Trusted data space security interaction method and system

Abstract

The invention discloses a trusted data space security interaction method and system, a supervisor generates a key pair and a key fragment divided by a master key for each data space, and sends the key pair and the key fragment to a corresponding data space management system, and the key fragment, a public key and data space basic information are published to a block chain smart contract; the requester data space sends a data application request through the block chain data request contract; when the target data space performs compliance auditing on the data application request, when the compliance auditing is passed, encrypting a key fragment through a private key corresponding to a public key of the target data space, and writing the encrypted key fragment into a block chain data request contract; checking the integrity of the obtained key fragment of the target space and a master key recovered from the key fragment through the block chain data request contract; and when the master key recovered by the key segment passes the auditing, completing request data delivery between the requester data space and the target data space based on the request data information.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data self-care, more particularly, to a trusted data space safe interaction method and system. BACKGROUND

[0002] At present, the existing technology is committed to guiding the development of trusted data space and promoting the compliance and efficient circulation of data elements. The key infrastructure of the marketization configuration of data elements in trusted data space is to promote the efficient circulation and value release of data under the premise of ensuring data security and privacy. So far, a number of pilots have been built in the direction of city trusted data space, industry trusted data space and enterprise data space, and have taken initial shape. However, due to the diversity and low value density of big data, the demand of data users for data sources often goes beyond a single dimension channel, so different dimensions of trusted data space also face the demand for data collaboration.

[0003] The existing technology 1 (publication number CN120263387A) deploys edge computing nodes in multiple data owners to ensure that data participates in computing in the form of ciphertext or desensitization throughout the process. According to the data type of the collaborative analysis task, the privacy protection requirement and the calculation complexity, the appropriate privacy calculation protocol is selected. The interaction record and data use rules are realized through the block chain to prevent malicious nodes from tampering. However, the existing technology 1 does not involve the permission management involved in the multi-space cross-domain interaction process, and the use of verifiable key sharing technology to realize the interaction process management of one-to-one and one-to-many business entities.

[0004] The existing technology 2 (publication number CN120151208A) constructs a space network node for each data space to form a distributed space communication network, uses a tree topology structure to build multi-space cross-domain sharing, and realizes the separate control of data control right, management right and use right through the network management of the tree structure, realizing efficient circulation and collaborative management of multi-level organization data. However, the multi-level structure of the existing technology 2 brings the problems of complicated process and message redundancy.

[0005] The existing technology 3 (CN1200868896A) uses blockchain technology as the technical basis to build a multi-layer architecture including network, computing storage, trusted support, data circulation, data service and application scenario, and combines with privacy computing technology to realize data circulation invisibility, so that the data space following the unified technical architecture realizes interconnection and intercommunication, which helps to build a trusted data space network. However, the existing technology 3 does not involve the steps of flexible allocation of permissions and automatic approval in the interaction process. SUMMARY

[0006] The present invention provides a trusted data space secure interaction method and system to solve the problem of how to provide a secure and reliable data space interaction.

[0007] To address the above problems, this invention provides a trusted data space secure interaction method, the method comprising: The regulator generates a key pair and a key fragment divided by the master key for each initial data space. The key pair includes a public key and a private key. The regulator then sends the public key and key fragment of the data space to the corresponding data space management system. The data space management system stores the key fragments, public keys, and basic information of the corresponding data space, and publishes these data fragments, public keys, and basic information to the blockchain smart contract. When a requesting data space needs data from a target data space, the requesting data space sends a data request by calling a blockchain data request contract in the blockchain smart contract. The data request includes the public key of the target data space and the requested data information. When the data space management system of the target data space detects the data application request of the blockchain data request contract, it conducts a compliance review of the data application request through the data space management system. When the data application process passes the compliance review, it encrypts the key fragment with the private key corresponding to the public key of the target data space and writes the encrypted key fragment into the blockchain data request contract. The blockchain data request contract performs a complete review of the key fragments obtained from the target space. Once the key fragments from the target space are collected in their entirety, a request success event is thrown. When the regulator detects a successful request event from the blockchain data request contract, it reviews the master key recovered from the key fragment. When the master key recovered from the key fragment passes the audit, the requested data delivery between the requester's data space and the target data space is completed based on the requested data information.

