Data access method and device of dynamic strategy, electronic equipment and storage medium

Abstract

The invention discloses a dynamic strategy data access method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a dynamic strategy parameter corresponding to a data access object according to a data access request under the condition of obtaining the data access request corresponding to the data access object; determining a dynamic data access strategy corresponding to the data access object according to the dynamic strategy parameter; and determining target access data corresponding to the data access request based on the dynamic data access strategy, and sending the target access data to the data access object. Based on the technical scheme, the dynamic strategy corresponding to the data access request is determined, and then the target access data is dynamically determined according to the dynamic strategy, so that the data access strategy can be dynamically changed, the strategy flexibility problem in a specific scene of urban and rural fusion is solved, and the data credibility is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a dynamic strategy data access method, apparatus, electronic device, and storage medium. Background Technology

[0002] The urban-rural integration development strategy involves the free two-way flow of urban and rural factors, which urgently requires secure and reliable data interconnection support. Existing technical solutions provide data interfaces through centralized gateways such as Kong or Apigee, or achieve data circulation between urban and rural areas through data hashing on the blockchain and smart contracts executing fixed rules.

[0003] However, existing access control policies are insufficient to meet the fine-grained and dynamically changing policy requirements in the context of urban-rural integration, such as rules for agricultural subsidy distribution, cross-regional social security settlement, and complex contextual conditions such as data timeliness, geographical restrictions, and combinations of identity attributes. They also fail to meet the multi-dimensional security and compliance needs of market supervision, public services, and personal privacy protection in urban-rural integration. Summary of the Invention

[0004] This invention provides a dynamic strategy data access method, apparatus, electronic device, and storage medium. By determining a dynamic strategy corresponding to a data access request, and then dynamically determining the target data to be accessed based on the dynamic strategy, the data access strategy can be dynamically changed, solving the problem of strategy flexibility in specific scenarios of urban-rural integration and improving data credibility.

[0005] According to one aspect of the present invention, a dynamic strategy data access method is provided, comprising:

[0006] Upon receiving a data access request corresponding to a data access object, determine the dynamic strategy parameters corresponding to the data access object based on the data access request;

[0007] Determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters;

[0008] Based on the dynamic data access strategy, the target access data corresponding to the data access request is determined, and the target access data is sent to the data access object.

[0009] According to another aspect of the present invention, a data access device with dynamic strategy is provided, comprising:

[0010] The request parsing module is used to determine the dynamic strategy parameters corresponding to the data access object based on the data access request when a data access request corresponding to the data access object is obtained.

[0011] The dynamic strategy determination module is used to determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters.

[0012] The target data feedback module is used to determine the target access data corresponding to the data access request based on the dynamic data access strategy, and send the target access data to the data access object.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data access method of the dynamic strategy according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data access method of the dynamic strategy described in any embodiment of the present invention.

[0018] The technical solution of this invention, upon receiving a data access request corresponding to a data access object, determines dynamic strategy parameters corresponding to the data access object based on the data access request, determines a dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters, then determines target access data corresponding to the data access request based on the dynamic data access strategy, and sends the target access data to the data access object. Based on this technical solution, by determining a dynamic strategy corresponding to the data access request and then dynamically determining the target access data based on that dynamic strategy, the data access strategy can be dynamically changed, solving the problem of strategy flexibility in specific scenarios of urban-rural integration and improving data reliability.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a dynamic strategy data access method provided in an embodiment of the present invention;

[0022] Figure 2 This is a flowchart illustrating a dynamic strategy data access method provided in an embodiment of the present invention;

[0023] Figure 3 This is an architecture diagram of trusted data flow in urban and rural areas provided in an embodiment of the present invention;

[0024] Figure 4 This is a structural block diagram of the data access device with dynamic strategy provided in the embodiments of the present invention;

[0025] Figure 5 This is a schematic diagram of the structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] It should be noted that the acquisition, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations.

[0029] Example 1

[0030] Figure 1 This is a flowchart illustrating a dynamic policy data access method according to an embodiment of the present invention. This embodiment is applicable to determining a dynamic data access policy corresponding to a data access request upon receipt, and determining the data access status based on the access policy. This method can be executed by a dynamic policy data access device, which can be implemented in hardware and / or software. This dynamic policy data access device can be configured in an electronic device, such as a server or terminal device. Figure 1 As shown, the method includes:

[0031] S110. Upon receiving a data access request corresponding to a data access object, determine the dynamic strategy parameters corresponding to the data access object based on the data access request.

[0032] In this context, the data access target can be understood as the data user who needs to access the data, which may include city hospitals, agricultural product enterprises, township governments, farmers, etc. Data access requests are sent to the Trusted Data Space Service Platform through a connector. Dynamic policy parameters can be personalized data access policies corresponding to the access target.

