Data management method and device, electronic equipment, storage medium and program product
By formalizing access control policies into logical constraints and utilizing zero-knowledge proof technology, data capsules and zero-knowledge proofs are generated, solving the data leakage problem in existing technologies and improving data security and privacy protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA UNITED NETWORK COMM GRP CO LTD
- Filing Date
- 2025-12-16
- Publication Date
- 2026-04-10
AI Technical Summary
Existing data management strategies store or transmit data in plaintext, leading to data leaks and reducing data security.
Access control policies are formalized into logical constraints, generating a set of commitments. Zero-knowledge proofs are used to achieve the confidentiality and cross-domain interoperability of policy verification, and data security is ensured through data capsules and zero-knowledge proofs.
It improves data security, prevents policy leaks, and achieves privacy protection and cross-domain interoperability.
Smart Images
Figure CN121841691A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of data processing technology, and in particular to a data management method, apparatus, electronic device, storage medium, and program product. Background Technology
[0002] With the accelerated development of data elementization and cross-domain sharing, trust issues between data providers and data consumers are becoming increasingly prominent. For example, in medical data sharing scenarios, hospitals need to authorize third-party research institutions to analyze patient data, but they must ensure that researchers use the data only under specific conditions and do not disclose the data access policy itself.
[0003] In the existing technology, in order to avoid data leakage, common data management methods mainly include: access control lists, role-based access control, and attribute-based access control.
[0004] However, existing data management strategies are stored or transmitted in plaintext, and the verifier needs to directly compare the request parameters with the strategy content during the verification process. This leads to data leakage issues and reduced data security. Summary of the Invention
[0005] This application provides a data management method, apparatus, electronic device, storage medium, and program product to address the problem of reduced data security in the prior art.
[0006] In a first aspect, embodiments of this application provide a data management method applied to a data provider client, comprising:
[0007] Receive data usage requests sent by the data consumer client;
[0008] Based on the data, the original data is obtained using the request, and an access policy is added based on the original data to generate a commitment set;
[0009] The set of commitments is added to the metadata to obtain a data capsule;
[0010] The data capsule is sent to the data consumer client, enabling the consumer client to generate a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct the verifier client to verify the zero-knowledge proof and obtain a decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
[0011] In one possible implementation, the step of adding an access policy based on the original data and generating a commitment set includes: encrypting the original data to generate encrypted data; creating an access policy based on the encrypted data; formalizing the access policy into logical constraints; and generating a commitment set based on the logical constraints.
[0012] In one possible implementation, generating the commitment set based on the logical constraints includes: calculating commitment values using a typical commitment algorithm based on the constraint parameters in the logical constraints; and combining the commitment values to generate the commitment set.
[0013] Secondly, embodiments of this application provide a data management method applied to a data consumer client, comprising:
[0014] A data usage request is sent to the data provider client so that the data provider client can obtain the original data according to the data usage request, add an access policy according to the original data, and generate a commitment set. The commitment set is used to instruct the data provider client to add the commitment set to the metadata to obtain a data capsule.
[0015] Receive the data capsule sent by the data provider;
[0016] Zero-knowledge proofs are generated based on the data capsule;
[0017] The zero-knowledge proof is sent to the verification client so that the verification client can verify the zero-knowledge proof and obtain the decryption key based on the zero-knowledge proof;
[0018] Receive the decryption key sent by the verification client;
[0019] The data capsule is decrypted using the data decryption key to access the data.
[0020] In one possible implementation, generating a zero-knowledge proof based on the data capsule includes: inputting the commitment set and constraint parameters in the data capsule into a zero-knowledge proof framework to obtain a proof statement; compiling the logical constraints in the data capsule to obtain an arithmetic circuit; and running a proof algorithm based on the arithmetic circuit and the proof statement to generate a zero-knowledge proof.
[0021] In one possible implementation, the step of running the proof algorithm based on the arithmetic circuit and the proof statement to generate a zero-knowledge proof includes: executing the arithmetic circuit in parallel using a hardware accelerator to generate a running result; optimizing the read / write latency of the running result using a caching mechanism; and generating a zero-knowledge proof based on the running result and the proof statement.
