Method, apparatus, device, medium and product for uniformly processing data requests

Abstract

According to embodiments of the present disclosure, a method, an apparatus, a device, a storage medium and a program product for unified processing of data are provided. In the method, a data request for target data is obtained, the data request is related to a data requirement scenario and at least includes a usage range of the target data. In response to the data request being verified, at least one data acquisition mode is determined from a plurality of data acquisition modes based on a data protection requirement related to the target data, different data acquisition modes in the plurality of data acquisition modes are configured to acquire business data with different data protection requirements. The target data is acquired according to the at least one data acquisition mode. Access to the target data is provided based on the usage range.

Description

Technical Field

[0001] The exemplary embodiments disclosed herein generally relate to the field of computers, and particularly to methods, apparatus, devices, computer-readable storage media, and computer program products for uniformly processing data requests. Background Technology

[0002] With the continued growth of the digital economy, data assets, as a crucial factor of production, have become an important component of the assets of enterprises and organizations. At the same time, there is increasing attention paid to the security and compliance of data assets, placing higher demands on their management. However, traditional data management technologies still need improvement in terms of management efficiency, cost, and capabilities. Summary of the Invention

[0003] In a first aspect of this disclosure, a method for uniformly processing data requests is provided. The method includes: acquiring a data request for target data, the data request being related to a data requirement scenario and at least including the scope of use of the target data; in response to the data request being verified, determining at least one data acquisition mode from a plurality of data acquisition modes based on data protection requirements related to the target data, different data acquisition modes among the plurality of data acquisition modes being configured to acquire business data with different data protection requirements; acquiring the target data according to the at least one data acquisition mode; and providing access to the target data based on the scope of use.

[0004] In a second aspect of this disclosure, an apparatus for uniformly processing data requests is provided. The apparatus includes: a first acquisition module configured to acquire a data request for target data, the data request being related to a data demand scenario and at least including the scope of use of the target data; a determination module configured to, in response to a data request being verified, determine at least one data acquisition mode from a plurality of data acquisition modes based on data protection requirements related to the target data, the different data acquisition modes being configured to acquire business data with different data protection requirements; a second acquisition module configured to acquire the target data according to the at least one data acquisition mode; and a providing module configured to provide access to the target data based on the scope of use.

[0005] In a third aspect of this disclosure, an electronic device is provided. The device includes at least one processing unit; and at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit. When executed by the at least one processing unit, the instructions cause the device to perform the method of the first aspect.

[0006] In a fourth aspect of this disclosure, a computer-readable storage medium is provided. This computer-readable storage medium stores a computer program that can be executed by a processor to implement the method of the first aspect. It should be understood that the content described in this content section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description.

[0007] In a fifth aspect of this disclosure, a computer program product is provided, comprising a computer program executable by a processor to implement the method of the first aspect. Attached Figure Description

[0008] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0009] Figure 1 A schematic diagram is shown of an example environment in which embodiments of the present disclosure may be implemented;

[0010] Figure 2 A schematic diagram of an example architecture for uniformly processing data requests according to some embodiments of the present disclosure is shown;

[0011] Figure 3A A schematic diagram of an example architecture for acquiring target data according to some embodiments of the present disclosure is shown;

[0012] Figures 3B-3F A schematic diagram of several data acquisition modes according to some embodiments of the present disclosure is shown;

[0013] Figure 4 A schematic diagram of an example architecture of a data center according to some embodiments of the present disclosure is shown;

[0014] Figure 5 A flowchart is shown as an example process for uniformly processing data requests according to some embodiments of the present disclosure;

[0015] Figure 6 A schematic structural block diagram of an example apparatus for uniformly processing data requests according to some embodiments of the present disclosure is shown; and

[0016] Figure 7 A block diagram of an electronic device capable of implementing several embodiments of the present disclosure is shown. Detailed Implementation

[0017] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0018] It should be noted that the headings of any section / subsection provided herein are not limiting. Various embodiments are described throughout this document, and embodiments of any type may be included under any section / subsection. Furthermore, embodiments described in any section / subsection may be combined in any way with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0019] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below. The terms "first", "second", etc., may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0020] The embodiments of this disclosure may involve user data, data acquisition, and / or use. All of these aspects comply with applicable laws, regulations, and relevant provisions. In the embodiments of this disclosure, all data collection, acquisition, processing, manipulation, forwarding, and use are conducted with the user's knowledge and confirmation. Accordingly, in implementing the embodiments of this disclosure, the type, scope of use, and usage scenarios of any data or information that may be involved should be communicated to the user and their authorization obtained in accordance with relevant laws and regulations through appropriate means. The specific methods of notification and / or authorization may vary depending on the actual situation and application scenario, and the scope of this disclosure is not limited in this respect.

[0021] In this specification and the embodiments, any processing of personal information will be carried out only under the premise of legality (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract), and will only be carried out within the scope stipulated or agreed upon. A user's refusal to process personal information other than that necessary for basic functions will not affect the user's use of basic functions.

[0022] As used in this paper, the term "model" refers to a model that learns the relationship between inputs and outputs from training data, enabling it to generate corresponding outputs for a given input after training. Model generation can be based on machine learning techniques. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs using multiple layers of processing units. A machine learning model is an example of a deep learning-based model. In this paper, "model" may also be referred to as a "machine learning model," "learning model," "machine learning network," or "learning network," and these terms are used interchangeably.

[0023] As mentioned above, with the continuous growth of the digital economy, data assets, as an important factor of production, have become a crucial component of the assets of enterprises and organizations. Managing data assets requires consideration throughout their entire lifecycle, from data collection and storage to application and destruction, presenting significant challenges. For various reasons, there is a demand for data assets. Typically, depending on factors such as the data demand scenario, data demanders may be scattered across different departments or teams within the same enterprise or organization. Similarly, data providers also vary, for example, having different data query channels, data storage media, and compliance requirements.

[0024] Currently, when using data assets, different data-demanding parties directly obtain and use the corresponding data assets from the relevant business operation platforms or databases. In the current solutions, the processes for acquiring and using data assets are relatively fragmented, resulting in low management efficiency and high management costs. Furthermore, this solution struggles to cover the entire lifecycle of data assets.

[0025] In view of this, embodiments of the present disclosure propose a scheme for unified processing of data requests. This solution can be implemented at a data management entity, such as a data management platform or a data center for data management. In this scheme, the unified data management entity determines at least one data acquisition pattern from multiple data acquisition patterns based on a verified data request to acquire target data. Subsequently, the data management entity provides access to the target data to the data requester based on the scope of use indicated by the data request.