[0008] Preferably, the method further includes generating new key fragments for the newly added data space by the regulator: By constructing a new polynomial f`(x) satisfying f`(0) = s, such that f`(1) = f`(2) = ... = f`(n) = s, the key fragment si = f`(i) of the newly added data space is calculated by randomly selecting t`-1 = 1 additional points; where s is the master key, f`(0) ... f`(n) are the key fragments of the i-th member; t` is the number of key fragments involved in the synthesis; i is the i-th key fragment; The regulator generates a key pair for the newly added data space and sends the public key and key fragment to the data space management system corresponding to the newly added data space.

[0009] Preferably, it also includes invoking a logging contract via a blockchain data request contract, the logging contract being used for: When the blockchain data request contract sends a data request, the blockchain data request contract calls the log recording contract in the blockchain smart contract, and the status recorded by the log recording contract is marked as "request initiated"; Once the integrity of the key fragment and the master key recovered from the key fragment have both passed the verification, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "verification passed"; Once the requested data is delivered between the requester's data space and the target data space, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "completed".

[0010] Preferably, when the regulator detects a successful request event from the blockchain data request contract, the step of verifying the master key recovered from the key fragment includes: When the regulator detects a successful request event from the blockchain data request contract, it decrypts the key fragment using the private key of the target data space and verifies the decrypted key fragment. When the master key composed of the decrypted key fragments passes the verification, the request data delivery between the requester's data space and the target data space is completed based on the request data information.

[0011] Preferably, the method further includes delivering the requested data between the requester's data space and the target data space through off-chain data transmission based on the requested data information.

[0012] Based on another aspect of the present invention, the present invention provides a trusted data space secure interaction system, the system comprising: An initial unit is used to generate a key pair and a key fragment divided by the master key for each initial data space through the regulator. The key pair includes a public key and a private key. The regulator then sends the public key and key fragment of the data space to the corresponding data space management system. The publishing unit is used to save the key fragments, public keys, and basic information of the corresponding data space through the data space management system, and to publish the key fragments, public keys, and basic information of the data space to the blockchain smart contract. The request unit is used to send a data request by calling the blockchain data request contract in the blockchain smart contract when a requesting data space needs data from a target data space. The data request includes the public key of the target data space and the requested data information. The first review unit is used to review the compliance of the data application request when the data space management system of the target data space detects the data application request of the blockchain data request contract. When the data application process passes the compliance review, the unit encrypts the key fragment with the private key corresponding to the public key of the target data space and writes the encrypted key fragment into the blockchain data request contract. The second review unit is used to conduct a complete review of the key fragments of the target space obtained through the blockchain data request contract. When the key fragments of the target space are collected completely, a request success event is thrown. The third auditing unit is used to audit the master key recovered from the key fragment when the regulator detects a successful request event of the blockchain data request contract. The data delivery unit is used to deliver the requested data between the requester's data space and the target data space based on the requested data information when the master key recovered from the key fragment passes the audit.

[0013] Preferably, the system further includes a new addition unit for generating new key fragments for the newly added data space by the regulator: By constructing a new polynomial f`(x) satisfying f`(0) = s, such that f`(1) = f`(2) = ... = f`(n) = s, the key fragment si = f`(i) of the newly added data space is calculated by randomly selecting t`-1 = 1 additional points; where s is the master key, f`(0) ... f`(n) are the key fragments of the i-th member; t` is the number of key fragments involved in the synthesis; i is the i-th key fragment; The regulator generates a key pair for the newly added data space and sends the public key and key fragment to the data space management system corresponding to the newly added data space.

[0014] Preferably, it also includes a calling unit for requesting a logging contract via blockchain data, the logging contract being used for: When the blockchain data request contract sends a data request, the blockchain data request contract calls the log recording contract in the blockchain smart contract, and the status recorded by the log recording contract is marked as "request initiated"; Once the integrity of the key fragment and the master key recovered from the key fragment have both passed the verification, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "verification passed"; Once the requested data is delivered between the requester's data space and the target data space, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "completed".