[0022] Thirdly, embodiments of this application provide a data management device applied to a data provider client, comprising:
[0023] The receiving module is used to receive data usage requests sent by the data consumer client;
[0024] The acquisition module is used to obtain the original data based on the data usage request, add access policies based on the original data, and generate a commitment set;
[0025] An add module is used to add the set of commitments to the metadata to obtain a data capsule;
[0026] A sending module is configured to send the data capsule to a data consumer client, so that the consumer client generates a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct a verification client to verify the zero-knowledge proof and obtain a decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
[0027] Fourthly, embodiments of this application provide an electronic device, including: a memory and a processor;
[0028] The memory stores computer-executed instructions;
[0029] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first and / or second aspects as described above, as well as various possible implementations of the first and / or second aspects.
[0030] Fifthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or the second aspect as described above, and various possible implementations of the first aspect and / or the second aspect.
[0031] Sixthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first and / or second aspects as described above, as well as various possible implementations of the first and / or second aspects.
[0032] The data management method, apparatus, electronic device, storage medium, and program product provided in this application obtain the original data through a data usage request sent by the consumer client, add access policies based on the original data, generate a commitment set to avoid policy leakage, add the commitment set to the metadata to generate a data capsule, the consumer client generates a zero-knowledge proof based on the data capsule, and the verifying client determines whether to send the decryption key to the consumer client by verifying the zero-knowledge proof. This eliminates the need to directly obtain information from the consumer client. The consumer client decrypts the data capsule based on the decryption key and uses the data, thereby improving data security. Attached Figure Description
[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0034] Figure 1 This is a schematic diagram illustrating an application scenario of the data management method provided in the embodiments of this application;
[0035] Figure 2 Flowchart of the data management method provided in this application Figure 1 ;
[0036] Figure 3 Flowchart of the data management method provided in this application Figure 2 ;
[0037] Figure 4 An interactive diagram illustrating the data management method provided in this application;
[0038] Figure 5 A schematic diagram of the data management device provided in this application;
[0039] Figure 6 A schematic diagram of the structure of the electronic device provided in this application.
[0040] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0041] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0042] First, let's explain the terms used in this application:
[0043] Data capsule: A data capsule is a data container that encrypts and encapsulates data, along with access policies, encryption keys, and other information. It converts the original data into encrypted form for storage and transmission, and only users who meet the access policy can decrypt and obtain the data, ensuring data security and controllability.
[0044] Zero-knowledge proof: Zero-knowledge proof technology is a cryptographic protocol whose core objective is to allow the prover to prove to the verifier that they do indeed possess the information without revealing any critical secret information to the verifier.
[0045] With the accelerated development of data elementization and cross-domain sharing, trust issues between data providers and data consumers are becoming increasingly prominent. For example, in medical data sharing scenarios, hospitals need to authorize third-party research institutions to analyze patient data, but must ensure that researchers use the data only under specific conditions and do not disclose the data access policy itself. In existing technologies, common data management methods to avoid data leakage mainly include access control lists, role-based access control, and attribute-based access control. However, existing data management policies are stored or transmitted in plaintext, and the verification party needs to directly compare request parameters with policy content during the verification process. This existing data management strategy is prone to data leakage, leading to reduced data security.
[0046] To address the aforementioned technical problems, this application proposes the following technical concept: The inventors considered transforming access control policies into verifiable mathematical constraints and utilizing zero-knowledge proof technology to achieve policy verification's confidentiality and cross-domain interoperability. Specifically, the data provider client formalizes the policy into logical constraints and generates a policy commitment value; the data consumer client generates a zero-knowledge proof based on its own credentials to prove that its request satisfies the policy constraints without disclosing the policy content or request details; the verifying client only needs to verify the zero-knowledge proof to complete authorization, thereby achieving policy hiding, privacy protection, and cross-domain interoperability.