[0026] In this way, the data manager acquires the target data and provides it to the data requester, thereby achieving unified data collection and distribution. This allows for the management and control of data assets throughout their entire lifecycle, thus improving data asset security.

[0027] Example Environment

[0028] Figure 1A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. For example... Figure 1 As shown, the example environment 100 may include a data management platform 110 and a terminal device 120.

[0029] Figure 1 A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. For example... Figure 1 As shown, example environment 100 may include a data management platform 110, which may be implemented by a data manager, for example. In this example environment 100, the data management platform 110 can be used to manage the use of data assets within an organization (e.g., an enterprise, government agency, other group, etc.). The data management platform 110 may be implemented as a transparency center or as part of a transparency center, for example.

[0030] For example, user 130's terminal device 120 may run a client of the data management platform 110, which can support interaction between the user and the data management platform 110 provided by the server. When the data management platform 110 runs locally on the user's terminal device, user 130 can directly interact with the local data management platform 110 using terminal device 120. When the data management platform 110 is on a server device, the server device can provide services to the client running on the terminal device based on the communication connection with terminal device 120.

[0031] In some embodiments, user 130 may initiate a data request to data management platform 110 to describe their data usage needs. In some embodiments, user 130 may initiate a data access request to data management platform 110 to access the data they wish to use.

[0032] The data management platform 110 can run on suitable electronic devices. These electronic devices can be any type of computing-capable device, including terminal devices or server devices. Terminal devices can be any type of mobile terminal, fixed terminal, or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio receivers, e-book devices, gaming devices, or any combination of the foregoing, including accessories and peripherals of these devices or any combination thereof. Server devices can include, for example, computing systems / servers, such as mainframes, edge computing nodes, computing devices in cloud environments, and so on. In some embodiments, the data management platform 110 can be implemented based on cloud services.

[0033] It should be understood that the structure and function of the various elements in environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure.

[0034] The following section provides a detailed description of various example implementations of this scheme, with reference to the accompanying drawings.

[0035] Example Architecture

[0036] Figure 2 A schematic diagram of an example architecture 200 for uniformly processing data requests according to some embodiments of the present disclosure is shown.

[0037] In some embodiments, the data management platform 110 may be associated with one or more business systems of an organization to maintain control over the use of data assets (e.g., operational data of the business) within the business systems. In some embodiments, the data management platform 110 may provide data corresponding to the data request 210 to the corresponding data requester based on the data request 210 provided by the user or other entity.

[0038] In some embodiments, the data management platform 110 obtains a data request for target data. The target data can be business data that the data requester initiating the data request 210 expects to obtain. The data request 210 is related to the data requirement scenario and at least includes the scope of use of the target data. In the data request 210, the target data can be specified at various suitable granularities. In some embodiments, the target data is specified at the field granularity. By refining the granularity of the target data specification, data usage can be controlled more precisely.

[0039] The scope of use can be defined from one or more dimensions. Examples of one or more dimensions may include data type, data usage scenario, permission dimension, or time dimension. Accordingly, in some embodiments, the scope of use of the target data may include at least one of the following: the type of target data, scenario information of the data requirement scenario, permission scope for accessing the target data, or time range of the target data.

[0040] In some embodiments, the type of target data can indicate the information corresponding to the target data. For example, the type of target data may include product identification information (e.g., product name or product number), product sales information, or product promotion information. In some embodiments, the type of target data (also referred to as data subject) may include multiple levels. For example, the first-level type indicates the business to which the target data belongs, such as e-commerce data type. The second-level type indicates a subtype of the first-level type, such as order data. The third-level type indicates a specific field within the subtype, such as order number.

[0041] The scenario information of the data request scenario indicates the scenario in which the data request was initiated. For example, the data request scenario could be a business research scenario or a fault diagnosis scenario. The scope of permissions to access the target data can refer to the range of personnel who can access the target data. Personnel within the scope of permissions may or may not include the data requester. For example, personnel within the scope of permissions may include the data requester, and may also additionally include other personnel besides the data requester. Alternatively, personnel within the scope of permissions may not include the data requester, but may include other personnel besides the data requester. The time range of the target data indicates the expected time for access to the target data or the duration of the target data's existence.

[0042] In some embodiments, data request 210 can be a request entered by a user. For example, if a user needs to view data related to case A, the user can directly enter "I need data related to case A to process request B" into the data management platform 110. In this case, "processing request B" is the data requirement scenario related to data request 210. In some embodiments, the data management platform 110 can obtain data request 210 through configurable options provided to the user. For example, the data management platform 110 can provide the user with configurable options for the type, scenario information, permission scope, and time range of the target data. Based on the user's interaction with multiple configurable options, a corresponding data request 210 is generated. For example, regarding the type of target data, if a data request creation instruction is detected (e.g., a trigger for the type of target data), the data management platform 110 can present the user with multiple candidate fields indicating different data types. If the user's selection of a target field from among the multiple candidate fields is received, a data request 210 is created based on the user's selected target field. For example, if the user selects the "product identifier" field, a data request 210 for data of the "product identifier" type is generated. In this way, the data management platform can determine the type of target data that the user expects to obtain based on the data request, thereby providing the user with data more accurately.

[0043] In some embodiments, data request 210 can be determined by data management platform 110 based on information obtained from user input or other processes. For example, if the preceding process is related to the processing of Case A, data management platform 110 can determine the corresponding data request 210 based on information related to the preceding process (e.g., the input or processing result of the preceding process). In some embodiments, data management platform 110 can utilize a language model (e.g., a large language model) to generate the corresponding data request 210 based on user input or the execution result of the preceding process. For example, user input or the execution result of the preceding process can be provided to the language model, and the scope of use of the target data can be determined based on the language model, thereby generating data request 210.