[0015] Preferably, the third auditing unit is used to audit the master key recovered from the key fragment when the regulator detects a successful request event of the blockchain data request contract, and is also used to: When the regulator detects a successful request event from the blockchain data request contract, it decrypts the key fragment using the private key of the target data space and verifies the decrypted key fragment. When the master key composed of the decrypted key fragments passes the verification, the request data delivery between the requester's data space and the target data space is completed based on the request data information.

[0016] Preferably, the data delivery unit is further configured to deliver the requested data between the requester's data space and the target data space via off-chain data transmission based on the requested data information.

[0017] This invention provides a secure interaction method and system for trusted data spaces. The method includes: a regulator generating a key pair and key fragments divided by a master key for each initial data space; the key pair including a public key and a private key; the regulator sending the public key and key fragments of the data space to the corresponding data space management system; the data space management system storing the key fragments, public key, and basic information of the corresponding data space, and publishing these information to a blockchain smart contract; when a requesting data space needs data from a target data space, the requesting data space sends a data request by calling a blockchain data request contract within the blockchain smart contract, the data request including the public key of the target data space and the requested data. Information; When the target data space's data space management system detects a data request request from a blockchain data request contract, it conducts a compliance review of the request. If the data request passes the compliance review, it encrypts a key fragment using the private key corresponding to the public key of the target data space and writes the encrypted key fragment into the blockchain data request contract. The blockchain data request contract then performs a complete post-review of the obtained key fragment from the target space. Once the key fragment from the target space is fully collected, a request success event is emitted. When the regulator detects a successful request event from the blockchain data request contract, it reviews the master key recovered from the key fragment. When the master key recovered from the key fragment passes the review, the requested data is delivered between the requesting data space and the target data space based on the requested data information. This invention provides a secure and reliable data space interaction method and system. It uses blockchain as the medium for information interaction between data spaces, leveraging its distributed deployment and immutability to provide functions such as interaction record storage and traceability. Smart contracts deployed in the blockchain enable message publishing and subscription functions. The verifiable key sharing technology of this invention provides scalable permission management for interactions between multiple data spaces. Attached Figure Description

[0018] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures: Figure 1 This is a flowchart of a trusted data space security interaction method according to a preferred embodiment of the present invention; Figure 2 This is a schematic diagram of the system architecture according to a preferred embodiment of the present invention; Figure 3 A flowchart illustrating the regulator's key initialization process according to a preferred embodiment of the present invention; Figure 4 A flowchart illustrating the process of creating a key for the newly added space by the regulator according to a preferred embodiment of the present invention; Figure 5A flowchart illustrating the initiation of a cross-space data request according to a preferred embodiment of the present invention; Figure 6 This is a flowchart illustrating the target space review request process according to a preferred embodiment of the present invention. Figure 7 A flowchart illustrating the supervisor's key verification process according to a preferred embodiment of the present invention; Figure 8 A flowchart illustrating the process of modifying the request status after the requester obtains data, according to a preferred embodiment of the present invention; and Figure 9 This is a system architecture diagram of a trusted data space security interaction method according to a preferred embodiment of the present invention. Detailed Implementation

[0019] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0020] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0021] Figure 1 This is a flowchart of a trusted data space security interaction method according to a preferred embodiment of the present invention; The purpose of this invention is to provide a secure and reliable data space interaction system. It uses blockchain as the medium for information exchange between data spaces, leveraging its distributed deployment and immutability to provide functions such as interaction record storage and traceability. Message publishing and subscription functions are implemented through smart contracts deployed in the blockchain. Verifiable key sharing technology (PedersenVSS) provides scalable permission management for interactions between multiple data spaces.

[0022] This invention uses an underlying blockchain system, and each data space manager and regulator needs to deploy a node to connect to the chain.

[0023] This invention establishes a management system responsible for connecting the data space and blockchain nodes, with each role performing different functions. The data space manager is responsible for reading data from the data space and writing it to the blockchain, while the regulator is responsible for managing users and monitoring processes. The system architecture is as follows:Figure 2 As shown.