[0047] Figure 1 This is a schematic diagram illustrating an application scenario of the data management method provided in the embodiments of this application, such as... Figure 1 As shown, this application scenario includes a data provider client 101, a data consumer client 102, and a verification client 103.
[0048] Specifically, the data provider client 101 receives a data usage request from the data consumer client 102, obtains the original data, adds an access policy based on the original data, generates a commitment set, adds the commitment set to the metadata, and obtains a data capsule. The data provider client 101 sends the data capsule to the data consumer client 102. The data consumer client 102 generates a zero-knowledge proof based on the data capsule and sends the zero-knowledge proof to the verifier client 103. The verifier client 103 verifies the zero-knowledge proof, obtains the decryption key based on the zero-knowledge proof, and sends the decryption key to the consumer client 102. The consumer client 102 decrypts the data capsule based on the decryption key and uses the data.
[0049] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.
[0050] Figure 2 Flowchart of the data management method provided in this application Figure 1 ,like Figure 2 As shown, applied to the data provider client, the method includes:
[0051] S201: Receive data usage request sent by the data consumer client.
[0052] In this embodiment, the data usage request is formatted as a structured data usage request message.
[0053] Specifically, when the data provider's client receives a data usage request from the data consumer, the data provider's client verifies the data consumer's identity information. If the verification is successful, the client obtains the metadata.
[0054] In this embodiment, the identity information of the data consumer includes, but is not limited to, session identifier, data resource identifier requested for access, and temporary public key certificate of the consumer.
[0055] S202: Obtain the original data based on the data usage request, add access policies based on the original data, and generate a commitment set.
[0056] Specifically, the data provider client encrypts the original data, creates an access policy based on the encrypted data, formalizes the access policy into logical constraints, and generates a set of commitments based on the logical constraints.
[0057] S203: Add the set of commitments to the metadata to obtain the data capsule.
[0058] Specifically, the data capsule adds the commitment set to the metadata, serializes the updated metadata together with the original data, calculates the checksum of the data capsule, and obtains the data capsule.
[0059] S204: Send a data capsule to the data consumer client so that the consumer client can generate a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct the verifier client to verify the zero-knowledge proof and obtain the decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
[0060] Specifically, the consumer client sends a zero-knowledge proof to the verifier client. The verifier client verifies the zero-knowledge proof. After successful verification, it obtains the decryption key and sends it to the consumer client. The consumer client uses the decryption key to decrypt the encrypted data in the data capsule and uses the data.
[0061] As can be seen from the above embodiments, the original data is obtained through a data usage request sent by the consumer client. An access policy is added based on the original data, a commitment set is generated to avoid policy leakage, and the commitment set is added to the metadata to generate a data capsule. The consumer client generates a zero-knowledge proof based on the data capsule, and the verifier client determines whether to send the decryption key to the consumer client by verifying the zero-knowledge proof. There is no need to directly obtain information from the consumer client. The consumer client decrypts the data capsule based on the decryption key and uses the data, which improves data security.
[0062] In one embodiment of this application, step S202 includes:
[0063] S2021: Encrypt the original data to generate encrypted data.
[0064] Specifically, the encryption engine uses a symmetric encryption algorithm and a randomly generated data encryption key to encrypt the original data, generating encrypted data in ciphertext form and a corresponding authentication tag.
[0065] S2022: Create access policies based on encrypted data.
[0066] Specifically, the policy engine creates access policies for encrypted data based on policy creation rules.
[0067] The content recorded in the policy creation rules includes, but is not limited to, data type, data body, and data declaration.
[0068] S2023: Formalize the access policy into logical constraints.
[0069] In this embodiment, logical constraints include, but are not limited to, role constraints, access count constraints, and data range constraints.
[0070] S2024: Generate a set of commitments based on logical constraints.
[0071] Specifically, a commitment value is calculated for each constraint parameter using a typical commitment algorithm, and the calculated commitment values are integrated to generate a commitment set.