[0044] In some embodiments, to further enhance the security of data assets, the data management platform 110 can verify the received data requests. For example... Figure 2 As shown, during the data application approval stage, the data management platform 110 verifies the data request 210. If the data request 210 passes verification, the data management platform 110 obtains the target data from the data provider. Figure 2 In the example, the verification of data request 210 may include pre-approval 211 from the data requester and business approval 212 from the data provider. If data request 210 passes both pre-approval 211 and business approval 212, it indicates that both the data requester and the data provider approve the data request. If data request 210 fails verification, the data application process is terminated. The data management platform 110 may send the verification result to the risk control system to help the risk control system determine the security of the data assets. For example, pre-approval 211 may be conducted by relevant personnel of the data requester to assess the feasibility of data request 210. Business approval 212 may be conducted by relevant personnel of the data provider to determine whether data request 210 complies with the protocol requirements of the corresponding business system. In some embodiments, the data management platform 110 may verify the degree of matching between data request 210 and the data usage scenario to determine whether there is a risk of data leakage.

[0045] If data request 210 passes verification, the data acquisition phase begins. Data management platform 110 executes data acquisition 213. Based on data protection requirements related to the target data, data management platform 110 determines at least one data acquisition mode from multiple data acquisition modes. In some embodiments, data management platform 110 can acquire the target data from a corresponding data provider according to the determined at least one data acquisition mode. For example, the data provider may be a business system or the business system's data storage system, etc.

[0046] In some embodiments, the data management platform 110 can support acquiring requested data through multiple data acquisition modes. In some embodiments, different data acquisition modes among the multiple data acquisition modes are configured to acquire business data with different data protection requirements. As used herein, data protection requirements can refer to requirements for one or more elements of data protection, such as data security level, data privacy level, data activity level, data storage format, requirements of the business system to which the data belongs, etc. The data management platform 110 can determine one or more data acquisition modes from the multiple data acquisition modes based on the data protection requirements related to the target data. The target data is then acquired through these one or more data acquisition modes. The determined data acquisition modes are used to acquire at least a portion of the target data, such as data from a portion of fields or data from a portion of the subject.

[0047] The following is for reference. Figures 3A to 3F To describe several examples of data acquisition patterns. For example... Figure 3A As shown, the data acquisition modes may include task assignment-based acquisition mode 320, interface-based acquisition mode 322, agent-based acquisition mode 324, instruction set-based acquisition mode 326, or data table-based acquisition mode 328. The data management platform 110 can utilize one or more of these acquisition modes to acquire target data 310 from one or more business systems 330.

[0048] The data management platform 110 can determine one or more data acquisition modes corresponding to the data request 210 from multiple data acquisition modes based on the data protection requirements of the target data, thereby acquiring the target data. In some embodiments, the determination of the data acquisition mode can be performed at the field level. For example, the target data may include multiple fields, and the data management platform 110 can determine a suitable data acquisition mode for each of these fields. In some embodiments, the determination of the data acquisition mode can be performed at the subject level. For example, the target data may include data from multiple data subjects, and the data management platform 110 can determine a suitable data acquisition mode for each of these data subjects.

[0049] For example, if a field or data topic in the target data has a low security level or high data activity (e.g., target data such as customer service data or operational data), the data management platform 110 can retrieve the data for that field or data topic from the business system 330 using interface-based retrieval mode 322, proxy-based retrieval mode 324, or data table-based retrieval mode 328. In this way, the data management platform can retrieve data through simple operations or processes.

[0050] In some embodiments, for at least a portion of the target data (e.g., one or more fields, one or more data topics), the data management platform 110 can determine an interface-based acquisition pattern 322. Accordingly, the data management platform 110 can determine an interface, such as an application programming interface (API), for connecting to a business system related to that at least portion of the data, based on the business context associated with that portion. The data management platform 110 can then acquire at least a portion of the target data from the business system through the interface. Figure 3B A sample architecture diagram of interface-based acquisition mode 322 is shown. Figure 3B As shown, API 332 is connected to business system 335. Data management platform 110 can obtain at least a portion of target data 310, such as data from one or more fields, from business system 335 by calling API 332.

[0051] In some embodiments, for at least a portion of the target data (e.g., one or more fields, one or more data topics), the data management platform 110 may determine a proxy-based acquisition pattern 324. Figure 3C A sample architecture diagram of agent-based acquisition mode 324 is shown. Figure 3C As shown, the data management platform 110 can utilize the data agent 341 to acquire at least a portion of the target data 310. For example, the data management platform 110 determines a data agent that communicates with a first data storage system 340 for the business based on a business relating to at least a portion of the target data. The determined data agent is configured to acquire business data from the first data storage system 340 based on a data acquisition request. The first data storage system 340 is used to store business information for the business. In this disclosure, the data storage system for the business may, for example, be a data warehouse used to store business data. Subsequently, the data management platform 110 provides a data acquisition request to the data agent 341 based on the data request.

[0052] Data broker 341 retrieves the requested data from first data storage system 340 based on the received data retrieval request and sends a response to data management platform 110 in response to the data retrieval request. Correspondingly, data management platform 110 receives the response to the data retrieval request from data broker. This response may include the requested data, i.e., at least a portion of the target data. In this embodiment, data broker can act as an intermediary between the business system and the data management platform, providing unified encapsulation services for the business system's data. Through data broker, data security control of the business system's data can be achieved.

[0053] In some embodiments, for at least a portion of the target data (e.g., one or more fields, one or more data subjects), the data management platform 110 can determine a data table-based retrieval pattern 328. Accordingly, the data management platform 110 can... Figure 3D A schematic diagram of an example architecture based on a data table retrieval pattern is shown. Figure 3D As shown, the data management platform 110 identifies a business related to at least a portion of the target data, and based on this at least a portion, determines a business data table 351 with access permissions, such as a business base table, from the second storage system 352 of the business. Accordingly, the data management platform 110 can read at least a portion of the target user data from the determined business data table 351. The second data storage system 352 is used to store business information of the business and may include multiple business data tables of the business, such as multiple business base tables. For example, for a certain data topic in the target data, the data management platform 110 can determine the use of a data table-based retrieval pattern 328. Based on this data topic, the data management platform 110 can determine which business data table stores the data of that data topic. In this way, the data management platform 110 can read the data of that data topic from that business data table.

[0054] In this mode, the data management platform 110 can be pre-authorized by the business system or a part thereof (e.g., the second data storage system 352). Thus, upon receiving a data request, the data management platform 110 can read data from the authorized business data tables.

[0055] In some embodiments, for at least a portion of target data (e.g., one or more fields, one or more data topics), the data management platform 110 can determine a task-assignment-based acquisition pattern 320. For example, if the security level associated with the target data is high, the data management platform 110 can utilize the task-assignment-based acquisition pattern 320 to acquire at least a portion of the target data 310 from the business system 330. Exemplarily, the data management platform 110 can pre-determine the types of business data that the data provider can provide. The data management platform 110 can present the types of business data provided by the data provider to the user in the form of candidate fields. The user determines the target field from the candidate fields and creates a corresponding data request 210.