[0024] like Figure 1 As shown, the present invention provides a trusted data space secure interaction method, the method comprising: Step 101: The regulator generates a key pair and a key fragment divided by the master key for each initial data space. The key pair includes a public key and a private key. The regulator then sends the public key and key fragment of the data space to the corresponding data space management system. Preferably, the method further includes generating new key fragments for the newly added data space by the regulator: By constructing a new polynomial f`(x) satisfying f`(0) = s, such that f`(1) = f`(2) = ... = f`(n) = s, the key fragment si = f`(i) of the newly added data space is calculated by randomly selecting t`-1 = 1 additional points; where s is the master key, f`(0) ... f`(n) are the key fragments of the i-th member; t` is the number of key fragments involved in the synthesis; i is the i-th key fragment; The regulator generates a key pair for the newly added data space and sends the public key and key fragment to the data space management system corresponding to the newly added data space.

[0025] The regulator of this invention performs the following operations in the management system based on the initial number of data space accesses, n: selects a secret s and a random blinding factor r, generates n shards s1=s2=...=sn=s, and constructs Pedersen commitments. Simultaneously, a public-private key pair PkiSki is generated for each data space. The system stores the key fragment ki according to the corresponding data space and sends the key fragment ki and the public key pki to the management system of the corresponding data space through a secure off-chain channel. The process is as follows: Figure 3 As shown. When a new data space provider wants to join, it applies for a new key fragment from the regulator through the management system. Since the PedersenVSS key sharing scheme can dynamically increase the number of fragments or threshold values ​​without changing the master key K, the regulator only needs to generate a new key fragment for the new member, and it will not affect the use of other key fragments. The specific operation is as follows: Construct a new polynomial f`(x) that satisfies f`(0)=s (key remains unchanged), f`(1)=f`(2)=...=f`(n)=s (old key fragment compatibility), randomly select t` (number of target spaces involved in the request)-1=1 extra points to calculate the new fragment si=f`(i), calculate the new Pedersen commitment, and the overall business process is as follows. Figure 4 As shown.

[0026] Step 102: Save the key fragment, public key, and basic information of the corresponding data space through the data space management system, and publish the key fragment, public key, and basic information of the data space to the blockchain smart contract; The data space management mechanism of this invention publishes the PKI (Public Key Infrastructure) pushed by the regulatory authority's management system, along with relevant information about the space (such as space introduction, data catalog, etc.), to an on-chain smart contract via blockchain nodes. When a space needs data from one or more other spaces, it needs to invoke the Data Request Contract (DRC) to initiate a data request process. This request includes the target space's public key, the data catalog ID, and relevant information about the request (the requester's qualifications, the purpose of the requested data, etc.). The DRC then invokes the Log Recording Contract (LRC) to create a new request record, with the status marked as "Request Initiated." The process is as follows... Figure 5 As shown.

[0027] Step 103: When a requesting data space needs data from a target data space, the requesting data space sends a data request by calling the blockchain data request contract in the blockchain smart contract. The data request includes the public key of the target data space and the requested data information. Step 104: When the target data space's data space management system detects a data request request from the blockchain data request contract, it conducts a compliance review of the data request request through the data space management system. When the data request process passes the compliance review, it encrypts the key fragment using the private key corresponding to the public key of the target data space and writes the encrypted key fragment into the blockchain data request contract. After the target data space of this invention receives a data request, it reviews it in the management system. Upon successful review, it encrypts its key fragment ki using its private key Ski and writes it as a response into the drc. After a specified block time, the drc checks whether it has collected all key fragments sent by the target spaces in this request. If all are collected, a success event is thrown; otherwise, a failure event is thrown. The process is as follows: Figure 6 As shown.

[0028] Step 105: Completely verify the key fragments of the target space obtained through the blockchain data request contract. Once the key fragments of the target space are completely collected, a request success event is emitted. Step 106: When the regulator detects a successful request event from the blockchain data request contract, it reviews the master key recovered from the key fragment. Step 107: When the master key recovered from the key fragment passes the verification, the requested data is delivered to the requester's data space and the target data space based on the requested data information.

[0029] Preferably, it also includes calling a logging contract via a blockchain data request contract, the logging contract being used for: After the blockchain data request contract sends a data request, it calls the log recording contract in the blockchain smart contract and marks the status as "request initiated" through the log recording contract. Once the integrity of the key fragment and the master key recovered from the key fragment have both passed the verification, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "verification passed"; Once the requested data is delivered between the requester's data space and the target data space, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "completed".

