Data request method, apparatus, system, device, medium, and product

Abstract

The present disclosure relates to the technical field of communication, and in particular, to a data request method, device, system, equipment, medium and product, comprising: a user end to which target data belongs sends a data use request, the user end generates a target credential, and sends the target credential to a data holder, a data user finds matched first data, and in the case that the target credential is verified, generates a target key, first key association information and second key association information, encrypts the first data based on the target key to obtain first encrypted data, returns the first encrypted data, the first key association information and the second key association information to the user end, the user end determines target encrypted data based on the first encrypted data and the first key association information, and sends the target encrypted data and the second key association information to the data user, and the data user determines the target data based on the target encrypted data and the second key association information.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and more specifically, to a data request method, apparatus, system, device, medium, and product. Background Technology

[0002] In the current data circulation scenario, data transactions typically rely on various data trading platforms as intermediaries. Data holders and data users conduct data transactions through these platforms, and the authorization of user data depends on the privacy agreements pushed to users by the data holders.

[0003] In related technologies, users typically manage user data indirectly through privacy agreements, lacking the ability to manage their own user data, resulting in insufficient security and privacy in the data request process. Summary of the Invention

[0004] This disclosure is made in view of the above-mentioned problems. This disclosure provides a data request method, apparatus, system, device, medium, and product.

[0005] According to one aspect of this disclosure, a data request method is provided, applied to an application server, comprising:

[0006] Send a data usage request to the client of the user who owns the target data;

[0007] Obtain the target encrypted data and the second key association information sent by the user terminal; wherein, the target encrypted data is determined based on the first encrypted data and the first key association information, the first encrypted data is obtained by the data holder encrypting the first data based on the target key, the first data is obtained by the data holder matching the identity identifier in the target credential in the local database, the target credential is generated by the user terminal, and the target key, the first key association information and the second key association information are generated by the data holder after the target credential is verified;

[0008] The second key association information is decrypted to determine the target key;

[0009] The target encrypted data is decrypted based on the target key, and the target data is obtained after decryption.

[0010] According to one aspect of this disclosure, a data request method is provided, applied to a user terminal, comprising:

[0011] Upon receiving a data usage request from a data user, a target credential is generated; wherein, the target credential includes the identity identifier of the user to whom the requested target data belongs;

[0012] Send the target credential to the data holder;

[0013] Obtain the first encrypted data, the first key association information, and the second key association information sent by the data holder; wherein, the first encrypted data is obtained by encrypting the first data in the local database of the data holder based on the target key, the first key association information, the second key association information, and the target key are obtained by the data holder after the target credential is verified, and the first data is all of the target data or part of the target data;

[0014] The target encrypted data is determined based on the first encrypted data and the first key association information, and the target encrypted data and the second key association information are sent to the data user so that the data user can determine the target data based on the target encrypted data and the second key association information.

[0015] According to one aspect of this disclosure, a data request method is provided, applied to a data holder, comprising:

[0016] Receive target credentials sent by the user terminal; the target credentials are identity identifiers of the user to whom the requested target data belongs, generated by the user terminal after receiving the data usage request;

[0017] First data is obtained by matching the identity identifier in the target credential in the local database; wherein, the first data is all of the target data or part of the target data;

[0018] If the target credential is successfully verified, a target key, first key association information, and second key association information are generated.

[0019] The first data is encrypted based on the target key to obtain the first encrypted data.

[0020] The first encrypted data, the first key association information, and the second key association information are sent to the user terminal so that the user terminal can determine the target encrypted data based on the first encrypted data and the first key association information. The user terminal then sends the second key association information to the data user so that the data user can determine the target data based on the target encrypted data and the second key.

[0021] According to another aspect of this disclosure, a data request system is provided, comprising: a data user, a user terminal, and a data holder;

[0022] The data user is used to send a data usage request to the user terminal of the user to which the target data belongs.

[0023] The user terminal is used to generate a target credential including the identity identifier of the user to whom the requested target data belongs, based on the data usage request, and send the target credential to the data holder.

[0024] The data holder is configured to obtain first data in a local database based on the identity identifier in the target credential; if the target credential is verified, generate a target key, first key association information, and second key association information; and encrypt the first data based on the target key to obtain first encrypted data; and return the first encrypted data, the first key association information, and the second key association information to the user terminal; wherein, the first data is all of the target data or part of the target data;

[0025] The user terminal is used to determine the target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user.

[0026] The data user is used to determine the target data based on the target encrypted data and the second key association information.

[0027] According to another aspect of this disclosure, a data user is provided, including:

[0028] The request sending unit is used to send a data usage request to the client of the user to which the target data belongs.

[0029] The first data acquisition unit is used to acquire target encrypted data and second key association information sent by the user terminal; wherein, the target encrypted data is determined based on first encrypted data and first key association information, the first encrypted data is obtained by the data holder encrypting first data based on the target key, the first data is obtained by the data holder matching the identity identifier in the target credential in the local database, the target credential is generated by the user terminal, and the target key, the first key association information and the second key association information are generated by the data holder after the target credential is verified.

[0030] A key decryption unit is used to decrypt the second key association information to determine the target key;

[0031] The data decryption unit is used to decrypt the target encrypted data based on the target key, and obtain the target data after decryption.

[0032] According to another aspect of this disclosure, a user terminal is provided, comprising:

[0033] The credential generation unit is used to generate a target credential after receiving a data usage request from a data user; wherein the target credential includes the identity identifier of the user to whom the requested target data belongs;

[0034] A credential sending unit is used to send the target credential to the data holder;

[0035] The second data acquisition unit is used to acquire the first encrypted data, the first key association information, and the second key association information sent by the data holder; wherein, the first encrypted data is obtained by encrypting the first data in the local database of the data holder based on the target key, the first key association information, the second key association information, and the target key are obtained by the data holder after the target credential is verified, and the first data is all of the target data or part of the target data;

[0036] A first data encryption unit is configured to determine target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user so that the data user can determine the target data based on the target encrypted data and the second key association information.

[0037] According to another aspect of this disclosure, a data holder is provided, including:

[0038] A credential receiving unit is used to receive a target credential sent by a user terminal; the target credential is an identity identifier of the user to whom the requested target data belongs, generated by the user terminal after receiving a data usage request.

[0039] A data matching unit is configured to obtain first data by matching the identity identifier in the target credential in a local database; wherein the first data is all of the target data or a portion of the target data;

[0040] A key generation unit is used to generate a target key, first key association information, and second key association information when the target credential is verified successfully.

[0041] The second data encryption unit is used to encrypt the first data based on the target key to obtain the first encrypted data;

[0042] The data return unit is configured to send the first encrypted data, the first key association information, and the second key association information to the user terminal, so that the user terminal can determine the target encrypted data based on the first encrypted data and the first key association information, and to send the second key association information to the data user, so that the data user can determine the target data based on the target encrypted data and the second key.

[0043] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is in operation, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps in the above-described data request method are performed.

[0044] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores a computer program, which, when executed by a processor, performs the steps of the data request method described above.

[0045] According to another aspect of this disclosure, a computer program product is provided, which is stored in a storage medium and executed by at least one processor to implement the steps in the data request method described above.