[0056] Figure 3E A schematic diagram of an example architecture for task assignment-based acquisition mode 320 is shown. Figure 3EAs shown, if the data management platform 110 receives a data request 210, it determines a data acquisition instruction 360 for acquiring at least a portion of the target data. The data acquisition instruction 360 may be a data acquisition notification message. The data acquisition instruction 360 may indicate the data to be acquired, the scope of use of the data, etc. Subsequently, the data management platform 110 provides the data acquisition instruction to the data provider, so that the data provider initiates a data acquisition task 361 corresponding to the data request 210. The data management platform 110 receives the execution result 362 of the data acquisition task from the data provider, and the execution result 362 includes at least a portion of the target data.

[0057] For example, after sending the data acquisition instruction 360, the data management platform 110 can present a data acquisition task interface on the terminal device of relevant personnel of the data provider. This interface displays information about the data acquisition task, such as the data to be acquired, the scope of data use, and the data provision entry point. Alternatively, a data template can be downloaded through this interface so that relevant personnel can fill in the data. This template may be generated by the data management platform 110 based on the data request or the data to be acquired, or it may be provided by the requesting party initiating the data request. Afterwards, relevant personnel can provide feedback on the acquired data to the data management platform 110 through the aforementioned interface or other interfaces. For example, relevant personnel can enter or upload data through the data provision entry point (e.g., uploading the filled-in template).

[0058] In some embodiments, the data management platform 110 may verify the business data included in the execution result 362 to determine whether the business data can satisfy the data request 210. If it can, the business data is used as the target data. If it cannot, the data acquisition task 361 is executed again to obtain the updated business data.

[0059] In some embodiments, for at least a portion of the target data (e.g., one or more fields, one or more data topics), the data management platform 110 can determine an instruction set-based acquisition pattern 322. For example, if the target data 210 has a high security level or the corresponding business has its own data protection policy, the data management platform 110 can utilize the instruction set-based acquisition pattern 326 to acquire at least a portion of the target data 310 from the business system 330. In these embodiments, the instruction set can be a collection of executable instructions deployed in the business system, such as a runnable script. Figure 3FA schematic diagram of an example architecture for instruction set-based acquisition mode 326 is shown. In some embodiments, a target instruction set deployed in a business system of a business is determined based on a business relating to at least a portion of the target data. For example, for a given data topic, the data management platform 110 can determine the business to which the data topic belongs, and thus determine the instruction set deployed in the business system of that business, such as a remote script deployed in that business system. The instruction set can be viewed as a data reading service remotely deployed in the business system.

[0060] Subsequently, the data management platform 110 provides the remote call parameters 381 to the business system 389 to invoke the corresponding target instruction set 382. After receiving the remote call parameters 381, the target instruction set 382 retrieves the business data corresponding to the data request 210 from the first data storage area 371 of the business system. The first data storage area 371 is used to store business data tables, such as business baseline tables. That is, the target instruction set 382 can read the required data from the business data table, such as data from one or more fields, or data from one or more data themes. Subsequently, the target instruction set 382 can store the obtained business data in the second data storage area 372 of the business system 389. The data management platform 110 can then retrieve the target data from the second data storage area 372. The second data storage area differs from the first data storage area. The data required by the data management platform 110 is stored separately from the data of the business system itself. This method facilitates data tracking by the business system and allows the business system to apply its own data protection strategies. This further enhances the controllability and traceability of data usage.

[0061] In some embodiments, at block 383, the target instruction set 382 can be configured to encrypt the obtained business data using a second key to improve data security. The second key is a key exclusive to the business system 389. This prevents data leakage in other business systems due to key leakage in one business system. In this embodiment, the business data in the second storage area 372 is encrypted. Accordingly, at block 384, the data management platform 110 can decrypt the obtained data using the second key. At block 385, the data management platform 110 can encrypt the decrypted data using a first key. The first key is held by the data management platform 110 and can be used to encrypt data obtained from different business systems. At block 386, the data management platform 110 can store the encrypted data within the platform itself for user access.

[0062] Data management platform 110 can acquire target data through various acquisition modes. Different data acquisition modes yield different data types and representations. To improve data uniformity and usability, in some embodiments, data management platform 110 can process (e.g., integrate) the target data acquired through different acquisition modes. In some embodiments, data management platform 110 acquires initial data from at least one data provider based on a data request. The initial data includes multiple data items of different data types. The multiple data items are grouped based on their corresponding data types to determine multiple sets of data. For example, e-commerce data is grouped as one set of data, and human resources data as another set. Subsequently, standardization processing (e.g., standardizing data formats, deleting duplicate and invalid data, etc.) is performed on each set of data to determine multiple sets of processed data as target data.

[0063] Continue to refer to Figure 2 During the data acquisition phase, after acquiring data from one or more business systems, the data management platform 110 can perform encrypted data storage 214. For example, the data management platform 110 can use the aforementioned first key to encrypt the acquired target data and store the encrypted data. That is, the data management platform 110 stores ciphertext data. In some embodiments, the first key can be dedicated to the unified processing of data requests; that is, the data management platform 110 can use the first key to encrypt the corresponding target data of multiple data requests. In some embodiments, the data management platform 110 can use different keys to encrypt the acquired target data. For example, the data management platform 110 can determine the encryption key based on the initiator of the data request or based on the type of target data.

[0064] During the data usage phase, the data management platform 110 can provide access to the target data to the accessing party based on the scope of use of the target data. Access to the target data includes data viewing and data downloading. In some embodiments, if a viewing request for the target data is received, the data management platform 110 can determine whether the requesting party has viewing permission for the target data based on the scope of permissions. If viewing permission is granted, the target data 210 is presented to the requesting party, as shown in box 215. In some embodiments, the target data 210 is encrypted and stored in the data management platform 110. In this case, in order to securely present the target data 210 at the requesting party's terminal device, a secure transmission strategy can be applied to the target data 210 during the transmission of the target data 210 from the data management platform 110 to the requesting party's terminal device. For example, the data management platform 110 can first decrypt the target data 210, and then establish a secure tunnel between the requesting party's terminal device and the data management platform 110 using a suitable transmission security protocol, and send the target data 210 to the requesting party's terminal device through the secure tunnel. Examples of such transport security protocols may include Hypertext Transfer Security Protocol (HTTPS) and Point-to-Point Tunneling Protocol (PPTP).