[0030] Preferably, when the regulator detects a successful request event from the blockchain data request contract, it audits the master key recovered from the key fragment, including: When the regulator detects a successful request event from a blockchain data request contract, it decrypts the key fragment using the private key of the target data space and verifies the decrypted key fragment. When the master key composed of the decrypted key fragments passes the verification, the requested data is delivered to the requester's data space and the target data space based on the requested data information.

[0031] Preferably, it also includes delivering the requested data between the requester's data space and the target data space through off-chain data transmission based on the requested data information.

[0032] After the regulatory management system of this invention detects a successful event emitted by the DRC, it decrypts the key fragment using the private key 'ski' of the corresponding space and attempts to recover the master key. The verification result is written to the corresponding request record in the DRC to record the audit result. The DRC calls the LRC to record the request status as "audit approved" or "audit failed". Once the data space requester and the target data space detect the regulatory approval event, they determine that the request is compliant and can choose their own data transmission method through off-chain secure channels. The process is as follows... Figure 7 As shown. After receiving the data, the requesting party calls the DRC to record the time the data was received. After receiving all the data, the DRC calls the LRC to record the request status as "completed". The process is as follows. Figure 8 As shown. This concludes a complete data space interaction process.

[0033] This invention uses PedersenVSS key sharing technology to achieve flexible permission management. It can select any number of spatial entities to participate in interactive activities according to business needs, and provides scalable automated permission verification for the entire multi-space interaction.

[0034] This invention uses blockchain technology as a distributed storage system to record the entire lifecycle of multi-space interactions, while also enabling automated message push during the interaction process.

[0035] This invention enables access control during spatial interaction through verifiable key sharing technology, allowing for dynamic selection of the number of participants based on business needs.

[0036] The multi-space interaction process of this invention automatically verifies the encrypted key fragments sent after approval by all target spaces, without requiring trusted human intervention.

[0037] This invention constructs a multi-space interaction system message framework using blockchain and smart contract technologies, and keeps operation records, retaining a full lifecycle record of a cross-space request, which facilitates auditing of the interaction process by regulatory teams.

[0038] Figure 9 This is a structural diagram of a trusted data space security interaction system according to a preferred embodiment of the present invention.

[0039] like Figure 9 As shown, the present invention provides a trusted data space secure interaction system, the system comprising: The initial unit 901 is used by the regulator to generate a key pair and a key fragment divided by the master key for each initial data space. The key pair includes a public key and a private key. The regulator then sends the public key and key fragment of the data space to the corresponding data space management system. The publishing unit 902 is used to save the key fragments, public keys, and basic information of the corresponding data space through the data space management system, and to publish the key fragments, public keys, and basic information of the data space to the blockchain smart contract. The request unit 903 is used to send a data request by calling the blockchain data request contract in the blockchain smart contract when a requester's data space needs the data request of the target data space. The data request includes the public key of the target data space and the requested data information. The first review unit 904 is used to conduct compliance review of the data application request through the data space management system when the data space management system of the target data space detects the data application request of the blockchain data request contract. When the data application process passes the compliance review, the key fragment is encrypted with the private key corresponding to the public key of the target data space, and the encrypted key fragment is written into the blockchain data request contract. The second audit unit 905 is used to perform a complete audit of the key fragments of the target space obtained through the blockchain data request contract. When the key fragments of the target space are collected completely, a request success event is thrown. The third audit unit 906 is used to audit the master key recovered from the key fragment when the regulator detects a successful request event of the blockchain data request contract. The data delivery unit 907 is used to deliver the requested data to the requester's data space and the target data space based on the requested data information when the master key recovered from the key fragment passes the audit.

[0040] Preferably, the system further includes a new unit for generating new key fragments for the newly added data space by the regulator: By constructing a new polynomial f`(x) satisfying f`(0) = s, such that f`(1) = f`(2) = ... = f`(n) = s, the key fragment si = f`(i) of the newly added data space is calculated by randomly selecting t`-1 = 1 additional points; where s is the master key, f`(0) ... f`(n) are the key fragments of the i-th member; t` is the number of key fragments involved in the synthesis; i is the i-th key fragment; The regulator generates a key pair for the newly added data space and sends the public key and key fragment to the data space management system corresponding to the newly added data space.