[0046] As will be described in detail below, according to embodiments of the present disclosure, a data request method, apparatus, system, device, medium, and product involves the following steps: A data user sends a data usage request to the user terminal of the user to whom the target data belongs. The user terminal generates a target credential including the identity identifier of the user based on the data usage request and sends the target credential to the data holder. The data user searches for first data matching the identity identifier in a local database. If the target credential is verified, a target key, first key association information, and second key association information are generated. The first data is then encrypted based on the target key to obtain first encrypted data. The first encrypted data, first key association information, and second key association information are returned to the user terminal. The user terminal determines the target encrypted data based on the first encrypted data and first key association information and sends the target encrypted data and second key association information to the data user. The data user determines the target data based on the target encrypted data and second key association information. Through the above processing method, the data user generates a target key for secure data transmission and shares this target key collaboratively among the data user, the user terminal, and the data holder. This provides the user with direct data management capabilities. Each data use requires confirmation from the user terminal, ensuring that data sharing is perceptible. The target key is used to achieve secure data flow among the three participants, avoiding unnecessary intermediate nodes, reducing the risk of data leakage, and thus effectively improving data security and privacy.

[0047] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0048] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0049] Figure 1 This is a flowchart illustrating a data request method according to an embodiment of the present disclosure.

[0050] Figure 2 This is a flowchart illustrating a second data request method according to an embodiment of the present disclosure.

[0051] Figure 3 This is a flowchart illustrating a third data request method according to an embodiment of the present disclosure.

[0052] Figure 4This is an overall flowchart illustrating a data request process according to an embodiment of the present disclosure.

[0053] Figure 5 This is an interactive diagram illustrating a data request process according to an embodiment of the present disclosure.

[0054] Figure 6 This is a block diagram illustrating a data user according to an embodiment of the present disclosure.

[0055] Figure 7 This is a block diagram illustrating a user terminal according to an embodiment of the present disclosure.

[0056] Figure 8 This is a block diagram illustrating a data holder according to an embodiment of the present disclosure.

[0057] Figure 9 This is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0058] Figure 10 This is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0060] To facilitate understanding of this embodiment, a data request method disclosed in this disclosure will first be described in detail. The execution subject of the data request method provided in this disclosure is generally an electronic device with a certain computing power, such as a terminal device, a server, or other processing device. In some possible implementations, the data request method can be implemented by a processor calling computer-readable instructions stored in memory.

[0061] See Figure 1 The diagram shows a flowchart of a data request method provided in this embodiment of the present disclosure. This data request method can be applied to data users. The method includes steps S101 to S104, wherein:

[0062] Step S101: Send a data usage request to the client of the user who owns the target data.

[0063] Here, target data refers to the user's privacy data. Since users lack the ability to manage their privacy data in the existing technology, this disclosure introduces user-side execution logic to improve users' ability to manage their privacy data.

[0064] In this way, whenever a data user needs to use a user's data, the data user sends a data usage request to the client of the user to whom the target data belongs. After receiving the data usage request, the target data that the data user needs to use must be confirmed by the user, realizing the user's direct management of the data and improving the autonomy and security of data management.

[0065] Step S102: Obtain the target encrypted data and the second key association information sent by the user terminal; wherein, the target encrypted data is determined based on the first encrypted data and the first key association information, the first encrypted data is obtained by the data holder encrypting the first data based on the target key, the first data is obtained by the data holder matching the identity identifier in the target credential in the local database, the target credential is generated by the user terminal, and the target key, the first key association information and the second key association information are generated by the data holder after the target credential is verified.

[0066] In this embodiment of the disclosure, after the data user sends a data usage request to the user terminal, the user terminal generates a target credential including the identity identifier of the user to whom the target data belongs, and sends the target credential to the data holder.

[0067] The data holder searches its local database for data that matches the identity identifier in the target credential, thus obtaining the first data. This first data may be all or part of the target data, as will be illustrated later.

[0068] The data holder verifies the target credential and, upon successful verification, generates a target key, first key association information, and second key association information. The target key is collaboratively generated by the data user, the client, and the data holder, enabling secure end-to-end data flow of the target data among these three parties. A novel three-party computation protocol facilitates the sharing of the target key, significantly enhancing the reliability of key sharing.

[0069] Based on this, the data holder uses the target key to encrypt the first data to obtain the first encrypted data. The data holder then sends the first encrypted data, the first key association information, and the second key association information to the user terminal.

[0070] The user terminal determines the target encrypted data based on the first encrypted data and the first key association information, and sends the target encrypted data and the second key association information to the data user. Here, the target encrypted data refers to the data encrypted with the target data.

[0071] Step S103: Decrypt the second key association information to determine the target key.

[0072] In this embodiment of the disclosure, after receiving the target encrypted data and the second key association information returned by the user terminal, the data user decrypts the second key association information to determine the target key.

[0073] Step S104: Decrypt the target encrypted data based on the target key to obtain the target data.

[0074] In this embodiment of the disclosure, the data user uses the target key to decrypt the target encrypted data to obtain the target data requested by the data usage request.

[0075] In the above implementation, the data user generates a target key for secure data transmission and shares this target key collaboratively among the data user, the user terminal, and the data holder. This provides the user with direct data management capabilities. Each data use requires confirmation from the user terminal, ensuring that data sharing is perceptible. The target key is used to achieve secure data flow among the three participants, avoiding unnecessary intermediate nodes, reducing the risk of data leakage, and thus effectively improving data security and privacy.

[0076] In an optional implementation, the above steps further include the following steps: obtaining the first public key of the user terminal and the second public key of the data holder; generating a third private key and a first random number; encrypting the first random number based on the first public key and the second public key to obtain first random number encryption information; generating first signature information for the data usage request based on the third private key; and sending the first random number encryption information and the first signature information to the user terminal of the user to which the target data belongs during the process of sending the data usage request, so that the user terminal generates the target credential based on the first random number encryption information and the first signature information.

[0077] Here, the user's first public key is Kp. pub The data holder's second public key is Kh pub The third private key of the data user is Ku. pri The first random number is a.

[0078] In this process, the data user will also pre-generate a third public key, Ku. pubThe first, second, and third public keys are stored on the blockchain along with their respective identifiers. This allows all three parties to access each other's public keys, facilitating subsequent processing of signature information and data flow. Specifically, the blockchain stores the mapping relationships between the first public key and the user's identity identifier, the second public key and the data holder's identity identifier, and the third public key and the data user's identity identifier.

[0079] The process of encrypting the first random number will be described exemplarily later.

[0080] Based on this, the data user uses a third private key to generate the first signature information sign(R,Ku). pri ), where R is the data usage request.

[0081] In this embodiment of the disclosure, when the data user sends a data usage request to the user terminal, it may also send a first random number encryption information and a first signature information to the user terminal so that the user terminal generates a target credential.

[0082] In the above embodiments, by generating a first random number to encrypt information, a stable data foundation is provided for the subsequent generation of target credentials by the user, and the process of generating target keys by the data holder is flexible. Furthermore, by generating signature information, the authenticity of the data user's operation can be ensured, thereby improving the security of the data flow process to a certain extent.

[0083] In an optional implementation, the above steps encrypt the first random number based on the first public key and the second public key to determine the first random number encryption information of the first random number, specifically including the following steps:

[0084] The first random number is encrypted using the first public key and the second public key to obtain first encrypted information; a set of prime numbers is generated and sent to the user terminal and the data holder, so that the user terminal and the data holder generate the target key based on the set of prime numbers respectively; a modulo operation is performed on the set of prime numbers and the first random number to obtain a first operation result; wherein, the set of prime numbers includes a first prime number and a second prime number greater than the first prime number; the first operation result is encrypted using the second public key to obtain second encrypted information; the first encrypted information and the second encrypted information are determined to be the encrypted information of the first random number.

[0085] Following on the above, the processing of the first random number encryption information will be described in an exemplary manner.