[0033] Specifically, upon receiving a data access request corresponding to a data access object, dynamic policy parameters corresponding to the data access object are determined based on the data access request. For example, during data processing, when a data access request associated with a data access object is received, a policy parsing process is initiated. First, the data access request is comprehensively parsed to extract key information such as the access subject, operation type, and data scope. Then, based on a pre-configured policy rule base and combined with the attribute characteristics of the data access object, such as data sensitivity and storage location, the dynamic policy parameters matching the data access object are accurately calculated and determined. For instance, the user connector sends a formal call request to the trusted data space service platform, such as: Contract ID: xx contract address, interface call parameters: date: xxx, signature: xxxx private key signature, etc.

[0034] Based on the above technical solution, before determining the dynamic policy parameters corresponding to the data access object according to the data access request, the method further includes: determining a verification identifier corresponding to the data access object according to the data access request; determining a request verification result corresponding to the data access request based on the verification identifier; and determining the dynamic policy parameters corresponding to the data access object according to the data access request if the request verification result is successful.

[0035] The verification identifier includes at least one of the following: a contract identifier, a request signature validity period, and request parameters. The contract identifier uniquely identifies the relevant contract; the request signature validity period indicates the validity period of the data access object's personal signature; and the request parameters represent the specific content of the request, which may include the target data, the purpose of the data, etc. The verification identifier can be identification information used to determine the data access permissions of the data access object.

[0036] Specifically, a verification identifier corresponding to the data access object is determined based on the data access request; a request verification result corresponding to the data access request is determined based on the verification identifier; if the request verification result is successful, dynamic policy parameters corresponding to the data access object are determined based on the data access request. For example, when processing a data access request, a verification identifier corresponding to the target data access object is determined from the data access request. The verification identifier serves as a key basis for subsequent verification and at least covers one type of key information, including a contract identifier used to uniquely identify the relevant contract, the validity period of the request signature, and the request parameters. Based on the verification identifier, permission verification is performed according to preset rules to obtain a request verification result corresponding to the data access request. When the request verification result is successful, dynamic policy parameters matching the data access object are further determined based on the data access request.

[0037] Based on the above technical solution, the step of determining the dynamic strategy parameters corresponding to the data access object according to the data access request includes: determining the request context data corresponding to the data access request, and extracting the dynamic strategy parameters corresponding to the data access object from the request context data according to a preset data dimension.

[0038] The preset data dimensions include at least one of the following: time validity dimension, geographical dimension, industry chain dimension, and data attribute. Context data can be descriptive data associated with the data access request. Preset data dimensions can be understood as pre-defined data extraction dimensions.

[0039] Specifically, the request context data corresponding to the data access request is determined, and dynamic strategy parameters corresponding to the data access object are extracted from the request context data according to preset data dimensions. For example, a deep analysis of the data access request is first conducted to comprehensively collect and determine the request context data closely related to the request. This data is like a jigsaw puzzle, containing rich information such as the precise time the request was initiated, the geographical location of the request source, the business links involved in the request, and the attribute characteristics of the data itself. Then, preset data dimensions are used as a filtering benchmark to extract dynamic strategy parameters corresponding to the data access object from the request context data. The preset data dimensions include a time validity dimension to determine whether the request is within the allowed time range, a geographical dimension to determine whether the request source location has access rights, a supply chain dimension to consider whether the position of the request in the supply chain conforms to the access rules, and data attributes to determine at least one type of access strategy based on the data's sensitivity, type, and other attributes, thereby ensuring the accuracy and rationality of the dynamic strategy parameters.

[0040] S120. Determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters.

[0041] Among them, dynamic data access strategy can be a data access strategy corresponding to the access object.

[0042] Specifically, after obtaining the dynamic policy parameters associated with the data access object, these parameters undergo comprehensive and meticulous verification to ensure their completeness, accuracy, and validity, preventing deviations in subsequent policy formulation due to parameter errors. Furthermore, the dynamic policy parameters are analyzed, with each piece of information within them, such as time validity, geographical restrictions, and data sensitivity, matched and mapped one-to-one with the policy rules. Based on the matching and mapping results, a dynamic data access policy corresponding to the data access object is determined. This dynamic data access policy is used to strictly regulate data access behavior and permissions. For example, the data control module receives a call request. The engine verifies the validity of the request's contract identifier, the validity of the request signature, and whether the request parameters conform to the contract's basic scope. If verification fails, the request is immediately blocked, logged, and all parties are notified. If verification succeeds, the engine enters the dynamic policy generation stage. Combining the following multi-dimensional information, a final executable policy is generated in real time. Specifically, the core constraint framework is provided by the contract terms. Based on the request context, such as the user's identity attributes, request parameters, call time, and the region that the call source IP can be mapped to, data sensitivity and the industry chain link are obtained from the directory service. Then, based on the generated policy, a final decision is made to allow or deny the current request. This policy instance is compiled into a policy execution instruction that can be understood and executed by the provider and user connectors. The instruction contains specific control points, such as filtering fields, de-identification rules, watermark embedding requirements, and call counter initialization. The instruction is then issued: the engine securely issues the corresponding execution instructions to the provider and user connectors through the connector management module.