[0041] Preferably, the system further includes a calling unit for requesting a logging contract via blockchain data. The logging contract is used for: After the blockchain data request contract sends a data request, it calls the log recording contract in the blockchain smart contract and marks the status as "request initiated" through the log recording contract. Once the integrity of the key fragment and the master key recovered from the key fragment have both passed the verification, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "verification passed"; Once the requested data is delivered between the requester's data space and the target data space, the blockchain data request contract calls the log recording contract, and the status recorded by the log recording contract is marked as "completed".

[0042] Preferably, the third audit unit 906 is used to audit the master key recovered from the key fragment when the regulator detects a successful request event of the blockchain data request contract, and is also used for: When the regulator detects a successful request event from a blockchain data request contract, it decrypts the key fragment using the private key of the target data space and verifies the decrypted key fragment. When the master key composed of the decrypted key fragments passes the verification, the requested data is delivered to the requester's data space and the target data space based on the requested data information.

[0043] Preferably, the data delivery unit 907 is also used to deliver the requested data between the requester's data space and the target data space through off-chain data transmission based on the requested data information.

[0044] The trusted data space secure interaction system provided by the preferred embodiment of the present invention corresponds to the trusted data space secure interaction method provided by another preferred embodiment of the present invention, and will not be described in detail here.

[0045] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0046] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0047] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0048] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0049] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0050] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0051] The invention has been described with reference to a few embodiments. However, as will be known to those skilled in the art, and as defined in the appended claims, other embodiments besides those disclosed above fall equivalently within the scope of the invention.

[0052] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the art, unless otherwise expressly defined herein. All references to “a / the / the [device, component, etc.]” ​​are openly interpreted as at least one instance of said device, component, etc., unless otherwise expressly stated. The steps of any method disclosed herein need not be performed in the exact order disclosed unless explicitly stated otherwise.

Claims

1. A trusted data space security interaction method, the method comprising: generating, by a supervisor, a key pair and key fragments divided by a master key for each initial data space, the key pair comprising a public key and a private key; sending, by the supervisor, the public key and the key fragments of the data space to a corresponding data space management system; storing, by the data space management system, the key fragments, the public key and data space basic information of the corresponding data space, and publishing the key fragments, the public key and the data space basic information of the data space to a blockchain smart contract; when there is a data request of a requestor data space requiring a data request of a target data space, the requestor data space sends a data application request by calling a blockchain data request contract in the blockchain smart contract, the data application request comprising the public key of the target data space and request data information; when the data space management system of the target data space listens to the data application request of the blockchain data request contract, the data space management system audits the data application request for compliance, and when the data application process passes the compliance audit, the key fragments are encrypted by the private key corresponding to the public key of the target data space, and the encrypted key fragments are written into the blockchain data request contract; the blockchain data request contract audits the obtained key fragments of the target space for completeness, and when the key fragments of the target space are collected completely, a request success event is thrown; when the supervisor listens to the request success event of the blockchain data request contract, the master key recovered from the key fragments is audited; when the master key recovered from the key fragments passes the audit, the request data delivery between the requestor data space and the target data space is completed based on the request data information.

2. The method of claim 1, further comprising generating, by the supervisor, new key fragments for a newly added data space: a new polynomial f`(x) is constructed to satisfy f`(0) = s, so that f`(1) = f`(2) =... = f`(n) = s, and the key fragments si of the newly added data space are calculated by randomly selecting t`-1 = 1 additional points; wherein s is the master key, f`(0)...f`(n) are the key fragment shards of the i-th member; t` is the number of participants in the key fragment synthesis; i is the i-th key fragment; the supervisor generates a key pair for the newly added data space and sends the public key and the key fragments to the data space management system corresponding to the newly added data space.