[0086] Data users can obtain the first and second public keys from the blockchain, first encrypting the first random number using the first public key, and then encrypting it a second time using the second public key to obtain the first encrypted information Enc(Enc(a,Kp). pub ),Kh pub ).

[0087] Here, the first prime number in the set of prime numbers is g, and the second prime number is p. The data user can generate this set of prime numbers before sending a data usage request to the user terminal. This disclosure does not specify the timing of the generation of the set of prime numbers.

[0088] In this embodiment of the disclosure, after generating a set of prime numbers, the data user sends the set of prime numbers to both the user terminal and the data holder. The user terminal generates a target key based on the first private key, the set of prime numbers, and the first key association information. The data holder generates the target key based on the pre-generated third random number, the first random number decryption information, and the set of prime numbers.

[0089] Based on this, a modulo operation is performed on the set of prime numbers and the first random number to obtain the first operation result, where the first operation result is s1 = g. a modp, and encrypt the result of the first operation using the second public key to obtain the second encrypted information as Enc(s1,Kh) pub ).

[0090] In the above implementation, the method of processing the first random number using the user's first public key, the data holder's second public key, and a set of prime numbers increases the difficulty for third parties to crack the data and effectively reduces the probability of data leakage.

[0091] In an optional implementation, the above steps for decrypting the second key association information to determine the target key specifically include the following steps:

[0092] Obtain third signature information; wherein the third signature information is generated based on the second private key and second signature information of the data holder, and the second signature information is generated based on the first private key and the first signature information of the user terminal; if the third signature information is verified, the second key association information is decrypted based on the third private key to obtain a second operation result; the second operation result is processed to obtain the target key.

[0093] In this embodiment of the disclosure, after the user sends the target encrypted data and the second key association information to the data user, the user sends the third signature information to the data user.

[0094] The first signature information is sign(R,Ku) priThe second signature information is sign(sign(R,Ku)). pri ),Kp pri The third signature information is sign(sign(sign(R,Ku)). pri ),Kp pri ),Kh pri )).

[0095] Here, the second key association information is Enc(s2,Ku) pub The data user uses the third private key to decrypt the information associated with the second key, and obtains the second operation result s2.

[0096] In this embodiment of the disclosure, the data user generates first signature information, the user terminal generates second signature information after verifying the first signature information, the data holder generates third signature information after verifying the second signature information, the data holder returns the third signature information to the user terminal, the user terminal returns the third signature information to the data user, and the data user decrypts the second key association information to determine the target key after verifying the third signature information.

[0097] In the above implementation, during each data request process, the data user, the client, and the data holder need to generate their respective signature information. This triple signature operation can ensure the authenticity of the actions performed by the data user, the client, and the data holder. This mechanism can prevent abuse and unauthorized access, and can trace the source in case of problems or disputes.

[0098] In an optional implementation, the above steps process the second calculation result to obtain the target key, specifically including the following steps:

[0099] Perform a calculation on the second operation result and the first random number to obtain a third operation result; perform a modulo operation on the third operation result and the second prime number to obtain the target key; wherein the second prime number is a prime number in the generated prime number set that is greater than the first prime number; and / or; calculate the product of the second operation result and the first operation result to obtain a product result; wherein the first operation result is obtained by performing a modulo operation on the prime number set and the first random number; perform a modulo operation on the product result and the second prime number to obtain the target key.

[0100] Here, the process by which the data user obtains the target key is described exemplarily.

[0101] Since the public and private keys generated by the three parties may be of different types, this disclosure provides an exemplary description of RSA keys and elliptic curve keys. The RSA key is a key using the RSA encryption algorithm (RSA algorithm).

[0102] If the public and private keys are RSA keys, then the target key is K. share =s2 a modp, where s2 is the result of the second operation, and s2 = g b mod p, s2 a The result of the third operation is p, where p is the second prime number.

[0103] If the public and private keys are elliptic curve keys, then the target key is K. share =s1s2mod p, where s1 is the result of the first operation.

[0104] In this embodiment of the disclosure, a method for generating the target key at the data user is provided for two types of keys, which facilitates the circulation of the target key among the three parties and improves the flexibility of the target key.

[0105] See Figure 2 The diagram shows a flowchart of a second data request method provided in this embodiment of the present disclosure. This data request method can be applied to a user terminal. The method includes steps S201 to S204, wherein:

[0106] Step S201: After receiving a data usage request from the data user, generate a target credential; wherein the target credential includes the identity identifier of the user to whom the requested target data belongs.

[0107] Step S202: Send the target credential to the data holder.

[0108] The data user sends a data usage request to the client of the user who owns the target data. The client generates a target credential carrying the user's identity based on the data usage request and sends the target credential to the data holder.

[0109] Step S203: Obtain the first encrypted data, the first key association information, and the second key association information sent by the data holder; wherein, the first encrypted data is obtained by encrypting the first data in the local database of the data holder based on the target key, the first key association information, the second key association information, and the target key are obtained by the data holder after the target credential is verified, and the first data is all of the target data or part of the target data.

[0110] In this embodiment of the disclosure, after receiving the target credential, the data holder first searches the local database for data that matches the identity identifier in the target credential to obtain the first data. Then, the data holder verifies the target credential and, if the verification is successful, generates a target key, first key association information, and second key association information. Next, the data holder uses the target key to encrypt the first data to obtain the first encrypted data. The data holder then sends the first encrypted data, the first key association information, and the second key association information to the user terminal.

[0111] Step S204: Determine target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user; so that the data user can determine the target data based on the target encrypted data and the second key association information.

[0112] In this embodiment of the disclosure, the user terminal determines the target encrypted data based on the first encrypted data and the first key association information, and sends the target encrypted data and the second key association information to the data user. After receiving the target encrypted data and the second key association information returned by the user terminal, the data user decrypts the second key association information to determine the target key. Then, the data user uses the target key to decrypt the target encrypted data to obtain the target data requested by the data usage request.

[0113] In the above implementation, the data user generates a target key for secure data transmission and shares this target key collaboratively among the data user, the user terminal, and the data holder. This provides the user with direct data management capabilities. Each data use requires confirmation from the user terminal, ensuring that data sharing is perceptible. The target key is used to achieve secure data flow among the three participants, avoiding unnecessary intermediate nodes, reducing the risk of data leakage, and thus effectively improving data security and privacy.

[0114] In an optional implementation, the above steps, after receiving a data usage request from the data user, specifically include the following steps:

[0115] The target data is fragmented based on a pre-generated first public key and a pre-generated second random number to obtain multiple first data and multiple second data; an index relationship is constructed between the identity identifier and the first data; the multiple second data are stored in a local database, and the multiple first data and the index relationship are sent to the data holder so that the data holder can search for the first data in the local database based on the index relationship.

[0116] Before receiving a data usage request from a data user, the client can pre-encode multiple stored user data sets and then segment the encoded user data into multiple first data segments and multiple second data segments. After learning the target data required by the data user, the client can locate the corresponding first data sets in the multiple first data segments and the corresponding second data sets in the multiple second data segments based on the target data's data identifier. The first data segments are variable-length data segments, the second data segments are fixed-length data segments, and the target data is the data from the multiple user data sets.

[0117] After receiving a data usage request from a data user, the client can also encode the target data to obtain the encoded target data D = Encode(Data), where Data is the target data; and then perform fragmentation on the encoded target data to obtain multiple first data and multiple second data.

[0118] The first data is Seg1 = Enc(D⊕r d ,Kp pub The second data is Seg2 = Enc(r) d ,Kp pub ), r d Kp is a pre-generated second random number. pub This is the pre-generated first public key. The ⊕ operation can be addition, subtraction, multiplication, XOR, etc., and you can choose according to your actual needs.