[0065] In some embodiments, if a download request for target data is received, the data management platform 110 can determine, based on the scope of permissions, whether the requester initiating the download request has the permission to download the target data. The download request indicates the downloadable data in the target data and the usage scenario of the downloadable data. If it is determined that the requester has the download permission for the target data and the usage scenario matches the data requirement scenario, the downloadable data is determined from the target data and provided to the requester, as shown in box 216. For example, the data requirement scenario for target data A is "as reference data for third party B to evaluate example C". If the usage scenario for the downloadable data is "provided to unit B", then it is determined that the usage scenario matches the data requirement scenario. Subsequently, the downloadable data is provided to the requester. In this way, the target data is ensured to be downloaded only under necessary conditions, thereby improving the security of the target data. In some embodiments, the downloadable data can be carried by a data object of a predetermined type (e.g., a document). This data object can be embedded with a watermark. The watermark may include, for example, information of the data management platform (e.g., platform identifier), information of the requester initiating the download request (e.g., account, time), etc.

[0066] In some embodiments, the target data provided by the data management platform 110 to the accessor is the minimum necessary data. That is, if the received data request 210 is for a subset a in dataset A, only the data related to subset a will be provided to the accessor.

[0067] In some embodiments, after providing the downloaded data to the requester, the data management platform 110 can utilize predetermined protection strategies or methods to prevent data leakage. For example, the data management platform 110 can enable a data leakage prevention (DLP) policy on the requester's device for the downloaded data. For instance, the DLP policy can be used to detect whether the data object sent externally by the requester contains the aforementioned watermark, and if the watermark is present, the external transmission of the data object can be intervened during the process or audited afterward. Alternatively, the data management platform 110 can prevent data leakage by restricting the requester's device, network, and access conditions.

[0068] In some embodiments, if a business person is included in the access scope, that business person can access the target data. In some embodiments, the access scope may include multiple business persons. Multiple business persons may have the same access rights or different access rights. For example, the access scope may include person A and person B. Person A can access target data of type C, and person B can access target data of type D. In some embodiments, if a business person is included in the access scope and is currently within the permitted access time range, that business person can access the corresponding target data. If not within the permitted time range, the business person is not allowed to access the target data 210.

[0069] like Figure 2 As shown, during the data destruction phase, the data management platform 110 can perform data destruction 218. As mentioned above, the scope of data use can include the permitted time range for data use. If the permitted time range for using the target data is reached or exceeded, the data management platform 110 can delete the encrypted target data. Timely data destruction is a crucial step for the secure and controllable use of data and can reduce data security risks.

[0070] Figure 4 A schematic diagram of an example architecture 400 of a data management platform 110 according to some embodiments of the present disclosure is shown. Figure 4 As shown, the data management platform 110 (e.g., a transparent center) can implement a data acquisition unit 420 and a data management unit 450. The data acquisition unit 420 establishes a database based on the business data table 410, service-related data 411, and data uploaded by users 412, to provide data query services for business personnel. In some embodiments, the data obtained by the data acquisition unit 420 is data that has undergone security verification.

[0071] In some embodiments, user 130 may send a login request to data management platform 110 through external system 460 mounted on terminal device 120. If external system 460 is a system that data management platform 110 authorizes to log in to, for example, if the network address of external system 460 is a preset network address (e.g., an internal network address), or if the identification information of external system 460 meets preset conditions, data management platform 110 authorizes the login request, so that user 130 can access data management platform 110 through external system 460.

[0072] Data management platform 110 can receive data requests 210 sent by user 130 to provide corresponding data services to user 130. In some embodiments, data management unit 450 can perform tasks such as acquiring corresponding target data, presenting or exporting target data, file proofreading, file transfer, and file encryption based on data requests 210 sent by user 130. For example, data management platform 110 prevents data leakage caused by traffic replay by encrypting the transmission of target data. In data storage tasks, data management platform 110 can store the acquired business data for data access parties to query or download. The business data stored by data management platform 110 can only be accessed within a limited time. If the target data storage time exceeds the usage time range, the target data is deleted. In some embodiments, data management platform 110 uses Key Management Service (KMS) to encrypt the acquired target data to further improve data security.

[0073] In some embodiments, the data management platform 110 can be used to investigate security alarms triggered by unreasonable distribution of exported files, conduct attack and defense drills, and eliminate redundant permissions, thereby further improving the security of the data management platform 110. In some embodiments, the data management platform 110 can collaborate with the data requester to explain and verify the use of business data.

[0074] In some embodiments, the behavior tracking unit 440 can record user actions within the data management platform 110 for later traceability and auditing. In some embodiments, the data management platform 110 can utilize the blockchain system 470 to record user behavior and data results generated during the data lifecycle. For example, the blockchain system 470 can generate identification information for the target data based on data requests, target data, and the processing procedure of the target data. For example, the processing procedure of the target data may include the data management platform 110 obtaining a data request for the target data, the data management platform 110 obtaining the target data using at least one data acquisition mode, the data management platform 110 storing the target data, the data management platform 110 providing access to the target data, and the data management platform 110 deleting the target data. The identification information can characterize the lifecycle of the target data. For example, the identification information may include the generation time of the target data, the provider of the target data, and the data acquisition mode used to obtain the target data. Subsequently, the data management platform 110 writes the identification information into the blockchain. For example, if user A views data C at time B, a hash value or other identification information is generated based on information related to that event. The generated identification information is then written into the blockchain for later review. This method enables data traceability and verification.

[0075] According to embodiments of this disclosure, a data management platform can establish a data lifecycle security process domain and a general security process domain, with data control as the core objective, throughout the data lifecycle. The data lifecycle security process domain includes data acquisition security, data transmission security, data storage security, data usage security, and data destruction security. The general security process domain includes endpoint DLP policies, endpoint data security, security operations, access control, organization and personnel management, privacy protection, and periodic auditing. In this way, data is controlled and distributed throughout the data lifecycle, improving data security.

[0076] Example process

[0077] Figure 5 A flowchart of an example process 500 for uniformly processing data requests according to some embodiments of the present disclosure is shown. Process 500 can be implemented at a data management platform 110. Reference is made below. Figure 1 Let's describe process 500. The following is just an example of how to describe process 500.