3. The method of claim 1, further comprising calling a log recording contract by the blockchain data request contract, the log recording contract being used for: after the blockchain data request contract sends a data application request, the blockchain data request contract calls a log recording contract in the blockchain smart contract, and the state recorded by the log recording contract is marked as "initiating a request". When the integrity of the key fragment and the master key recovered by the key fragment are both passed, the blockchain data request contract calls the log recording contract, and the state recorded by the log recording contract is marked as "passed"; When the request data delivery between the requestor data space and the target data space is completed, the blockchain data request contract calls the log recording contract, and the state recorded by the log recording contract is marked as "completed".

4. The method of claim 1, wherein when the supervisor listens to the request success event of the blockchain data request contract, the master key recovered by the key fragment is audited, comprising: When the supervisor listens to the request success event of the blockchain data request contract, the key fragment is decrypted by the private key of the target data space, and the decrypted key fragment is verified; When the master key composed of the decrypted key fragment is passed, the request data delivery between the requestor data space and the target data space is completed based on the request data information.

5. The method of claim 1, further comprising completing the request data delivery between the requestor data space and the target data space based on the request data information through an off-chain data transmission mode.

6. A trusted data space secure interaction system, the system comprising: An initial unit for generating a key pair and a key fragment divided by a master key for each initial data space by a supervisor, the key pair comprising a public key and a private key; Sending the public key and the key fragment of the data space to the corresponding data space management system by the supervisor; A publishing unit for saving the key fragment, the public key and the data space basic information of the corresponding data space by the data space management system, and publishing the key fragment, the public key and the data space basic information of the data space to a blockchain smart contract; A request unit for sending a data application request by the requestor data space calling a blockchain data request contract in the blockchain smart contract when there is a data request of the requestor data space requiring data request of the target data space, the data application request comprising the public key of the target data space and request data information; A first auditing unit for performing compliance audit on the data application request by the data space management system of the target data space when the data application request of the blockchain data request contract is listened to by the data space management system, encrypting the key fragment by the private key corresponding to the public key of the target data space when the data application process passes the compliance audit, and writing the encrypted key fragment into the blockchain data request contract; A second auditing unit for performing completeness audit on the obtained key fragment of the target space by the blockchain data request contract, and throwing a request success event when the key fragment of the target space is collected completely; A third auditing unit for auditing the master key recovered by the key fragment when the supervisor listens to the request success event of the blockchain data request contract. a data delivery unit configured to complete the requested data delivery between the requester data space and the target data space based on the request data information when the key fragment recovered master key passes the audit.

7. The system of claim 6, further comprising an adding unit configured to generate a new key fragment for an added data space by the supervisor: By constructing a new polynomial f`(x) satisfying f`(0) = s, such that f`(1) = f`(2) =... = f`(n) = s, calculate the key fragment si = f`(i) of the added data space by randomly selecting t`-1 = 1 additional points; wherein s is the master key, f`(0)...f`(n) is the key fragment shard of the i-th member; t` is the number of participants in the key fragment synthesis; i is the i-th key fragment; generate a key pair for the added data space by the supervisor, and send the public key and the key fragment to the data space management system corresponding to the added data space.

8. The system of claim 6, further comprising a calling unit configured to call a log recording contract by a blockchain data request contract, wherein the log recording contract is configured to: When the blockchain data request contract sends a data application request, the blockchain data request contract calls a log recording contract in the blockchain smart contract, and the state recorded by the log recording contract is marked as "initiating request"; When the integrity of the key fragment and the key fragment recovered master key pass the audit, the blockchain data request contract calls the log recording contract, and the state recorded by the log recording contract is marked as "audit passed"; When the requested data delivery between the requester data space and the target data space is completed, the blockchain data request contract calls the log recording contract, and the state recorded by the log recording contract is marked as "completed".

9. The system of claim 6, wherein the third audit unit is configured to audit the key fragment recovered master key when the supervisor listens to the request success event of the blockchain data request contract, and is further configured to: When the supervisor listens to the request success event of the blockchain data request contract, decrypt the key fragment by the private key of the target data space, and verify the decrypted key fragment; When the decrypted key fragment composed of the master key passes the audit, complete the requested data delivery between the requester data space and the target data space based on the request data information.

10. The system of claim 6, wherein the data delivery unit is further configured to complete the requested data delivery between the requester data space and the target data space based on the request data information by an off-chain data transmission method.

Images