[0119] In addition, the first and second data obtained after fragmenting the target data can also be one. This disclosure does not require the timing of fragmentation or the number of fragments of the target data.

[0120] In this embodiment of the disclosure, after receiving a data usage request from a data user, the user terminal can perform fragmentation processing on the target data based on a first public key and a second random number to obtain multiple first data with variable data lengths and multiple second data with fixed data lengths. The user terminal stores the multiple second data in its local database and constructs an index relationship between the identity identifier and the first data. The user terminal then sends the multiple first data and the index relationship to the data holder, who can determine the first data in its local database based on the index relationship.

[0121] In the above implementation, the target data is split into two parts: one part is stored at the user's end, and the other part is stored at the data holder's end. This achieves hardware-level secure data management, which remains unchanged regardless of terminal replacement or application software upgrades, significantly improving the autonomy, security, and stability of data management. Furthermore, even if the data is accidentally cracked by a compromised key or subjected to brute-force attacks, the data will be incomplete, making it difficult to extract useful information. This effectively enhances the security of the target data and the data request process.

[0122] In an optional implementation, the above steps generate the target credential, specifically including the following steps:

[0123] The system receives first signature information and first random number encryption information sent by the data user; wherein the first signature information is generated by the data user based on a third private key, and the first random number encryption information is obtained by encrypting a first random number generated by the data user based on the user's first public key and the data holder's second public key; determines the identity identifier of the user; generates second signature information based on the pre-generated first private key and the first signature information; and processes the first random number encryption information, the identity identifier, and the second signature information to obtain the target credential.

[0124] Here, the first signature information is sign(R,Ku) pri The first random number encryption information is Enc(Enc(a,Kp)). pub ),Kh pub ) and Enc(s1,Kh pub The second signature information is sign(sign(R,Ku)). pri ),Kp pri ).

[0125] After receiving a data usage request from a data user, the client needs to determine whether to authorize the use of the target data. For data requiring authorization, the client generates an authorization credential based on the data user's unique identifier, the requested data type, and the data holder's unique identifier. Based on the authorization credential, the client then combines the first random number encryption information, the identity identifier of the user to whom the target data belongs, and the second signature information to generate a target credential.

[0126] Meanwhile, users can also upload the hash value of the authorized data content to the blockchain for the data holder to verify whether the subsequent data content has been tampered with. The information uploaded to the blockchain may also include the identity identifier of the user who owns the authorized data and the identity identifier of the data holder who holds the authorized data.

[0127] In this embodiment of the disclosure, when the data user sends a data usage request to the user terminal of the user to which the target data belongs, the data user sends a first random number encryption information and a first signature information to the user terminal. If the user terminal verifies the first signature information, it generates a second signature information using a first private key, and generates a target credential based on the first random number encryption information, the identity identifier of the user to which the data belongs, and the second signature information.

[0128] In the above implementation, the user terminal ensures the security of the target credential generation process through dual protection of key and signature information, and provides stable data support for the data holder to generate the target key based on the target credential, thereby improving the security of the target key in tripartite collaboration.

[0129] In an optional implementation, the above steps determine the target encrypted data based on the first encrypted data and the first key association information, specifically including the following steps:

[0130] Obtain the third signature information sent by the data holder; wherein the third signature information is generated based on the second private key and the second signature information of the data holder; if the third signature information is verified, decrypt the first key association information based on the first private key to obtain the first random number and the third random number; wherein the third random number is generated by the data holder; obtain the set of prime numbers sent by the data user, and perform operations on the first random number, the third random number, and the set of prime numbers to obtain the target key; decrypt the first encrypted data based on the target key to obtain the first data; encrypt the first data and the second data based on the target key to determine the target encrypted data.

[0131] Here, the first signature information is sign(R,Ku) pri The second signature information is sign(sign(R,Ku)). pri ),Kp pri The third signature information is sign(sign(sign(R,Ku)). pri ),Kp pri ),Kh pri )).

[0132] In this embodiment of the disclosure, the data user generates first signature information, and the user terminal generates second signature information after verifying the first signature information. The data holder generates third signature information after verifying the second signature information. The data holder returns the third signature information to the user terminal. After verifying the third signature information, the user terminal decrypts the first key association information based on the first private key to obtain a first random number and a third random number.

[0133] Here, the first key association information is f(Enc(a,Kp) pub ),Enc(b,Kp pub The first private key is Kp. pri After decrypting the first key association information, the first random number a and the third random number b are obtained.

[0134] As mentioned above, the result of the first operation is s1 = g a modp, the result of the second operation is s2 = g b mod p. In this regard, after the client receives the set of prime numbers sent by the data user, that is, the first prime number is g and the second prime number is p, it can perform operations on the first prime number, the first random number and the second prime number to obtain the first operation result, and then perform operations on the first prime number, the third random number and the second prime number to obtain the second operation result.

[0135] Therefore, if the public and private keys are RSA keys, then the target key is K. share =s2 a mod p; if the public and private keys are elliptic curve keys, then the target key is K. share =s1s2modp.

[0136] Here, the first encrypted data is Enc(Seg1,K) share The client uses the target key to decrypt the first encrypted data, obtaining the first data Seg1. Further, the client reads the second data Seg2 from the local database and, based on Seg1 = Enc(D⊕r... d ,Kp pub ) and Seg2 = Enc(r d ,Kp pub Using the first public key Kp pub Restore the target data Data, and encrypt the target data using the target key to obtain the encrypted target data Enc(Data,K). share ).

[0137] In this embodiment of the disclosure, after the data holder sends the first encrypted data and the first key association information to the user terminal, and the data user sends the set of prime numbers to the user terminal, the user terminal uses the first private key to decrypt the first key association information to obtain the first random number and the third random number. The user terminal then uses the first random number, the third random number, and the set of prime numbers to determine the target key, thereby achieving the sharing of the target key on the user side. Based on this, the user terminal uses the target key to determine the target encrypted data, which allows the data user to parse the target encrypted data and obtain the target data.

[0138] In the above implementation, the target key is reproduced and shared through mixed operations between random numbers and prime numbers. The three parties do not directly transmit the target key, but generate their own target keys. This effectively prevents attackers from directly obtaining the target key during data transmission. Thus, while ensuring the security of the target key, it also ensures that the target encrypted data determined by the target key is also secure, thereby improving the security and privacy of the target data.

[0139] In an optional implementation, after sending the target encrypted data and the second key association information to the data user, the above steps specifically include the following steps:

[0140] The third signature information is sent to the data user so that the data user can decrypt the second key association information based on the third signature information.

[0141] In this embodiment of the disclosure, the user terminal returns third signature information to the data user. If the third signature information is verified, the data user decrypts the second key association information to determine the target key.

[0142] See Figure 3 The diagram shows a flowchart of a third data request method provided in this embodiment of the present disclosure. This data request method can be applied to a data holder. The method includes steps S301 to S305, wherein:

[0143] Step S301: Receive the target credential sent by the user terminal; the target credential is the identity identifier of the user to whom the requested target data belongs, generated by the user terminal after receiving the data usage request.

[0144] In this embodiment of the disclosure, the data user sends a data usage request to the user terminal of the user to which the target data belongs. The user terminal generates a target credential based on the data usage request and sends the generated target credential to the data holder. The target credential includes the identity identifier of the user to which the data belongs.

[0145] Step S302: Obtain first data by matching the identity identifier in the target credential in the local database; wherein, the first data is all of the target data or part of the target data.