[0072] As can be seen from the above embodiments, by encrypting the original data, creating an access policy based on the encrypted data, further formalizing the access policy into logical constraints, and generating a set of commitments based on the logical constraints, the comprehensiveness of the generated commitment values is ensured.
[0073] In one embodiment of this application, step S2024 includes:
[0074] S301: Calculate the commitment value using a typical commitment algorithm based on the constraint parameters in the logical constraints.
[0075] In this embodiment, the formula for calculating the commitment value of the constraint parameter x is:
[0076]
[0077] In the formula, Indicates the commitment value; and For public generators; Represents a random number; For modulo operation; It is a prime number.
[0078] S302: Combine the commitment values to generate a commitment set.
[0079] Specifically, the individual commitment values are packaged into a sequence number according to a set order to generate an array structure of commitment sets.
[0080] As can be seen from the above embodiments, by using a typical commitment algorithm to calculate the commitment value and combining the commitment values to generate a commitment set, the security of the generated commitment value is improved.
[0081] Figure 3 Flowchart of the data management method provided in this application Figure 2 ,like Figure 3 As shown, applied to the data consumer client, the method includes:
[0082] S401: Send a data usage request to the data provider client so that the data provider client can obtain the original data according to the data usage request, add access policies according to the original data, generate a commitment set, and use the commitment set to instruct the data provider client to add the commitment set to the metadata to obtain the data capsule.
[0083] Specifically, the consumer client calls the API interface to send a data usage request to the data provider client. The data provider client obtains the original data based on the data usage request, adds access policies based on the original data, generates a commitment set, adds the commitment set to the metadata, and obtains the data capsule.
[0084] S402: Receive data capsule sent by the data provider.
[0085] Specifically, the consumer client receives an HTTP response from the data provider client, parses out the complete data capsule, stores it in a secure temporary storage area locally, and verifies its integrity signature.
[0086] S403: Generate zero-knowledge proofs based on data capsules.
[0087] Specifically, the commitment set and constraint parameters in the data capsule are input into the zero-knowledge proof framework to obtain the proof statement. The logical constraints in the data capsule are compiled through the target zero-knowledge proof framework to obtain the arithmetic circuit. The proof algorithm is then run to generate the zero-knowledge proof.
[0088] S404: Send a zero-knowledge proof to the verifier client so that the verifier client can verify the zero-knowledge proof and obtain the decryption key based on the zero-knowledge proof.
[0089] Specifically, the verification client obtains the zero-knowledge proof, takes the commitment value, the zero-knowledge proof object, and the public verification parameters as input, runs the verification and outputs the verification result. If the verification result is successful, the decryption key is obtained.
[0090] Specifically, if verification fails, a request is made to prohibit the data consumer client from accessing the data in the data capsule.
[0091] S405: Receive the decryption key sent by the authenticator client.
[0092] Specifically, the consumer client monitors the verifier client's response, and when it receives a response from the verifier client, it loads a data capsule.
[0093] S406: Decrypt the data capsule using the data decryption key to use the data.
[0094] Specifically, the consumer client invokes the data capsule, uses the decryption key to decrypt the encrypted data in the data capsule, and after successful decryption, uses the original plaintext data.
[0095] As can be seen from the above embodiments, the original data is obtained through a data usage request sent by the consumer client. An access policy is added based on the original data, a commitment set is generated to avoid policy leakage, and the commitment set is added to the metadata to generate a data capsule. The consumer client generates a zero-knowledge proof based on the data capsule, and the verifier client determines whether to send the decryption key to the consumer client by verifying the zero-knowledge proof. There is no need to directly obtain information from the consumer client. The consumer client decrypts the data capsule based on the decryption key and uses the data, which improves data security.
[0096] In one embodiment of this application, step S403 includes:
[0097] S4031: Input the set of commitments and constraint parameters in the data capsule into the zero-knowledge proof framework to obtain the proof statement.
[0098] Specifically, the data consumer client obtains the data consumer's credentials, inputs the credentials into the zero-knowledge proof framework, and obtains the proof statement.