[0043] Based on the above technical solution, the step of determining the dynamic data access strategy corresponding to the data access object according to the dynamic strategy parameters includes: when there are parameters in the dynamic strategy parameters corresponding to the regional dimension, determining the development index corresponding to the data access object according to the regional dimension; determining the regional attribute corresponding to the data access object based on the development index; and determining the dynamic data access strategy to increase the number of data calls when both the regional attribute and the data attribute meet preset conditions.

[0044] Among these, the development index can be the economic development index of the region where the data access object is located. The regional attribute can be understood as information reflecting the economic attributes of the region where the data access object is located; for example, the regional attribute could be an economically developed region or an economically underdeveloped region. The data attribute can be the data purpose corresponding to the access request.

[0045] Specifically, when the dynamic strategy parameters contain parameters corresponding to the geographic dimension, a development index corresponding to the data access object is determined based on the geographic dimension. Based on the development index, a geographic attribute corresponding to the data access object is determined. If both the geographic attribute and the data attribute meet preset conditions, the dynamic data access strategy is determined to increase the number of data calls. For example, when a parameter corresponding to the geographic dimension is detected in the dynamic strategy parameters, a geographic dimension-based analysis mechanism is initiated. First, a pre-built development index calculation model covering multi-dimensional data is invoked. The geographic dimension parameter is substituted into the model as a key input variable. By accurately combining various factors such as the region's economy, policies, and market, the development index corresponding to the data access object is calculated. Then, based on preset geographic attribute classification standards, the calculated development index is classified and mapped to determine the geographic attribute corresponding to the data access object. After determining the geographic attribute, the data attributes of the data access object are simultaneously acquired and compared with preset data attribute conditions. At the same time, the determined regional attributes are matched with the preset regional attribute requirements. Only when both the regional attributes and data attributes meet the preset conditions will the dynamic data access strategy be determined to increase the number of data calls.

[0046] For example, the engine identifies the geographical attributes of the subject involved in the request and dynamically calculates and adjusts threshold parameters in the strategy based on predefined rules or associated external indices. For instance, if it detects that the user is located in an underdeveloped rural area (based on indices or attributes) and the data is used for public service purposes, it automatically increases the call limit in the strategy from the base value of 10 times / day to 20 times / day, promoting the reasonable flow of data in underdeveloped areas. Regarding the characteristics of the industrial chain (source: data resource catalog), the engine identifies the specific industrial chain link to which the target data belongs. Based on the data sensitivity characteristics and business rules of different links, it dynamically generates or modifies field-level and operation set control rules. For example, for planting data, the strategy may only open basic attribute fields (such as variety, expected yield, planting time). When the same topic (or related subject) requests data for the processing link, the strategy dynamically unlocks component indicator fields (such as sugar content, acidity) and strictly prohibits non-processing link subjects from accessing component indicators. For policy validity rules, the engine identifies the strategy template associated with the request and its validity period, and automatically merges the rules in the template into the generated strategy. This engine has built-in... The time validity monitoring module automatically calculates a relative time window based on the template's validity period when generating policies. For example, if it detects that a related rural revitalization subsidy policy template has expired, the engine automatically terminates all data access permissions that depend on that template in the policy generation, or directly rejects the request in the decision-making process to ensure policy compliance. Specifically, the association mechanism is as follows: - Government agencies upload templates: {"policy_template_id":"ZJ-Rural Revitalization-2023","expiry_date":"2025-12-31","applicable_region":"Zhejiang Province"} When providers publish data, they bind the following in the metadata: {"data_id":"A Town Apple Subsidy","bound_policy_templates":["ZJ-Rural Revitalization-2023"]} The engine inherits the validity period when generating policies: policy.conditions.temporal.valid_to = min(request duration, ZJ-Rural Revitalization-2023.expiry_date)

[0047] Core Strategy Generation Process: Input: Verified data call request + contract terms + user identity attributes + target data metadata + associated strategy template + (optional) external factors. Factor Parsing and Fusion: The engine parses the above inputs, extracting key dimension information such as region, industry, and timeliness. Rule Matching and Derivation: Based on a pre-built rule base (configurable) and contract terms, combined with various dimension factors, specific control requirements are derived. - Example: IF(data.sector=='agriculture_production' AND request.purpose=='supply_chain_optimization' AND subject.regionIN[list of underdeveloped regions]) THEN SETquota.limit=20. Strategy Instantiation: The derived control requirements are instantiated into specific, structured strategy objects.