[0146] In this embodiment of the disclosure, after receiving the target credential, the data holder searches its local database for data that matches the identity identifier in the target credential to obtain the first data.

[0147] Step S303: If the target credential is verified, generate the target key, the first key association information, and the second key association information.

[0148] In this embodiment of the disclosure, the data holder verifies the target credential and, if the verification is successful, generates a target key, first key association information, and second key association information.

[0149] Step S304: Encrypt the first data based on the target key to obtain the first encrypted data.

[0150] In this embodiment of the disclosure, the data holder uses a target key to encrypt the first data to obtain the first encrypted data.

[0151] Step S305: Send the first encrypted data, the first key association information, and the second key association information to the user terminal, so that the user terminal determines the target encrypted data based on the first encrypted data and the first key association information, and send the second key association information to the data user, so that the data user determines the target data based on the target encrypted data and the second key.

[0152] In this embodiment, the data holder sends first encrypted data, first key association information, and second key association information to the user terminal. The user terminal determines the target encrypted data based on the first encrypted data and the first key association information, and sends the target encrypted data and the second key association information to the data user. After receiving the target encrypted data and the second key association information returned by the user terminal, the data user decrypts the second key association information to determine the target key. Then, the data user uses the target key to decrypt the target encrypted data to obtain the target data requested in the data usage request.

[0153] In the above implementation, the data user generates a target key for secure data transmission and shares this target key collaboratively among the data user, the user terminal, and the data holder. This provides the user with direct data management capabilities. Each data use requires confirmation from the user terminal, ensuring that data sharing is perceptible. The target key is used to achieve secure data flow among the three participants, avoiding unnecessary intermediate nodes, reducing the risk of data leakage, and thus effectively improving data security and privacy.

[0154] In an optional implementation, the above steps involve obtaining first data in a local database based on identity identifiers in the target credentials, specifically including the following steps:

[0155] Obtain the index relationship sent by the user terminal; wherein the index relationship is used to indicate the identity identifier of the user and the data corresponding to the identity identifier; determine the first data in the local database based on the index relationship.

[0156] In this embodiment of the disclosure, after receiving a data usage request from a data user, the user terminal can perform fragmentation processing on the target data based on a first public key and a second random number to obtain multiple first data and multiple second data. The user terminal stores the multiple second data in its local database and constructs an index relationship between the identity identifier and the first data. The user terminal then sends the multiple first data and the index relationship to the data holder. The data holder can first determine the identity identifier in the target credential and determine the first data in its local database based on the identity identifier and the index relationship.

[0157] In the above implementation, when the first data is part of the target data, a portion of the target data is stored at the user's end, and the other portion is stored at the data holder. If the data holder experiences a data leak, the data will be incomplete, thereby effectively improving the security of the target data.

[0158] In an optional implementation, the above steps, upon successful verification of the target credential, generate a target key, first key association information, and second key association information, specifically including the following steps:

[0159] If the second signature information in the target credential is verified, the first random number encryption information in the target credential is decrypted to obtain the first random number decryption information. The first random number encryption information is obtained by encrypting the first public key of the user terminal and the second public key of the data holder. The second signature information is generated based on the first private key of the user terminal and the first signature information. The first signature information is generated based on the third private key of the data user. The set of prime numbers sent by the data user is obtained. The set of prime numbers includes a first prime number and a second prime number greater than the first prime number. The target key is generated based on the pre-generated third random number, the first random number decryption information, and the set of prime numbers. The first key association information is generated based on the third random number and the first random number decryption information, and the second key association information is generated based on the third random number and the set of prime numbers.

[0160] Here, the user's first public key is Kp. pub The data holder's second public key is Kh pub The user's first private key is Kp pri The third private key of the data user is Ku. pri The first signature information is sign(R,Ku) pri The first random number encryption information is Enc(Enc(a,Kp)). pub ),Kh pub ) and Enc(s1,Kh pubThe second signature information is sign(sign(R,Ku)). pri ),Kp pri The first key association information is f(Enc(a,Kp)). pub ),Enc(b,Kp pub The second key association information is Enc(s2,Ku). pub ).

[0161] The processing procedures for the target key, the first key association information, and the second key association information will be described exemplarily later.

[0162] In this embodiment of the disclosure, if the data holder verifies the second signature information in the target credential, the data holder decrypts the first random number encrypted information based on the second private key to obtain Enc(a,Kp). pub The data holder generates a target key based on the set of prime numbers sent by the data user, the pre-generated third random number, and the first random number decryption information, and realizes the reproduction of the target key in the data holder. Then, the data holder generates a first key association information based on the third random number and the first random number decryption information, and generates a second key association information based on the third random number and the set of prime numbers.

[0163] In an optional implementation, the above steps generate the target key based on a pre-generated third random number, the decryption information of the first random number, and the set of prime numbers, specifically including the following steps:

[0164] The third random number and the first operation result are processed to obtain a fourth operation result; wherein, the first operation result is obtained by performing a modulo operation on the set of prime numbers and the first random number, and the first random number is generated by the data user; the fourth operation result and the second prime number are processed to obtain the target key; and / or; the third random number and the set of prime numbers are processed to obtain a second operation result;

[0165] Calculate the product of the first operation result and the second operation result to obtain the product result; perform a modulo operation on the product result and the second prime number to obtain the target key.

[0166] An exemplary description is provided here of how the data holder generates the target key.

[0167] If the public and private keys are RSA keys, then the target key is K. share =s1 b modp, where s1 is the result of the first operation, s1 b The result of the fourth operation is p, where p is the second prime number.

[0168] If the public and private keys are elliptic curve keys, then the target key is K. share =s1s2mod p, where s2 is the result of the second operation, and s2 = g b mod p.

[0169] In this embodiment of the disclosure, a method for generating the target key at the data holder is provided for two types of keys, which facilitates the circulation of the target key among the three parties and effectively improves the flexibility of the target key.

[0170] In an optional implementation, the above steps generate the first key association information based on the third random number and the first random number decryption information, specifically including the following steps:

[0171] Obtain the first public key of the user terminal; encrypt the third random number based on the first public key to obtain the third encrypted information; perform calculations on the third encrypted information and the first random number decryption information to obtain the first key association information.

[0172] Here, the first public key is Kp. pub The third random number is b, and the third encrypted information is Enc(b, Kp). pub As mentioned above, the decrypted information from the first random number is Enc(a,Kp). pub ) and s1, for which two methods of generating the first key association information are determined for the two types of keys.

[0173] Specifically, if the public and private keys are RSA keys, then the first key association information is generated as follows: f(Enc(a,Kp) pub ),Enc(b,Kp pub ))=Enc(a,Kp pub )*Enc(b,Kp pub ).

[0174] If the public and private keys are elliptic curve keys, then the first key association information is generated as f(Enc(a,Kp)). pub ),Enc(b,Kp pub ))=Enc(a,Kp pub )+Enc(b,Kp pub ).

[0175] In the above embodiments, the data holder generates first key association information by combining random numbers and keys, which makes it easier for the user to restore the target key based on the first key association information. Two methods for generating the first key association information are provided, thereby improving the flexibility of the first key association information and the target key.

[0176] In an optional implementation, the above steps generate the second key association information based on the third random number and the set of prime numbers, specifically including the following steps:

[0177] Obtain the third public key of the data user; perform operations on the third random number and the set of prime numbers to obtain a second operation result; encrypt the second operation result based on the third public key to obtain the second key association information.

[0178] Here, the third public key is Ku. pub The third random number is b, and the result of the second operation is s2 = g. b modp, the second key association information is Enc(s2,Ku) pub ).