[0078] like Figure 5 As shown in box 510, the data management platform 110 obtains a data request for the target data. The data request is related to the data requirement scenario and at least includes the scope of use of the target data.

[0079] In some embodiments, obtaining a data request for target data includes: in response to receiving a data request creation instruction, presenting a plurality of candidate fields indicating different data types; and in response to receiving a selection of at least one target field among the plurality of candidate fields, creating a data request based on at least one target field.

[0080] In some embodiments, the scope of use includes at least one of the following: the type of target data, scenario information of the data requirement scenario, the scope of permissions to access the target data, or the time range for the use of the target data.

[0081] In box 520, the data management platform 110 determines at least one data acquisition mode from multiple data acquisition modes based on data protection requirements related to the target data. Different data acquisition modes among the multiple data acquisition modes are configured to acquire business data with different data protection requirements.

[0082] In box 530, the data management platform 110 acquires target data according to at least one data acquisition mode.

[0083] In some embodiments, obtaining target data according to at least one data acquisition mode includes: obtaining initial data according to at least one data acquisition mode, the initial data including multiple data items of different data types; grouping the multiple data items based on their respective data types to determine multiple sets of data; and performing standardization processing on each set of data in the multiple sets of data to obtain multiple sets of processed data as target data.

[0084] In some embodiments, at least one data acquisition mode includes an interface-based acquisition mode, and acquiring target data includes: determining an interface connected to a business system related to a business that is related to at least a portion of the target data; and acquiring at least a portion of the target data from the business system through the interface.

[0085] In some embodiments, at least one data acquisition mode includes a proxy-based acquisition mode, and acquiring target data includes: determining a data proxy that communicates with a first data storage system of the business based on the business related to at least a portion of the target data; providing a data acquisition request to the data proxy based on a data request, the data proxy being configured to acquire business data from the first data storage system based on the data acquisition request; and receiving a response from the data proxy to the data acquisition request, the response including at least a portion of the target data.

[0086] In some embodiments, at least one data acquisition mode includes an instruction set-based acquisition mode, and acquiring target data includes: determining a target instruction set deployed in a business system of the business based on a business related to at least a portion of the target data; invoking the target instruction set based on a data request, the target instruction set being configured to acquire data from a first data storage area of ​​the business system and encrypt and store the acquired data in a second data storage area of ​​the business system; and acquiring at least a portion of the target data from the second data storage area.

[0087] In some embodiments, obtaining at least a portion of the target data from the second data storage area includes: reading at least a portion of the encrypted target data from the second data storage area; and decrypting at least a portion of the encrypted target data based on a business-related second key to obtain at least a portion of the target data.

[0088] In some embodiments, at least one data acquisition mode includes a data table-based acquisition mode, and acquiring target data includes: determining a business related to at least a portion of the target data; determining a business data table with access permissions from a second storage system of the business based on at least a portion of the target data; and reading at least a portion of the target data from the determined business data table.

[0089] In some embodiments, at least one data acquisition mode includes a task assignment-based acquisition mode, and acquiring target data includes: determining a data acquisition instruction for acquiring at least a portion of the target data based on a data request; providing the data acquisition instruction to a data provider to initiate a data acquisition task corresponding to the data request at the data provider; and receiving the execution result of the data acquisition task from the data provider, the execution result including at least a portion of the target data.

[0090] In some embodiments, process 500 further includes: in response to determining that at least a portion of the target data does not satisfy a data request, generating an update request for at least a portion of the target data; and providing the update request to a data provider to obtain at least a portion of the updated target data.

[0091] In box 540, data management platform 110 provides access to target data based on the scope of use.

[0092] In some embodiments, the scope of use includes the permission scope to access the target data, and providing access to the target data includes: in response to receiving a viewing request for the target data, determining whether the requesting party initiating the viewing request has viewing permission for the target data based on the permission scope; and in response to determining that the requesting party has viewing permission for the target data, presenting the target data to the requesting party.

[0093] In some embodiments, the scope of use includes the permission scope to access the target data, and providing access to the target data includes: in response to receiving a download request for the target data, determining whether the requester initiating the download request has the permission to download the target data based on the permission scope, wherein the download request indicates the download data in the target data and the use scenario of the download data; in response to determining that the requester has the permission to download the target data and that the use scenario matches the data requirement scenario, determining the download data from the target data; and providing the download data to the requester.

[0094] In some embodiments, the scope of use includes indicating a time range for the use of target data, and the method further includes: deleting the stored target data in response to detecting that the storage time of the target data exceeds the time range for use.

[0095] In some embodiments, process 500 further includes encrypting target data using a first key dedicated to the unified processing of data requests; and storing the encrypted target data.

[0096] In some embodiments, process 500 further includes: generating identification information for the target data based on the data request, the target data, and the processing procedure of the target data, wherein the identification information characterizes the lifecycle of the target data; and writing the identification information into a blockchain.

[0097] Example devices and equipment

[0098] Embodiments of this disclosure also provide corresponding apparatus for implementing the above methods or processes. Figure 6 A schematic structural block diagram of an example apparatus 600 for unified processing of data requests according to certain embodiments of the present disclosure is shown. Apparatus 600 may be implemented as or included in a data management platform 110. The various modules / components in apparatus 600 may be implemented by hardware, software, firmware, or any combination thereof.

[0099] like Figure 6 As shown, the device 600 includes a first acquisition module 610, configured to acquire a data request for target data, the data request being related to a data requirement scenario and at least including the scope of use of the target data. The device 600 also includes a determination module 620, configured to determine at least one data acquisition mode from multiple data acquisition modes based on data protection requirements related to the target data, the different data acquisition modes being configured to acquire business data with different data protection requirements. The device 600 also includes a second acquisition module 630, configured to acquire the target data according to at least one data acquisition mode. The device 600 further includes a providing module 640, configured to provide access to the target data based on the scope of use.

[0100] In some embodiments, the first acquisition module 610 is further configured to, in response to receiving a data request creation instruction, present a plurality of candidate fields indicating different data types; and in response to receiving a selection of at least one target field among the plurality of candidate fields, create a data request based on at least one target field.

[0101] In some embodiments, the scope of use includes at least one of the following: the type of target data, scenario information of the data requirement scenario, the scope of permissions to access the target data, or the time range of the target data.