[0048] Output: Generates the final, executable policy decision and the corresponding policy execution instructions.

[0049] Based on the above technical solution, the step of determining the dynamic data access strategy corresponding to the data access object according to the dynamic strategy parameters includes: when there are parameters in the dynamic strategy parameters corresponding to the industry chain dimension, determining the industry chain position corresponding to the data access object according to the industry chain dimension; and determining the dynamic data access strategy corresponding to the data access object based on the industry chain position.

[0050] Among them, the position in the industry chain describes the location of the data access object in its industry chain, such as being an upstream manufacturer or a raw material producer.

[0051] Specifically, when a parameter corresponding to the industry chain dimension is detected in the dynamic strategy parameters, a strategy derivation mechanism based on the industry chain dimension is initiated. First, a pre-built industry chain analysis model is invoked. This model integrates rich industry chain data, covering multi-dimensional information such as upstream and downstream enterprise relationships, value distribution across industry segments, and supply chain stability. After inputting the industry chain dimension parameters into this model, it uses complex algorithms and logical analysis to accurately locate the industry chain position corresponding to the data access object, such as determining whether it is in the upstream raw material supply segment, the midstream manufacturing segment, or the downstream sales and service segment. After determining the industry chain position, a matching process is performed based on a pre-set strategy rule base. The strategy rule base stores data access strategy templates for different industry chain positions. These templates combine industry best practices, security and compliance requirements, and business development needs. The located industry chain position is compared and adapted with the templates in the rule base, while also considering other attributes of the data access object, such as data sensitivity and access frequency, to fine-tune the adapted strategy template. Ultimately, a highly targeted and flexible dynamic data access strategy was determined, corresponding to the data access objects, to ensure that data access can meet business needs while also guaranteeing data security and compliance.

[0052] Based on the above technical solution, the step of determining the dynamic data access strategy corresponding to the data access object according to the dynamic strategy parameters includes: if there are parameters in the dynamic strategy parameters corresponding to the time validity dimension, determining the policy document corresponding to the data access object; determining the validity period of the policy document; and determining the dynamic data access strategy according to the validity period of the policy document and the parameters corresponding to the time validity dimension.

[0053] In this context, "policy document" can be understood as a relevant policy document that matches the data access object. This can be a document provided by the user during the contract establishment process, or it can be dynamically determined based on the information corresponding to the data access object during the data access control process. For example, when the agricultural product of the data access object is A, the policy document associated with A can be determined based on the geographical attributes of the data access object. "Effective period" can be understood as the duration of the policy document.

[0054] Specifically, when a parameter corresponding to the time validity dimension is detected in the dynamic strategy parameters, a strategy derivation process based on the association between time and policy is triggered. First, a policy retrieval mechanism is initiated. Based on key characteristics such as the industry attributes, business scope, and data type of the data access object, a precise match is performed in a pre-built policy database to determine the policy document corresponding to that data access object, which may include rural revitalization subsidy policies. It should be noted that the policy database covers multi-level and multi-dimensional policy information, including industry regulatory regulations and internal company rules, and is regularly updated and maintained to ensure the timeliness and accuracy of policy documents. After identifying the policy document, key clauses and information regarding the validity period are extracted. Natural language processing technology and semantic analysis algorithms are used to identify important time nodes such as the policy's effective date, expiration date, and any possible transition periods, thereby determining the policy document's validity period. Furthermore, the validity period of policy documents is comprehensively analyzed and compared with the parameters corresponding to the time validity dimension. Combined with factors such as the frequency, duration, and urgency of data access, a preset strategy generation model is used to determine dynamic data access strategies. Dynamic data access strategies include adjusting the time window for data access, restricting data access within a specific time period, and dynamically adjusting data access permissions according to the policy validity period, so as to ensure that data access behavior always complies with policy requirements and at the same time ensures the normal operation of business.

[0055] S130. Based on the dynamic data access strategy, determine the target access data corresponding to the data access request, and send the target access data to the data access object.

[0056] The target access data can be data that corresponds to the dynamic data access strategy.

[0057] Specifically, the target access data corresponding to the data access request is determined based on the dynamic data access strategy, and the target access data is sent to the data access object. For example, the data corresponding to the initial contract can be determined based on the initial contract of the data access object, and the data corresponding to the dynamic data access strategy can be extracted from the data corresponding to the initial contract according to the dynamic data access strategy, and used as the target access data.