[0179] In this embodiment of the disclosure, after the data holder receives the set of prime numbers sent by the data user, it performs a calculation on the set of prime numbers and the generated third random number to obtain a second calculation result. Then, it obtains a third public key from the blockchain and uses the third public key to encrypt the second calculation result to obtain second key association information, so that the data user can decrypt the second key association information and restore the target key.

[0180] In an optional implementation, after sending the first encrypted data, the first key association information, and the second key association information to the user terminal, the above steps specifically include the following steps:

[0181] If the second signature information is verified, a third signature information is generated based on the generated second private key and the second signature information; the third signature information is sent to the user terminal so that the user terminal can decrypt the first key association information based on the third signature information.

[0182] Here, the first signature information is sign(R,Ku) pri The second signature information is sign(sign(R,Ku)). pri ),Kp pri The third signature information is sign(sign(sign(R,Ku)). pri ),Kp pri ),Kh pri The second private key is Kh pri .

[0183] In this embodiment, the data user generates a first signature based on a third private key and sends the first signature to the user terminal. If the user terminal verifies the first signature, it generates a second signature based on the first private key and sends the second signature to the data holder. If the data holder verifies the second signature, it generates a third signature based on the second private key and returns the third signature to the user terminal. If the user terminal verifies the third signature, it decrypts the first key association information based on the first private key to obtain a first random number and a third random number.

[0184] In the above implementation, each data request process requires triple signatures from the data holder, the user, and the data user, ensuring that data sharing is perceptible and verifying the authenticity of the data holder, the user, and the data user, thus facilitating data tracking.

[0185] See Figure 4 The diagram shown is an overall flowchart of a data request process provided in an embodiment of this disclosure. The process mainly includes two parts: a data storage process and a data usage process. Specifically, the data storage process includes S401 to S405, and the data usage process includes S406 to S411, wherein:

[0186] S401: The data user, the client, and the data holder generate their respective key pairs.

[0187] S402: Establish a mapping relationship between the public key and the generator of the public key in the three key pairs.

[0188] S403: Upload the public keys and mapping relationships generated by the three parties to the blockchain.

[0189] S404: The user terminal performs fragmentation processing on the target data to obtain multiple first data and multiple second data.

[0190] S405: The user sends multiple first data to the data holder and stores multiple second data in the local database.

[0191] S406: The user terminal of the target user sends a data usage request to the user terminal of the target user.

[0192] S407: The user generates the target credential and sends it to the data holder.

[0193] S408: The data holder generates the target key after the target credential has been verified.

[0194] S409: The data holder encrypts the first data based on the target key to obtain the first encrypted data, and sends the first encrypted data to the user terminal.

[0195] S410: The user terminal determines the target encrypted data based on the first encrypted data and returns the target encrypted data to the data user.

[0196] S411: The data user decrypts the target encrypted data based on the target key, and obtains the target data after decryption.

[0197] In this embodiment, the blockchain serves as a trust infrastructure for managing and tracking the data ownership authorization process. The SIM card (Subscriber Identification Module) in the user terminal is bound to the user and has the functions of key generation and sharding. The private key can be stored inside the SIM card, while the public key is uploaded to the blockchain for verifying personal signatures and generating target keys. Sharding refers to encoding the data and then subtracting a fixed-length random number (16 bits) to obtain the processed data. This random number is stored as a second data shard in the user terminal's SIM card, while another copy is uploaded as a first data shard to the data holder.

[0198] See Figure 5 The diagram shown is an interaction diagram of a data request process provided in an embodiment of this disclosure. The specific process is described as follows:

[0199] S501: The user terminal of the target user sends a data usage request to the user terminal of the target user.

[0200] S502: After receiving a data usage request from the data user, the client generates the target credential.

[0201] S503: The user sends the target credential to the data holder.

[0202] S504: The data holder obtains the first data in the local database based on the identity identifier in the target credential.

[0203] S505: If the data holder verifies the target credential, the data holder generates the target key, the first key association information, and the second key association information.

[0204] S506: The data holder encrypts the first data based on the target key to obtain the first encrypted data.

[0205] S507: The data holder sends the first encrypted data, the first key association information, and the second key association information to the user terminal.

[0206] S508: The user terminal determines the target encrypted data based on the first encrypted data and the first key association information.

[0207] S509: The user sends the target encrypted data and the second key association information to the data user.

[0208] S510: The data user decrypts the second key association information to determine the target key.

[0209] S511: The data user decrypts the target encrypted data based on the target key, and obtains the target data after decryption.

[0210] As can be seen from the above description, the technical solution disclosed herein has the following advantages:

[0211] (1): The data is segmented, one segment is selected and encrypted and stored on the user end, and bound to the user's identity. This realizes the hardware-level security management of the data and greatly improves the autonomy, security and stability of data management.

[0212] (2): Data is transmitted unidirectionally between the data holder, the user, and the data user, avoiding unnecessary intermediate nodes and reducing the risk of data leakage. By establishing a three-party collaborative key sharing among the data user, the data holder, and the user, secure end-to-end data flow among these three participants is achieved.

[0213] (3): Each operation by the data holder, user, and data user requires verification using the public keys of the other participants from the blockchain, and the operation is recorded on the blockchain. This ensures that data sharing is perceptible. In addition, each data usage process requires triple signatures from the data holder, user, and data user to ensure the authenticity of the user, holder, and user. This mechanism can prevent abuse and unauthorized access.

[0214] Based on the same inventive concept, this disclosure also provides a data request system corresponding to the data request method, which includes: a data user, a user terminal, and a data holder.

[0215] The data user is configured to send a data usage request to the user terminal of the user to which the target data belongs; and to determine the target data based on the target encrypted data and the second key association information.

[0216] Here, the specific implementation methods of the data users are as described in the above embodiments, and will not be described in detail here.

[0217] The user terminal is configured to generate a target credential including the identity identifier of the user to whom the requested target data belongs based on the data usage request, and send the target credential to the data holder; and to determine the target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user.

[0218] The specific implementation method of the user terminal is as described in the above embodiments, and will not be described in detail here.

[0219] The data holder is configured to obtain first data by matching the identity identifier in the target credential in a local database; if the target credential is verified, generate a target key, first key association information and second key association information, and encrypt the first data based on the target key to obtain first encrypted data; and return the first encrypted data, the first key association information and the second key association information to the user terminal; wherein, the first data is all of the target data or part of the target data.

[0220] Here, the specific implementation method of the data holder is as described in the above embodiments, and will not be described in detail here.

[0221] Based on the same inventive concept, this disclosure also provides a data request device corresponding to the data request method. This data request device includes a data user, a user terminal, and a data holder. Since the principle by which the device solves the problem is similar to the data request method described above, the implementation of the device can be referred to the implementation of the method, and repeated details will not be elaborated further.

[0222] Reference Figure 6 The diagram shown is a schematic representation of a data user according to an embodiment of this disclosure. The data user includes: a request sending unit 60, a first data acquisition unit 61, a key decryption unit 62, and a data decryption unit 63; wherein:

[0223] The request sending unit is used to send a data usage request to the client of the user to which the target data belongs.

[0224] The first data acquisition unit is used to acquire target encrypted data and second key association information sent by the user terminal; wherein, the target encrypted data is determined based on first encrypted data and first key association information, the first encrypted data is obtained by the data holder encrypting first data based on the target key, the first data is obtained by the data holder matching the identity identifier in the target credential in the local database, the target credential is generated by the user terminal, and the target key, the first key association information and the second key association information are generated by the data holder after the target credential is verified.