[0099] In this embodiment, the credential information includes, but is not limited to, the ID of the data consumer client, the number of historical accesses, and the set of request fields.
[0100] In this embodiment, the proof statement is a statement generated by applying the credential information according to the zero-knowledge proof framework.
[0101] S4032: The logical constraints in the data capsule are compiled using the target zero-knowledge proof framework to obtain the arithmetic circuit.
[0102] Specifically, the data consumer uses zero-knowledge proofs or zero-knowledge proof frameworks to compile logical constraints into arithmetic circuits.
[0103] S4033: Run the proof algorithm based on the arithmetic circuit and proof statement to generate a zero-knowledge proof.
[0104] Specifically, arithmetic circuits are executed in parallel using hardware accelerators to generate results, and the read / write latency of these results is optimized using a caching mechanism to generate zero-knowledge proofs.
[0105] As can be seen from the above embodiments, the logical constraints are compiled using the zero-knowledge proof framework to obtain an arithmetic circuit. The proof algorithm is then run through the arithmetic circuit to generate a zero-knowledge proof, ensuring the computational efficiency and security of the policy verification process.
[0106] In one embodiment of this application, step S4033 includes:
[0107] S501: Executes arithmetic circuits in parallel using a hardware accelerator to generate results.
[0108] Specifically, the hardware accelerator decomposes the computational task represented by the arithmetic circuit into subtasks that can be executed in parallel, schedules them to be executed in parallel on multiple computing cores of the accelerator, and generates the results.
[0109] S502: Optimizes the read / write latency of the execution results through a caching mechanism, and generates zero-knowledge proofs based on the execution results and proof statements.
[0110] Specifically, the memory management module uses a caching mechanism to optimize the storage of accessed intermediate data, preloads the intermediate data into the cache, reduces the read and write latency of memory access, and the proof generator integrates all the accelerated and cached execution results to generate zero-knowledge proofs.
[0111] As can be seen from the above embodiments, the arithmetic circuit is split into multiple sub-circuits and executed in parallel by the hardware accelerator, and the reading and writing latency of the running results is optimized by the caching mechanism to avoid the latency of repeated memory reading and writing.
[0112] Figure 4 An interactive diagram illustrating the data management method provided in this application, such as... Figure 4 As shown, the execution process of the data management method includes the following steps:
[0113] S601: The data consumer client generates a data usage request and sends the data usage request to the data provider client.
[0114] S602: The data provider client obtains the original data, adds access policies based on the original data, and generates a commitment set.
[0115] S603: The data provider client adds the commitment set to the metadata, obtains the data capsule, and sends the data capsule to the data consumer client.
[0116] S604: The consumer client generates a zero-knowledge proof based on the data capsule and sends the zero-knowledge proof to the verifier client.
[0117] S605: The verifier client verifies the zero-knowledge proof, obtains the decryption key based on the zero-knowledge proof, and sends the decryption key to the consumer client.
[0118] S606: The consumer client decrypts the data capsule using the decryption key and uses the data.
[0119] Figure 5 A schematic diagram of the data management device provided in this application is shown below. Figure 5 As shown, the data management device 50 provided in this embodiment includes: a receiving module 501, an acquiring module 502, an adding module 503, and a sending module 504.
[0120] The receiving module 501 is used to receive data usage requests sent by the data consumer client.
[0121] The acquisition module 502 is used to obtain the original data based on the data usage request, add access policies based on the original data, and generate a commitment set.
[0122] Add module 503 to add the commitment set to the metadata to obtain the data capsule.
[0123] The sending module 504 is used to send a data capsule to the data consumer client, so that the consumer client can generate a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct the verifying client to verify the zero-knowledge proof and obtain the decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
[0124] In one embodiment of this application, the acquisition module 502 includes:
[0125] The first generation unit is used to encrypt the original data and generate encrypted data.
[0126] Create a unit to create access policies based on encrypted data.
[0127] Formal units are used to formalize access policies into logical constraints.