[0058] It should be noted that the provider processes the data locally, including processing, data anonymization, and transformation. For example, the provider connector receives execution instructions and, according to the policy requirements in the instructions, securely accesses the data resource layer locally. Then, it processes the data through the data service engine built into the provider's local business system, automatically performing field selection, data anonymization, and format conversion. The provider connector directly transmits the processed data to the user connector. After completing the data transmission, the provider connector reports a detailed log of the transmission to the data metering and auditing service. During the use of data in the user's business system, the user connector may report actual usage logs according to policy instructions. The user's business system's access to data through the connector is also monitored by the connector, which reports critical events such as alarms when the number of calls reaches a threshold. The metering service receives all reported information, performs aggregation analysis, and writes key operation logs to the blockchain for permanent and tamper-proof storage.

[0059] The technical solution of this invention, upon receiving a data access request corresponding to a data access object, determines dynamic strategy parameters corresponding to the data access object based on the data access request, determines a dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters, then determines target access data corresponding to the data access request based on the dynamic data access strategy, and sends the target access data to the data access object. Based on this technical solution, by determining a dynamic strategy corresponding to the data access request and then dynamically determining the target access data based on that dynamic strategy, the data access strategy can be dynamically changed, solving the problem of strategy flexibility in specific scenarios of urban-rural integration and improving data reliability.

[0060] Example 2

[0061] Figure 2 This is a flowchart illustrating a dynamic strategy data access method provided in an embodiment of this application. This embodiment further explains the technical solution for determining the initial data access contract based on the above-described technical solution. Figure 2 As shown, before obtaining the data access request corresponding to the data access object, the process also includes:

[0062] S210. Obtain a contract establishment request corresponding to the data access object.

[0063] The contract creation request includes the target data identifier, contract duration, contract purpose, and data identifier. The contract creation request can be information used to establish an initial data access contract.

[0064] Specifically, a contract establishment request is obtained corresponding to the data access object. For example, the user's business system, such as an e-commerce platform, initiates a data usage request through a service layer application interface. The request includes: the target data identifier (DataID), the purpose of the request ("supply chain optimization"), the usage duration (optional), other parameters such as query conditions, and the user's digital identity credential signature. For example: Target: Apple price in Town A; Purpose: Supply chain optimization; Usage duration: 90 days, etc.

[0065] S220. Determine the initial data access contract corresponding to the data access object based on the contract establishment request.

[0066] The initial data access contract can be a data usage contract initially signed between the data access object and the data provider object.

[0067] Specifically, the service application layer forwards the request to the trusted control layer, and verifies the validity of the user's identity credentials and the authenticity of the signature through the identity authentication and authorization module. The data resource catalog module finds the corresponding data provider identifier and metadata based on the requested data identifier, including basic control requirements and associated policy template IDs. The provider then revises / confirms the policy. The trusted data space service platform forwards the request, including user identity attributes, request details, and target data metadata, to the provider's access connector. The provider's business system, such as a township cooperative system, can view the request through the interface provided by the connector and manually review or revise the terms based on business rules. For example, allowed fields include: date, specifications, wholesale price; prohibited uses include: resale, financial analysis; call limit: 10 times per day; binding a specific policy template ID; and returning the revised terms information to the platform. The digital contract module generates a specific, legally or technically binding digital contract based on the request context, such as user attributes, data metadata, provider revised terms, and associated contract / policy templates. This contract clearly stipulates the detailed rules and terms for this data use. The contract's hash or key digest information is stored on the blockchain, completing the notarization process and obtaining a unique contract identifier and blockchain transaction certificate. The full text of the contract or its encrypted digest can be stored off-chain. Both the user and provider systems are required to digitally sign and confirm the contract.

[0068] It should be noted that it can be combined with Figure 3 The technical solution provided by the present invention will be further described, such as... Figure 3As shown, the architecture of this invention includes a service application layer, a trusted control layer, and a data resource layer. Specifically, the service application layer provides an entry point for urban and rural business services, initiating data calls to the trusted control layer through a unified service interface API provided by this layer; the geographic information service system provides spatial data applications such as rural land planning and cultural relic positioning; the e-commerce service system supports agricultural product transactions and supply chain management; the big data intelligent analysis service system realizes cross-domain data value mining; and the virtual-real integrated display system constructs a visualization scenario for cultural and tourism resources. Furthermore, as the initiator of data usage requests, it encapsulates the specific business scenario's data requirements details, such as the requested data identifier, usage description, and calling parameters.

[0069] Trusted Control Layer: Enables core data security governance - Trusted Data Space Service Platform: As a core component of the entire system architecture, it is deployed in authoritative urban-rural integration institutions with credibility, such as provincial urban-rural integration development centers or leading industry players, and is responsible for overall management.

[0070] Identity Authentication and Authorization: All data providers / consumers participating in urban-rural integration, such as urban hospitals, agricultural product enterprises, township governments, and farmers, must register their unique digital identity ID here and obtain access credentials such as digital certificates. Their identity information, including attributes such as identity type, region, and industry, needs to be verified and managed.