[0225] A key decryption unit is used to decrypt the second key association information to determine the target key;

[0226] The data decryption unit is used to decrypt the target encrypted data based on the target key, and obtain the target data after decryption.

[0227] Reference Figure 7 The diagram shown is a schematic representation of a user terminal provided in an embodiment of this disclosure. The user terminal includes: a credential generation unit 70, a credential sending unit 71, a second data acquisition unit 72, and a first data encryption unit 73; wherein:

[0228] The credential generation unit is used to generate a target credential after receiving a data usage request from a data user; wherein the target credential includes the identity identifier of the user to whom the requested target data belongs;

[0229] A credential sending unit is used to send the target credential to the data holder;

[0230] The second data acquisition unit is used to acquire the first encrypted data, the first key association information, and the second key association information sent by the data holder; wherein, the first encrypted data is obtained by encrypting the first data in the local database of the data holder based on the target key, the first key association information, the second key association information, and the target key are obtained by the data holder after the target credential is verified, and the first data is all of the target data or part of the target data;

[0231] A first data encryption unit is configured to determine target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user so that the data user can determine the target data based on the target encrypted data and the second key association information.

[0232] Reference Figure 8The diagram shown illustrates a data holder according to an embodiment of this disclosure. The user terminal includes: a credential receiving unit 80, a data matching unit 81, a key generation unit 82, a second data encryption unit 83, and a data return unit 84; wherein:

[0233] A credential receiving unit is used to receive a target credential sent by a user terminal; the target credential is an identity identifier of the user to whom the requested target data belongs, generated by the user terminal after receiving a data usage request.

[0234] A data matching unit is configured to obtain first data by matching the identity identifier in the target credential in a local database; wherein the first data is all of the target data or a portion of the target data;

[0235] A key generation unit is used to generate a target key, first key association information, and second key association information when the target credential is verified successfully.

[0236] The second data encryption unit is used to encrypt the first data based on the target key to obtain the first encrypted data;

[0237] The data return unit is configured to send the first encrypted data, the first key association information, and the second key association information to the user terminal, so that the user terminal can determine the target encrypted data based on the first encrypted data and the first key association information, and to send the second key association information to the data user, so that the data user can determine the target data based on the target encrypted data and the second key.

[0238] Corresponding to Figure 1 , Figure 2 and Figure 3 In addition to the data request method in the present disclosure, this embodiment also provides an electronic device 90, such as... Figure 9 The diagram shown is a schematic representation of the structure of an electronic device 90 provided in an embodiment of this disclosure, including:

[0239] The device includes a processor 91, a memory 92, and a bus 93. The memory 92 stores execution instructions and includes a main memory 921 and an external memory 922. The main memory 921, also known as internal memory, is used to temporarily store the computational data in the processor 91 and the data exchanged with external memory 922 such as a hard disk. The processor 91 exchanges data with the external memory 922 through the main memory 921. When the electronic device 90 is running, the processor 91 and the memory 92 communicate through the bus 93, causing the processor 91 to execute the steps of the data request method described in the above method embodiments.

[0240] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the data request method described in the above method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0241] This disclosure also provides a computer program product 1000, such as... Figure 10 The diagram shown is a structural schematic of a computer program product 1000 provided in an embodiment of this disclosure. The computer program product 1000 carries a computer program 1001. The program included in the computer program 1001 can be used to execute the steps of the data request method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0242] The data request method, apparatus, system, device, medium, and product according to embodiments of this disclosure have been described above with reference to the accompanying drawings. First, the data user sends a data usage request to the user terminal of the user to whom the target data belongs. Then, the data user obtains the target encrypted data and second key association information sent by the user terminal. The target encrypted data is determined based on first encrypted data and first key association information. The first encrypted data is obtained by the data holder encrypting first data based on a target key. The first data is obtained by the data holder matching an identity identifier in a target credential in a local database. The target credential is generated by the user terminal. The target key, the first key association information, and the second key association information are generated by the data holder after verifying the target credential. Next, the data user decrypts the second key association information to determine the target key. Finally, the data user decrypts the target encrypted data based on the target key to obtain the target data. Through the above processing method, the data user generates a target key for secure data transmission and shares this target key collaboratively among the data user, the user terminal, and the data holder. This provides the user with direct data management capabilities. Each data use requires confirmation from the user terminal, ensuring that data sharing is perceptible. The target key is used to achieve secure data flow among the three participants, avoiding unnecessary intermediate nodes, reducing the risk of data leakage, and thus effectively improving data security and privacy.

[0243] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0244] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0245] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0246] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0247] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0248] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0249] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A data request method, characterized in that, Applied to data users, including: Send a data usage request to the client of the user who owns the target data; Obtain the target encrypted data and the second key association information sent by the user terminal; wherein, the target encrypted data is determined based on the first encrypted data and the first key association information, the first encrypted data is obtained by the data holder encrypting the first data based on the target key, the first data is obtained by the data holder matching the identity identifier in the target credential in the local database, the target credential is generated by the user terminal, and the target key, the first key association information and the second key association information are generated by the data holder after the target credential is verified; The first key association information is generated by the data holder based on the third random number and the first random number decryption information. The first random number decryption information is obtained by the data holder after decrypting the first random number encryption information in the target credential. The first random number encryption information is obtained by the data user after encrypting the first random number generated by the data user. The second key association information is generated by the data holder based on the third set of random numbers and prime numbers; The second key association information is decrypted to determine the target key; The target encrypted data is decrypted based on the target key, and the target data is obtained after decryption.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the first public key of the user terminal and the second public key of the data holder; Generate a third private key and a first random number; The first random number is encrypted using the first public key and the second public key to obtain the encrypted information of the first random number. Generate the first signature information for the data usage request based on the third private key; During the process of sending a data usage request to the user terminal of the user to which the target data belongs, the first random number encryption information and the first signature information are sent to the user terminal so that the user terminal generates the target credential based on the first random number encryption information and the first signature information.

3. The method according to claim 2, characterized in that, The step of encrypting the first random number based on the first public key and the second public key to determine the first random number encryption information includes: The first random number is encrypted using the first public key and the second public key to obtain the first encrypted information; Generate a set of prime numbers and send the set of prime numbers to the user terminal and the data holder, so that the user terminal and the data holder respectively generate the target key based on the set of prime numbers; A modulo operation is performed on the set of prime numbers and the first random number to obtain a first operation result; wherein, the set of prime numbers includes a first prime number and a second prime number greater than the first prime number; The first operation result is encrypted using the second public key to obtain the second encrypted information; The first encrypted information and the second encrypted information are determined to be the first random number encrypted information.

4. The method according to claim 2, characterized in that, The step of decrypting the second key association information to determine the target key includes: Obtain third signature information; wherein the third signature information is generated based on the second private key and second signature information of the data holder, and the second signature information is generated based on the first private key and the first signature information of the user terminal; If the third signature information is verified, the second key association information is decrypted based on the third private key to obtain the second operation result; The result of the second operation is processed to obtain the target key.

5. The method according to claim 4, characterized in that, The step of processing the second operation result to obtain the target key includes: The second calculation result and the first random number are used to perform calculations to obtain the third calculation result; The target key is obtained by performing a modulo operation on the third operation result and the second prime number; wherein, the second prime number is a prime number in the generated prime number set that is greater than the first prime number; or; Calculate the product of the second operation result and the first operation result to obtain the product result; wherein, the first operation result is obtained by performing a modulo operation on the set of prime numbers and the first random number; The target key is obtained by performing a modulo operation on the product result and the second prime number.