[0128] The second generation unit is used to generate a set of commitments based on logical constraints.
[0129] In one embodiment of this application, the second generating unit includes:
[0130] The computational subunit is used to calculate the commitment value using a typical commitment algorithm based on the constraint parameters in the logical constraints.
[0131] The generation sub-unit is used to combine commitment values to generate a commitment set.
[0132] The data management device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.
[0133] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the electronic device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus.
[0134] In the specific implementation process, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to execute the above-described data management method.
[0135] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.
[0136] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.
[0137] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.
[0138] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.
[0139] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described data management method.
[0140] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the aforementioned data management method.
[0141] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.
[0142] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.
[0143] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.
[0144] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0145] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0146] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0147] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.
[0148] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.
Claims
1. A data management method, characterized in that, Applied to data provider clients, including: Receive data usage requests sent by the data consumer client; Based on the data, the original data is obtained using the request, and an access policy is added based on the original data to generate a commitment set; The set of commitments is added to the metadata to obtain a data capsule; The data capsule is sent to the data consumer client, enabling the consumer client to generate a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct the verifier client to verify the zero-knowledge proof and obtain a decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
2. The method according to claim 1, characterized in that, The step of adding access policies based on the original data and generating a commitment set includes: The original data is encrypted to generate encrypted data; Create an access policy based on the encrypted data; The access strategy is formalized into logical constraints. A set of commitments is generated based on the logical constraints.
3. The method according to claim 2, characterized in that, The step of generating a commitment set based on the logical constraints includes: The commitment value is calculated using a typical commitment algorithm based on the constraint parameters in the logical constraints. The commitment values are combined to generate a commitment set.
4. A data management method, characterized in that, Applied to the data consumer client, including: A data usage request is sent to the data provider client so that the data provider client can obtain the original data according to the data usage request, add an access policy according to the original data, and generate a commitment set. The commitment set is used to instruct the data provider client to add the commitment set to the metadata to obtain a data capsule. Receive the data capsule sent by the data provider; Zero-knowledge proofs are generated based on the data capsule; The zero-knowledge proof is sent to the verification client so that the verification client can verify the zero-knowledge proof and obtain the decryption key based on the zero-knowledge proof; Receive the decryption key sent by the verification client; The data capsule is decrypted using the data decryption key to access the data.
5. The method according to claim 4, characterized in that, The generation of zero-knowledge proofs based on the data capsule includes: The set of commitments and constraint parameters in the data capsule are input into the zero-knowledge proof framework to obtain the proof statement; The logical constraints in the data capsule are compiled to obtain an arithmetic circuit; The proof algorithm is run based on the arithmetic circuit and the proof statement to generate a zero-knowledge proof.
6. The method according to claim 5, characterized in that, The step of running the proof algorithm based on the arithmetic circuit and the proof statement to generate a zero-knowledge proof includes: The arithmetic circuit is executed in parallel using a hardware accelerator to generate the results. The read / write latency of the execution results is optimized through a caching mechanism, and zero-knowledge proofs are generated based on the execution results and proof statements.
7. A data management device, characterized in that, Applied to data provider clients, including: The receiving module is used to receive data usage requests sent by the data consumer client; The acquisition module is used to obtain the original data based on the data usage request, add access policies based on the original data, and generate a commitment set; An add module is used to add the set of commitments to the metadata to obtain a data capsule; A sending module is configured to send the data capsule to a data consumer client, so that the consumer client generates a zero-knowledge proof based on the data capsule. The zero-knowledge proof is used to instruct a verification client to verify the zero-knowledge proof and obtain a decryption key based on the zero-knowledge proof. The decryption key is used to instruct the consumer client to decrypt the data capsule based on the decryption key in order to use the data.
8. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the data management method as described in any one of claims 1 to 3, or the data management method as described in any one of claims 4 to 6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the data management method as described in any one of claims 1 to 3, or the data management method as described in any one of claims 4 to 6.
10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the data management method according to any one of claims 1 to 3, or the data management method according to any one of claims 4 to 6.