[0071] Establish a root of trust for all participating entities within the space, providing an identity foundation for subsequent attribute-based access control and policy decisions. All requests must be accompanied by valid credentials for authentication.

[0072] Data Resource Catalog: Publishes / manages a catalog of data assets and their metadata that can be shared within the space. Catalog entries include: a unique data identifier (DataID), data name / description, data provider ID, data format / schema, data sensitivity level, the industry chain link to which the data belongs (e.g., planting, processing, logistics, sales), optional policy template ID, and basic usage control requirements (not final policy). The catalog does not store the actual data itself. Provides data resource discovery capabilities. Users can search for available data based on metadata attributes such as region, industry, and sensitivity. Catalog information is one of the important input sources for dynamic policy generation. Access Connector Management: Manages access connector instances for all registered entities. It is responsible for distributing the final policy execution instructions generated by the Trusted Data Space Service Platform to the corresponding access connectors, and simultaneously receiving policy execution result logs, monitoring information such as call counts, data volume, and anomaly alarms reported by the connectors; acting as the distribution center for policy instructions and the monitoring center for connector status, it ensures smooth communication between the control layer and the execution layer. Digital Contract Management: Stores and manages predefined policy rule templates and contract templates. The strategy rule template defines a reusable control logic skeleton, such as: {Subject Condition: [Region = Zhejiang Province AND Industry = Supermarket AND Qualification = Organic Certification], Resource Condition: [Data Tag contains 'Quality Inspection'], Operation: [Read], Condition: [Purpose IN 'Procurement Decision' AND Validity Period <= Related Policy Validity Period], Obligation: [Prohibition of Resale AND Call Frequency <= Threshold]}. Contract templates are associated with specific business scenarios such as "Agricultural Product Subsidy Application" and "Cross-Regional Medical Insurance Settlement," containing a basic framework of terms agreed upon by the business parties. Government agencies and platform operators can upload / update strategy templates or contract templates bound to specific policies such as "ZJ-Rural Revitalization-2023," including policy effectiveness conditions such as region and timeliness, providing a rule base library for dynamically generated strategies. Policy timeliness and other rules are centrally managed here. Data Usage Control: Responsible for dynamically generating control strategies. Innovation points are based on the specific needs of urban-rural integration scenarios, such as the specific requirements of a certain integration policy, data sensitivity classification, and subject attribute association rules, dynamically generating or adapting control strategy instances. The strategy generation process considers unique urban and rural contextual factors such as location, industry chain links, and policy timeliness at the decision-making point. Data metering and management: All key operational events are logged in a complete and tamper-proof manner, including but not limited to: entity registration / authentication events, strategy / contract template changes, strategy generation decision details, strategy execution instruction issuance, connector execution result reports, and data access / call / transmission records including timestamps, entity ID, data ID, operation type, data volume / frequency, and strategy ID. This ensures traceability and auditability, meets compliance requirements, and provides a basis for billing and dispute arbitration. Key logs are stored on the blockchain to ensure their authenticity and non-repudiation. Connectors: Key security boundary components.Each urban and rural data participant node, whether a provider or a consumer, must deploy its dedicated connector at the local network boundary. As the execution terminal of the trusted control layer, the policy instructions generated by the data usage control module are managed and distributed to the execution terminal through the access connector. 1. Data Provider: Urban and rural entities holding data to be shared, such as city hospitals and agricultural cooperatives. Data is stored on their local systems and securely interacts with the outside world through their deployed connectors.

[0073] Data Users: Urban and rural entities that need to use shared data, such as agricultural e-commerce platforms and rural tourism planning departments. They request, receive, and use data through their deployed connectors. The entire process is constrained by usage control policies. Functions: Policy Execution Point: Receives policy execution instructions from the trusted control layer, parses and enforces the control requirements. Data Security Gateway: Acts as the sole proxy for accessing local data resources. For provider connectors, it is responsible for processing / de-identifying / converting local data according to policy instructions (processing / de-identification / conversion does not occur on the connector itself) and transmitting it to authorized user connectors through a secure channel. For user connectors, it is responsible for receiving controlled data and securely transmitting it to the local business system. Local Data Interface: Provides secure interaction interfaces with the local data storage system database, file system, and API services. Monitoring and Reporting: Collects policy execution status such as allow / deny, actual de-identification method, data transmission volume, system status, etc., and reports it to the connector management module of the trusted control layer. Ensuring the implementation of the trusted control layer's policy decisions is the core security boundary that guarantees "raw data not leaving the domain, processed data leaving the domain, raw data being usable but invisible, processed data being visible, and the flow being controllable." Actual data flows only peer-to-peer between the provider and the user, without passing through a trusted control layer. The trusted data space service platform is deployed on provincial government cloud platforms or industry leader's own cloud platforms, adopting a distributed service architecture and configuring redundant nodes to ensure high availability. The access connector uses lightweight hardware devices, deployed at the local network boundary of participating entities, and supports encrypted communication using the national cryptographic algorithm SM4. The trusted data space service platform and the access connector use the HTTPS+mTLS communication protocol, while the access connector and local business systems use the gRPC communication protocol. A storage subnet is built using the Chang'an Chain. Key log policy instructions and metering data are uploaded to the blockchain by calling on-chain smart contracts through the SDK, with a blockchain generation time of less than or equal to 3 seconds.