[0102] In some embodiments, the second acquisition module 630 is further configured to acquire initial data according to at least one data acquisition mode, the initial data including multiple data items of different data types; group the multiple data items based on their respective data types to determine multiple sets of data; and perform standardization processing on each set of data to obtain multiple sets of processed data as target data.

[0103] In some embodiments, at least one data acquisition mode includes an interface-based acquisition mode, and the second acquisition module 630 is further configured to determine an interface connected to a business system of a business related to at least a portion of the target data; and to acquire at least a portion of the target data from the business system through the interface.

[0104] In some embodiments, at least one data acquisition mode includes a proxy-based acquisition mode, and the second acquisition module 630 is further configured to: determine a data proxy communicating with a first data storage system of a service based on a service related to at least a portion of the target data; provide a data acquisition request to the data proxy based on a data request, the data proxy being configured to acquire service data from the first data storage system based on the data acquisition request; and receive a response from the data proxy to the data acquisition request, the response including at least a portion of the target data.

[0105] In some embodiments, at least one data acquisition mode includes an instruction set-based acquisition mode, and the second acquisition module 630 is further configured to determine a target instruction set deployed in a business system of a business based on a business related to at least a portion of the target data; invoke the target instruction set based on a data request, the target instruction set being configured to acquire data from a first data storage area of ​​the business system and encrypt and store the acquired data in a second data storage area of ​​the business system; and acquire at least a portion of the target data from the second data storage area.

[0106] In some embodiments, the second acquisition module 630 is further configured to read at least a portion of the encrypted target data from the second data storage area; and to decrypt at least a portion of the encrypted target data based on a business-related second key to obtain at least a portion of the target data.

[0107] In some embodiments, at least one data acquisition mode includes a data table-based acquisition mode, and the second acquisition module 630 is further configured to determine a service related to at least a portion of the target data; determine a service data table with access rights from a second storage system of the service based on at least a portion of the target data; and read at least a portion of the target data from the determined service data table.

[0108] In some embodiments, at least one data acquisition mode includes a task assignment-based acquisition mode, and the second acquisition module 630 is further configured to, based on a data request, determine a data acquisition instruction for acquiring at least a portion of the target data; provide the data acquisition instruction to a data provider to initiate a data acquisition task corresponding to the data request at the data provider; and receive the execution result of the data acquisition task from the data provider, the execution result including at least a portion of the target data.

[0109] In some embodiments, the apparatus 600 further includes an update module configured to generate an update request for at least a portion of the target data in response to determining that at least a portion of the target data does not satisfy a data request; and to provide the update request to a data provider to obtain at least a portion of the updated target data.

[0110] In some embodiments, the scope of use includes the permission scope to access the target data, and the providing module 640 is further configured to, in response to receiving a viewing request for the target data, determine whether the requester initiating the viewing request has viewing permission for the target data based on the permission scope; and in response to determining that the requester has viewing permission for the target data, present the target data to the requester.

[0111] In some embodiments, the scope of use includes the permission range that can access the target data, and the providing module 640 is further configured to, in response to receiving a download request for the target data, determine whether the requester initiating the download request has the permission to download the target data based on the permission range, wherein the download request indicates the download data in the target data and the use scenario of the download data; in response to determining that the requester has the permission to download the target data and that the use scenario matches the data requirement scenario, determine the download data from the target data; and provide the download data to the requester.

[0112] In some embodiments, the scope of use includes indicating the usage time range of the target data, and the apparatus 600 further includes a deletion module configured to delete the stored target data in response to detecting that the storage time of the target data exceeds the usage time range.

[0113] In some embodiments, the apparatus 600 further includes an encryption module configured to encrypt target data using a first key dedicated to unified processing of data requests; and to store the encrypted target data.

[0114] In some embodiments, the device 600 further includes an identification information generation module, configured to generate identification information for the target data based on the data request, the target data, and the processing of the target data, wherein the identification information characterizes the lifecycle of the target data; and to write the identification information into the blockchain.

[0115] like Figure 7 As shown, electronic device 700 is in the form of a general-purpose electronic device. Components of electronic device 700 may include, but are not limited to, one or more processors or processing units 710, memory 720, storage device 730, one or more communication units 740, one or more input devices 750, and one or more output devices 760. Processing unit 710 may be a physical or virtual processor and is capable of performing various processes according to programs stored in memory 720. In a multiprocessor system, multiple processing units execute computer-executable instructions in parallel to improve the parallel processing capability of electronic device 700.

[0116] Electronic device 700 typically includes multiple computer storage media. Such media can be any accessible media that is accessible to electronic device 700, including but not limited to volatile and non-volatile media, removable and non-removable media. Memory 720 can be volatile memory (e.g., registers, cache, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. Storage device 730 can be removable or non-removable media and can include machine-readable media, such as flash drives, disks, or any other media that can be used to store information and / or data and can be accessed within electronic device 700.

[0117] Electronic device 700 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not explicitly stated... Figure 7 As shown, disk drives for reading from or writing to removable, non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable, non-volatile optical disks can be provided. In these cases, each drive can be connected to a bus (not shown) via one or more data media interfaces. Memory 720 may include computer program product 725 having one or more program modules configured to perform various methods or actions of various embodiments of this disclosure.

[0118] The communication unit 740 enables communication with other electronic devices via a communication medium. Additionally, the functionality of the components of the electronic device 700 can be implemented using a single computing cluster or multiple computing machines capable of communicating via communication connections. Therefore, the electronic device 700 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network node.

[0119] Input device 750 can be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 760 can be one or more output devices, such as a monitor, speaker, printer, etc. Electronic device 700 can also communicate with one or more external devices (not shown) via communication unit 740 as needed. These external devices include storage devices, display devices, etc., and can communicate with one or more devices that enable user interaction with electronic device 700, or with any device that enables electronic device 700 to communicate with one or more other electronic devices (e.g., network card, modem, etc.). Such communication can be performed via input / output (I / O) interface (not shown).

[0120] According to an exemplary implementation of this disclosure, a computer-readable storage medium is provided that stores computer-executable instructions thereon, wherein the computer-executable instructions are executed by a processor to implement the methods described above. According to an exemplary implementation of this disclosure, a computer program product is also provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, which are executed by a processor to implement the methods described above.

[0121] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, devices, and computer program products implemented according to this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0122] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0123] Computer-readable program instructions can be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions that execute on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0124] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0125] Various implementations of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to technology in the market, or to enable others skilled in the art to understand the various implementations disclosed herein.

