determine the response status of the encrypted data block to be encapsulated; add a polymorphic control engine to the encrypted data block to be encapsulated, wherein the polymorphic control engine is used to determine the status of the target data capsule corresponding to the encrypted data block to be encapsulated; add an interface call engine to the encrypted data block to be encapsulated, wherein the interface call engine is used to determine the interface of the target data capsule; and perform data capsule encapsulation processing based on the encrypted data block to be encapsulated, the access control engine, the polymorphic control engine, and the interface call engine to obtain the target data capsule.
[0150] In one possible implementation, the use request includes a consumer request attribute for the encrypted data block to be encapsulated.
[0151] In one possible implementation, the first processing module 502 is specifically configured to: invoke the access control engine of the target data capsule to obtain a preset access policy table; perform query processing in the preset access policy table according to the consumer request attributes to obtain the access policy corresponding to the encrypted data block to be encapsulated; and determine the response status of the target data capsule according to the access policy.
[0152] In one possible implementation, the access policy table includes a policy identifier and the corresponding visitor type, request type, policy conditions, and response status. The response status includes decryption fields, encrypted calculations, rejection, and multiple records in the audit.
[0153] In one possible implementation, the second processing module 503 is specifically used to: invoke the polymorphic control engine of the target data capsule to obtain a preset first correspondence table between response states and their respective states; and determine the state of the target data capsule based on the first correspondence table.
[0154] In one possible implementation, the third processing module 504 is specifically used to: invoke the interface invocation engine of the target data capsule to obtain a preset second correspondence table of belonging status and interface information; determine the interface of the target data capsule according to the belonging status and the second correspondence table; and open the interface of the target data capsule.
[0155] In one possible implementation, the acquisition module, when "acquiring the encrypted data block to be encapsulated", is specifically configured to: acquire the data to be processed; split the data to be processed to obtain multiple data blocks to be processed; send an encryption request to the key management center according to the data blocks to be processed, so that the key management center distributes a sub-key for the data blocks to be processed according to the encryption request; receive the sub-key sent by the key management center; and encrypt the data blocks to be processed according to the sub-key to obtain the encrypted data block to be encapsulated.
[0156] The data encapsulation processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.
[0157] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus 604.
[0158] In a specific implementation, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to perform the above-described method.
[0159] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.
[0160] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.
[0161] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.
[0162] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.
[0163] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.
[0164] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.
[0165] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.
[0166] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.
[0167] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.
[0168] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0169] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0170] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0171] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.
[0172] Finally, it should be noted that other embodiments of this application will readily conceive of by those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and alterations may be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A data encapsulation processing method, characterized in that, include: In response to a data consumer's request to use the target data capsule, the data consumer is subjected to security authentication. If the security authentication is successful, the access control engine of the target data capsule is invoked to determine the response status of the target data capsule; The polymorphic control engine of the target data capsule is invoked to determine the state of the target data capsule; Invoke the interface call engine of the target data capsule to open the interface of the target data capsule; Based on the response status, the associated status, and the interface, the usage request is executed to generate a request result, which is then sent to the data consumer.
2. The method according to claim 1, characterized in that, Before performing security authentication on the data consumer in response to a usage request for the target data capsule sent by the data consumer, the method further includes: Obtain the encrypted data block to be encapsulated; An access control engine is added to the encrypted data block to be encapsulated; wherein the access control engine is used to determine the response status of the encrypted data block to be encapsulated. A polymorphic control engine is added to the encrypted data block to be encapsulated; wherein, the polymorphic control engine is used to determine the state of the target data capsule corresponding to the encrypted data block to be encapsulated; An interface call engine is added to the encrypted data block to be encapsulated; wherein, the interface call engine is used to determine the interface of the target data capsule; Based on the encrypted data block to be encapsulated, the access control engine, the polymorphic control engine, and the interface call engine, a data capsule encapsulation process is performed to obtain the target data capsule.
3. The method according to claim 1 or 2, characterized in that, The usage request includes the consumer request attribute of the encrypted data block to be encapsulated.
4. The method according to claim 3, characterized in that, The step of invoking the access control engine of the target data capsule to determine the response status of the target data capsule includes: Invoke the access control engine of the target data capsule to obtain the preset access policy table; Based on the consumer request attributes, a query is performed in the preset access policy table to obtain the access policy corresponding to the encrypted data block to be encapsulated. The response status of the target data capsule is determined based on the access policy.
5. The method according to claim 4, characterized in that, The access policy table includes a policy identifier and the corresponding visitor type, request type, policy conditions, and response status. The response status includes decryption fields, encrypted calculation, rejection, and multiple records in the audit.
6. The method according to claim 3, characterized in that, The step of invoking the polymorphic control engine of the target data capsule to determine the state of the target data capsule includes: The polymorphic control engine of the target data capsule is invoked to obtain a preset first correspondence table between response states and their respective states; The state of the target data capsule is determined based on the first correspondence table.
7. The method according to claim 3, characterized in that, The interface invocation engine for calling the target data capsule, to open the interface of the target data capsule, includes: The interface call engine of the target data capsule is invoked to obtain a preset second correspondence table between the state and the interface information; The interface of the target data capsule is determined based on the state and the second correspondence table; Open the interface of the target data capsule.
8. The method according to claim 2, characterized in that, The process of obtaining the encrypted data block to be encapsulated includes: Obtain the data to be processed; The data to be processed is split into multiple data blocks to be processed. Based on the data block to be processed, an encryption request is sent to the key management center, so that the key management center can distribute a subkey for the data block to be processed according to the encryption request; Receive the subkey sent by the key management center; The data block to be processed is encrypted according to the subkey to obtain the encrypted data block to be encapsulated.
9. A data encapsulation processing apparatus, characterized in that, include: The authentication processing module is used to perform security authentication on the data consumer in response to the data consumer's request to use the target data capsule; The first processing module is used to call the access control engine of the target data capsule if the security authentication is successful, so as to determine the response status of the target data capsule. The second processing module is used to invoke the polymorphic control engine of the target data capsule to determine the state of the target data capsule; The third processing module is used to call the interface call engine of the target data capsule to open the interface of the target data capsule; The sending module is configured to execute the usage request based on the response status, the belonging status, and the interface, to generate a request result, and send the request result to the data consumer.
10. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-8.
11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.
12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.