6. A data request method, characterized in that, Applied to the user end, including: Upon receiving a data usage request from a data user, a target credential is generated; wherein, the target credential includes the identity identifier of the user to whom the requested target data belongs; Send the target credential to the data holder; Obtain the first encrypted data, the first key association information, and the second key association information sent by the data holder; wherein, the first encrypted data is obtained by encrypting the first data in the local database of the data holder based on the target key, the first key association information, the second key association information, and the target key are obtained by the data holder after the target credential is verified, and the first data is all of the target data or part of the target data; The first key association information is generated by the data holder based on the third random number and the first random number decryption information. The first random number decryption information is obtained by the data holder after decrypting the first random number encryption information in the target credential. The first random number encryption information is obtained by the data user after encrypting the first random number generated by the data user. The second key association information is generated by the data holder based on the third set of random numbers and prime numbers; The target encrypted data is determined based on the first encrypted data and the first key association information, and the target encrypted data and the second key association information are sent to the data user so that the data user can determine the target data based on the target encrypted data and the second key association information.

7. The method according to claim 6, characterized in that, After receiving a data usage request from the data user, the method further includes: The target data is segmented based on a pre-generated first public key and a pre-generated second random number to obtain multiple first data and multiple second data. Construct an index relationship between the identity identifier and the first data; The plurality of second data are stored in a local database, and the plurality of first data and the index relationship are sent to the data holder so that the data holder can search for the first data in the local database based on the index relationship.

8. The method according to claim 6, characterized in that, The generation of the target credential includes: The system receives first signature information and first random number encryption information sent by the data user; wherein the first signature information is generated by the data user based on a third private key, and the first random number encryption information is obtained by the data user encrypting the first random number generated by the data user based on the first public key of the user terminal and the second public key of the data holder; Determine the identity identifier of the user to which the name belongs; Generate second signature information based on the pre-generated first private key and the first signature information; The first random number encryption information, the identity identifier, and the second signature information are processed to obtain the target credential.

9. The method according to claim 8, characterized in that, The step of determining the target encrypted data based on the first encrypted data and the first key association information includes: Obtain the third signature information sent by the data holder; wherein the third signature information is generated based on the data holder's second private key and the second signature information; If the third signature information is verified, the first key association information is decrypted based on the first private key to obtain the first random number and the third random number; wherein, the third random number is generated by the data holder. Obtain the set of prime numbers sent by the data user, and perform operations on the first random number, the third random number, and the set of prime numbers to obtain the target key; The first encrypted data is decrypted based on the target key to obtain the first data; The first data and the second data are encrypted based on the target key to determine the target encrypted data.

10. The method according to claim 9, characterized in that, After sending the target encrypted data and the second key association information to the data user, the method further includes: The third signature information is sent to the data user so that the data user can decrypt the second key association information based on the third signature information.

11. A data request method, characterized in that, Applied to data holders, including: Receive target credentials sent by the user terminal; the target credentials are identity identifiers of the user to whom the requested target data belongs, generated by the user terminal after receiving the data usage request; First data is obtained by matching the identity identifier in the target credential in the local database; wherein, the first data is all of the target data or part of the target data; If the target credential is verified, a target key, first key association information, and second key association information are generated; wherein, the first key association information is generated by the data holder based on a third random number and first random number decryption information, the first random number decryption information is obtained by the data holder after decrypting the first random number encryption information in the target credential, and the first random number encryption information is obtained by the data user after encrypting the first random number generated by the data user; The second key association information is generated by the data holder based on the third set of random numbers and prime numbers; The first data is encrypted based on the target key to obtain the first encrypted data. The first encrypted data, the first key association information, and the second key association information are sent to the user terminal so that the user terminal can determine the target encrypted data based on the first encrypted data and the first key association information. The user terminal then sends the second key association information to the data user so that the data user can determine the target data based on the target encrypted data and the second key.

12. The method according to claim 11, characterized in that, The step of obtaining the first data in the local database based on the identity identifier in the target credential includes: Obtain the index relationship sent by the user terminal; wherein the index relationship is used to indicate the identity identifier of the user and the data corresponding to the identity identifier; The first data is determined in the local database based on the index relationship.

13. The method according to claim 11, characterized in that, If the target credential is successfully verified, the generation of the target key, first key association information, and second key association information includes: If the second signature information in the target credential is verified, the first random number encryption information in the target credential is decrypted to obtain the first random number decryption information; the first random number encryption information is obtained by encryption based on the first public key of the user terminal and the second public key of the data holder, the second signature information is generated based on the first private key of the user terminal and the first signature information, and the first signature information is generated based on the third private key of the data user. Obtain the set of prime numbers sent by the data user; wherein the set of prime numbers includes a first prime number and a second prime number greater than the first prime number; The target key is generated based on a pre-generated third random number, the decryption information of the first random number, and the set of prime numbers. The first key association information is generated based on the third random number and the decryption information of the first random number, and the second key association information is generated based on the third random number and the set of prime numbers.

14. The method according to claim 13, characterized in that, The process of generating the target key based on a pre-generated third random number, the decryption information of the first random number, and the set of prime numbers includes: The third random number and the first operation result are processed to obtain a fourth operation result; wherein, the first operation result is obtained by performing a modulo operation on the set of prime numbers and the first random number, and the first random number is generated by the data user. The target key is obtained by performing a modulo operation on the result of the fourth operation and the second prime number; or; The second calculation result is obtained by performing operations on the third random number and the set of prime numbers. Calculate the product of the first operation result and the second operation result to obtain the product result; The target key is obtained by performing a modulo operation on the product result and the second prime number.

15. The method according to claim 13, characterized in that, The step of generating the first key association information based on the third random number and the first random number decryption information includes: Obtain the first public key of the user terminal; The third random number is encrypted using the first public key to obtain the third encrypted information; The first key association information is obtained by performing calculations on the third encrypted information and the first random number decryption information.

16. The method according to claim 13, characterized in that, The generation of the second key association information based on the third random number and the set of prime numbers includes: Obtain the third public key of the data user; The second calculation result is obtained by performing operations on the third random number and the set of prime numbers. The result of the second operation is encrypted using the third public key to obtain the second key association information.

17. The method according to claim 13, characterized in that, After sending the first encrypted data, the first key association information, and the second key association information to the user terminal, the method further includes: If the second signature information is verified, a third signature information is generated based on the generated second private key and the second signature information; The third signature information is sent to the user terminal so that the user terminal can decrypt the first key association information based on the third signature information.

18. A data request system, characterized in that, include: Data users, client terminals, and data holders; The data user is used to send a data usage request to the user terminal of the user to which the target data belongs. The user terminal is used to generate a target credential including the identity identifier of the user to whom the requested target data belongs, based on the data usage request, and send the target credential to the data holder. The data holder is used to obtain first data by matching the identity identifier in the target credential in the local database; if the target credential is verified, a target key, first key association information and second key association information are generated, and the first data is encrypted based on the target key to obtain first encrypted data; The first encrypted data, the first key association information, and the second key association information are returned to the user terminal; wherein, the first data is all of the target data or part of the target data; The first key association information is generated by the data holder based on the third random number and the first random number decryption information. The first random number decryption information is obtained by the data holder after decrypting the first random number encryption information in the target credential. The first random number encryption information is obtained by the data user after encrypting the first random number generated by the data user. The second key association information is generated by the data holder based on the third set of random numbers and prime numbers; The user terminal is used to determine the target encrypted data based on the first encrypted data and the first key association information, and send the target encrypted data and the second key association information to the data user. The data user is used to determine the target data based on the target encrypted data and the second key association information.

Images