[0074] Data Resource Layer: This refers to the local, physical or virtual data storage and processing systems of the data provider and / or user, such as database servers, data warehouses, business system databases, and file storage. It resides within the local or private cloud environment of each participating entity. Access can only be achieved through their deployed access connectors. The connectors control data access operations (reading, writing, API calls, etc.) and usage methods according to policies.

[0075] The technical solution of this invention, upon receiving a data access request corresponding to a data access object, determines dynamic strategy parameters corresponding to the data access object based on the data access request, determines a dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters, then determines target access data corresponding to the data access request based on the dynamic data access strategy, and sends the target access data to the data access object. Based on this technical solution, by determining a dynamic strategy corresponding to the data access request and then dynamically determining the target access data based on that dynamic strategy, the data access strategy can be dynamically changed, solving the problem of strategy flexibility in specific scenarios of urban-rural integration and improving data reliability.

[0076] Example 3

[0077] Figure 4 This is a structural block diagram of a dynamic strategy data access device provided in an embodiment of this application. For example... Figure 4 As shown, the device includes: a request parsing module 410, a dynamic strategy determination module 420, and a target data feedback module 430;

[0078] The request parsing module 410 is used to determine the dynamic strategy parameters corresponding to the data access object based on the data access request when a data access request corresponding to the data access object is obtained.

[0079] The dynamic strategy determination module 420 is used to determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters.

[0080] The target data feedback module 430 is used to determine the target access data corresponding to the data access request based on the dynamic data access strategy, and send the target access data to the data access object.

[0081] Based on the above technical solution, the request parsing module is used to determine the request context data corresponding to the data access request, and extract dynamic strategy parameters corresponding to the data access object from the request context data according to a preset data dimension; wherein, the preset data dimension includes at least one of the following: time validity dimension, region dimension, industry chain dimension, and data attribute.

[0082] Based on the above technical solution, the dynamic strategy determination module is used to determine a development index corresponding to the data access object according to the regional dimension when there are parameters in the dynamic strategy parameters that correspond to the regional dimension; determine the regional attribute corresponding to the data access object based on the development index; and determine the dynamic data access strategy as increasing the number of data calls when both the regional attribute and the data attribute meet the preset conditions.

[0083] Based on the above technical solution, the dynamic strategy determination module is used to determine the industry chain position corresponding to the data access object according to the industry chain dimension when there are parameters in the dynamic strategy parameters that correspond to the industry chain dimension; and to determine the dynamic data access strategy corresponding to the data access object based on the industry chain position.

[0084] Based on the above technical solution, the dynamic strategy determination module is used to determine the policy document corresponding to the data access object when there are parameters in the dynamic strategy parameters that correspond to the time validity dimension; determine the validity period of the policy document; and determine the dynamic data access strategy based on the validity period of the policy document and the parameters corresponding to the time validity dimension.

[0085] Based on the above technical solution, the request parsing module is used to determine a verification identifier corresponding to the data access object according to the data access request, wherein the verification identifier includes at least one of the following: contract identifier, request signature validity period, and request parameters; determine the request verification result corresponding to the data access request based on the verification identifier; and if the request verification result is successful, determine the dynamic policy parameters corresponding to the data access object according to the data access request.

[0086] Based on the above technical solution, the device further includes an initial contract signing module, used to obtain a contract establishment request corresponding to the data access object before obtaining a data access request corresponding to the data access object, wherein the contract establishment request includes a target data identifier, contract duration, contract purpose, and data identifier; and to determine an initial data access contract corresponding to the data access object based on the contract establishment request.

[0087] The technical solution of this invention, upon receiving a data access request corresponding to a data access object, determines dynamic strategy parameters corresponding to the data access object based on the data access request, determines a dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters, then determines target access data corresponding to the data access request based on the dynamic data access strategy, and sends the target access data to the data access object. Based on this technical solution, by determining a dynamic strategy corresponding to the data access request and then dynamically determining the target access data based on that dynamic strategy, the data access strategy can be dynamically changed, solving the problem of strategy flexibility in specific scenarios of urban-rural integration and improving data reliability.