Claims

1. A method for uniformly processing data requests, comprising: Obtain a data request for target data, wherein the data request is related to the data requirement scenario and at least includes the scope of use of the target data; In response to the data request being verified, at least one data acquisition mode is determined from multiple data acquisition modes based on data protection requirements related to the target data. Different data acquisition modes among the multiple data acquisition modes are configured to acquire business data with different data protection requirements. The multiple data acquisition modes include different types of data acquisition modes, and the different types of data acquisition modes include at least two of the following: interface-based acquisition mode, proxy-based acquisition mode, instruction set-based acquisition mode, data table-based acquisition mode, and task assignment-based acquisition mode. The target data is obtained according to the at least one data acquisition mode; as well as Based on the scope of use, access to the target data is provided.

2. The method of claim 1, wherein the scope of use includes the permission scope to access the target data, and providing access to the target data includes: In response to receiving a viewing request for the target data, determine whether the requester initiating the viewing request has viewing permission for the target data based on the permission scope; as well as In response to determining that the requesting party has viewing permission for the target data, the target data is presented to the requesting party.

3. The method of claim 1, wherein the scope of use includes the permission scope to access the target data, and providing access to the target data includes: In response to receiving a download request for the target data, the system determines whether the requester initiating the download request has the permission to download the target data based on the permission scope. The download request indicates the downloadable data in the target data and the usage scenario of the downloadable data. In response to determining that the requester has download permission for the target data and that the use case matches the data requirement scenario, the download data is determined from the target data; as well as The downloaded data is provided to the requesting party.

4. The method according to claim 1, wherein the scope of use includes the time range of use of the target data, and the method further comprises: In response to the detection that the storage time of the target data exceeds the usage time range, the stored target data is deleted.

5. The method of claim 1, wherein obtaining a data request for the target data comprises: In response to receiving a data request creation instruction, present multiple candidate fields indicating different data types; as well as In response to receiving a selection of at least one target field from the plurality of candidate fields, the data request is created based on the at least one target field.

6. The method according to claim 1, wherein acquiring the target data according to the at least one data acquisition mode comprises: Initial data is obtained according to the at least one data acquisition mode, and the initial data includes multiple data items of different data types; The multiple data items are grouped based on their corresponding data types to determine multiple groups of data; as well as Standardization processing is performed on each of the multiple sets of data to obtain multiple sets of processed data as the target data.

7. The method according to claim 1, further comprising: Based on the data request, the target data, and the processing procedure of the target data, identification information for the target data is generated, and the identification information represents the lifespan of the target data. as well as Write the identification information into the blockchain.

8. The method of claim 1, wherein the scope of application includes at least one of the following: The type of the target data, The scenario information of the data requirement scenario, The scope of permissions to access the target data, or The time range for the use of the target data.

9. The method according to claim 1, further comprising: The target data is encrypted using a first key, which is dedicated to the unified processing of data requests; as well as The encrypted target data is stored.

10. The method of claim 1, wherein the at least one data acquisition mode includes the interface-based acquisition mode, and acquiring the target data includes: Based on the business related to at least a portion of the target data, determine the interface that connects to the business system of the business. as well as At least a portion of the target data is obtained from the business system through the interface.

11. The method of claim 1, wherein the at least one data acquisition mode includes the agent-based acquisition mode, and acquiring the target data includes: Based on services related to at least a portion of the target data, a data proxy is determined that communicates with a first data storage system of the services. Based on the data request, a data acquisition request is provided to the data agent, and the data agent is configured to acquire business data from the first data storage system based on the data acquisition request. as well as Receive a response from the data broker for the data acquisition request, the response including at least a portion of the target data.

12. The method of claim 1, wherein the at least one data acquisition mode includes the instruction set-based acquisition mode, and acquiring the target data includes: Based on the business related to at least a portion of the target data, determine the target instruction set deployed in the business system of the business; Based on the data request, the target instruction set is invoked, and the target instruction set is configured to retrieve data from the first data storage area of ​​the business system and encrypt and store the retrieved data in the second data storage area of ​​the business system. as well as At least a portion of the target data is obtained from the second data storage area.

13. The method of claim 12, wherein obtaining at least a portion of the target data from the second data storage area comprises: Read at least a portion of the encrypted target data from the second data storage area; The at least portion of the encrypted target data is decrypted using a second key associated with the business to obtain the at least portion of the target data.

14. The method of claim 1, wherein the at least one data acquisition mode includes the data table-based acquisition mode, and acquiring the target data includes: Identify the business related to at least a portion of the target data; Based on at least a portion of the target data, determine the business data table with access permissions from the second storage system of the business; as well as Read at least a portion of the target data from the determined business data table.

15. The method of claim 1, wherein the at least one data acquisition mode includes the task assignment-based acquisition mode, and acquiring the target data includes: Based on the data request, a data acquisition instruction is determined for acquiring at least a portion of the target data; The data acquisition instruction is provided to the data provider so that the data provider can initiate a data acquisition task corresponding to the data request. as well as The execution result of the data acquisition task is received from the data provider, and the execution result includes at least a portion of the target data.

16. The method of claim 15, further comprising: In response to determining that at least a portion of the target data does not satisfy the data request, an update request is generated for at least a portion of the target data; as well as The update request is provided to the data provider to obtain the updated target data, at least a portion thereof.

17. An apparatus for uniformly processing data requests, comprising: The first acquisition module is configured to acquire a data request for target data, the data request being related to the data requirement scenario and at least including the scope of use of the target data; The determination module is configured to, in response to the data request being verified, determine at least one data acquisition mode from multiple data acquisition modes based on data protection requirements related to the target data. Different data acquisition modes among the multiple data acquisition modes are configured to acquire business data with different data protection requirements. The multiple data acquisition modes include different types of data acquisition modes, and the different types of data acquisition modes include at least two of the following: interface-based acquisition mode, proxy-based acquisition mode, instruction set-based acquisition mode, data table-based acquisition mode, and task assignment-based acquisition mode. The second acquisition module is configured to acquire the target data according to the at least one data acquisition mode; as well as A module is provided, configured to provide access to the target data based on the scope of use.

18. An electronic device, comprising: At least one processing unit; as well as At least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions causing the electronic device to perform the method according to any one of claims 1 to 16 when executed by the at least one processing unit.

19. A computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to implement the method according to any one of claims 1 to 16.

20. A computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 16.

Images