[0088] The data access device for dynamic strategies provided in the embodiments of the present invention can execute the data access method for dynamic strategies provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0089] Example 4

[0090] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices such as helmets, glasses, watches, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0091] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0092] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0093] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as dynamic policy data access methods.

[0094] In some embodiments, the dynamic policy data access method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the dynamic policy data access method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the dynamic policy data access method by any other suitable means, for example, by means of firmware.

[0095] The various embodiments of the techniques described above and applied herein can be implemented in digital electronic circuits, integrated circuits, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), on-chip SoCs, load-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable device including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from memory, at least one input device, and at least one output device, and transmitting data and instructions to the memory, the at least one input device, and the at least one output device.

[0096] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0097] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with instruction execution, means or apparatus. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor means or apparatus, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM) or flash memory, optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0098] To provide interaction with a user, the techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user, such as a CRT cathode ray tube or an LCD liquid crystal display monitor; and a keyboard and pointing device, such as a mouse or trackball, through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including sound input, voice input, or tactile input.

[0099] The technologies described herein can be implemented in computing that includes backend components, such as a data server; or in computing that includes middleware components, such as an application server; or in computing that includes frontend components, such as a user computer with a graphical user interface or a web browser through which a user can interact with the embodiments of the technologies described herein, or in computing that includes any combination of such backend components, middleware components, or frontend components. The components can be interconnected via digital data communication of any form or medium, such as a communication network. Examples of communication networks include: Local Area Networks (LANs), Wide Area Networks (WANs), blockchain networks, and the Internet.

[0100] Computation can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0101] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0102] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A data access method with dynamic strategies, characterized in that, include: Upon receiving a data access request corresponding to a data access object, determine the dynamic strategy parameters corresponding to the data access object based on the data access request; Determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters; Based on the dynamic data access strategy, the target access data corresponding to the data access request is determined, and the target access data is sent to the data access object.

2. The method according to claim 1, characterized in that, The step of determining the dynamic policy parameters corresponding to the data access object based on the data access request includes: Determine the request context data corresponding to the data access request, and extract dynamic strategy parameters corresponding to the data access object from the request context data according to a preset data dimension; wherein, the preset data dimension includes at least one of the following: time validity dimension, region dimension, industry chain dimension, and data attribute.

3. The method according to claim 2, characterized in that, The step of determining the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters includes: If there are parameters in the dynamic strategy parameters that correspond to the geographic dimension, a development index corresponding to the data access object is determined based on the geographic dimension. Based on the development index, the regional attribute corresponding to the data access object is determined. Under the condition that both the regional attribute and the data attribute meet the preset conditions, the dynamic data access strategy is determined to increase the number of data calls.

4. The method according to claim 2, characterized in that, The step of determining the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters includes: If there are parameters in the dynamic strategy parameters that correspond to the industry chain dimension, the industry chain position corresponding to the data access object is determined according to the industry chain dimension. Based on the position in the industry chain, a dynamic data access strategy corresponding to the data access object is determined.

5. The method according to claim 2, characterized in that, The step of determining the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters includes: If there is a parameter in the dynamic strategy parameters that corresponds to the time validity dimension, determine the policy document corresponding to the data access object; Determine the validity period of the policy document, and determine the dynamic data access strategy based on the validity period of the policy document and the parameters corresponding to the time validity dimension.

6. The method according to claim 1, characterized in that, Before determining the dynamic policy parameters corresponding to the data access object based on the data access request, the method further includes: A verification identifier corresponding to the data access object is determined based on the data access request, wherein the verification identifier includes at least one of the following: contract identifier, request signature validity period, and request parameters; Based on the verification identifier, the request verification result corresponding to the data access request is determined. If the request verification result is successful, the dynamic policy parameters corresponding to the data access object are determined according to the data access request.

7. The method according to claim 1, characterized in that, Before obtaining the data access request corresponding to the data access object, the process also includes: Obtain a contract creation request corresponding to the data access object, wherein the contract creation request includes a target data identifier, contract duration, contract purpose, and data identifier; Based on the contract establishment request, an initial data access contract corresponding to the data access object is determined.

8. A data access device with a dynamic strategy, characterized in that, include: The request parsing module is used to determine the dynamic strategy parameters corresponding to the data access object based on the data access request when a data access request corresponding to the data access object is obtained. The dynamic strategy determination module is used to determine the dynamic data access strategy corresponding to the data access object based on the dynamic strategy parameters. The target data feedback module is used to determine the target access data corresponding to the data access request based on the dynamic data access strategy, and send the target access data to the data access object.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the data access method of the dynamic strategy according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the data access method of any one of claims 1-7 with a dynamic strategy.

Images