An open source data trust data space planning method integrated with privacy computing

Abstract

The present application relates to the technical field of data space, in particular to a kind of open source data trusted data space planning method integrated privacy computing, comprising the following steps: parsing data call request extraction authority matrix row vector generates permission rule and number sequence, corresponding identification is generated by comparing node screening result, arrange ascending sequence and generate section continuous sequence judging adjacent continuous section, matching shared node communication link establishes path connection structure, according to call path organization dispersed data segment executes splicing association and constructs space planning.In the present application, by parsing authority matrix extraction dynamic node screening result, compare ascending sequence and establish continuous section coherent sequence, match bottom communication link and map exclusive path relationship, organize dispersed data splicing and build deep association structure, break static authority and solidified storage fragmentation bondage, reconstruct multi-source fragment node bottom communication dependent association, improve cross-subject network bottom layer sharing circulation efficiency.

Description

Technical Field

[0001] This invention relates to the field of data space technology, and in particular to an open-source, trusted data space planning method that integrates privacy computing. Background Technology

[0002] The field of data space technology refers to the technological system surrounding the collection, aggregation, storage, organization, sharing, and circulation of data resources. It encompasses core aspects such as data warehouse construction, distributed data storage structure design, multi-source heterogeneous data integration mechanisms, data catalog and metadata management, data access control strategies, and cross-entity data exchange and collaboration mechanisms. Through structured organization and unified management of data, it enables the association and collaborative processing between different data sources, forming a data sharing and utilization environment for multiple participants. This involves data node deployment methods, data index structure construction, data exchange interface definition, and data usage rule constraints. Among these, the traditional open-source trusted data space planning method integrating privacy computing involves organizing data from multiple data providers into a pre-defined data format during data space construction, establishing a data index structure based on unified data catalog rules, and segmenting data fields during data exchange. Sensitive fields are numerically split and stored on different nodes. Data retrieval is achieved by combining data fragments between nodes, and the data access scope of different participants is controlled by a pre-defined access permission table, thus realizing the collaborative organization and circulation of data among multiple entities.

[0003] Existing technologies mainly rely on pre-defined formats and unified directories to establish static indexes during the data construction and circulation process. In the exchange stage, simple field segmentation and numerical splitting are used to distribute and store data to independent nodes. In the reading stage, the reading range is rigidly controlled only by basic fragment combinations and static access permission tables. This rigid organizational model severs the underlying communication connections between scattered nodes, making it difficult to dynamically establish continuous segment dependencies and link connections in complex multi-source environments. This results in low efficiency of fragmented data flow and reorganization during cross-entity collaborative processing, which seriously restricts the performance of deep sharing and reliable circulation in a distributed environment. Summary of the Invention

[0004] To achieve the above objectives, the present invention adopts the following technical solution: an open-source data trusted data space planning method integrating privacy computing, comprising the following steps: S1: Obtain the data call request sent by the business terminal device, parse the access subject identifier and target field set, extract the row vector of the permission matrix corresponding to the access subject identifier, perform bitwise logical judgment to establish the field segment permission relationship, and generate the field segment permission rule and field segment number sequence. S2: Based on the field segment permission rules and field segment number sequence, scan the distributed server nodes, obtain the data segment identifier corresponding to the server node, compare the field segment number sequence with the field segment permission rules in the row vector of the permission matrix, establish the correspondence between the segment number and the server node, and generate node filtering results; S3: Arrange the server nodes in the node filtering results, obtain the ascending sequence of segment numbers, determine the difference between adjacent segments and filter continuous segments, establish the continuous relationship of segments, and generate a continuous node sequence of segments. S4: Based on the segment continuous node sequence, match the data space node connection relationship, obtain the communication link structure corresponding to the privacy computing data sharing node set, filter the path of the segment continuous node sequence in the communication link structure and establish the node connection path relationship, map the segment number, and generate the data space call path structure. S5: Based on the data space call path structure, organize the data fragments in the server node, obtain the data fragment set corresponding to the field access interval structure, perform segment sequential splicing calculation and construct the data space structure association relationship, and generate a reliable data space planning scheme.

[0005] As a further aspect of the present invention, the field segment permission rules and field segment number sequence include a fine-grained read / write permission list, a segment interval start and end index, and a target field encryption mask. The node filtering results include the matching server IP address, segment storage physical sector, and node load parameters. The segment continuous node sequence includes a linearly sorted node set, adjacent segment boundary cursors, and a coherent data retrieval queue. The data space call path structure includes a directional encrypted communication tunnel, node hop routing details, and cross-domain data flow to the network. The trusted data space planning scheme includes a multi-party collaborative computing architecture, a data availability-invisibility protection mechanism, and a full data splicing presentation view.

[0006] As a further aspect of the present invention, the field segment permission relationship refers to the access authorization mapping correspondence between the access subject and the target data field segment verified by performing bitwise logical judgment on the row vector of the access subject's permission matrix.

[0007] As a further aspect of the present invention, the field segment permission rules are generated based on permission relationships and guide and constrain the execution criteria for determining and extracting legal data segments in distributed nodes.

[0008] As a further aspect of the present invention, the specific steps of S1 are as follows: S101: Collect data call requests from business devices, parse the data call requests to extract the access subject identifier and target field set, read the preset policy table, match the access subject identifier with the associated primary key attribute, and reorganize the permission parameters by dimension to obtain the permission matrix row vector; S102: Perform bitwise logical operations on the row vectors of the permission matrix, compare the non-zero state of the bits to mark the permission flag, retrieve the segment location index from the policy table, associate the segment location index with the permission flag to construct a mapping structure, and establish the field segment permission correspondence relationship. S103: Call the target field set to divide the data range, extract the data block address offset to mark the segment number, aggregate the number to obtain the segment number set, match the segment number set according to the field segment permission correspondence, and generate field segment permission rules and field segment number sequence.

[0009] As a further aspect of the present invention, the specific steps of S2 are as follows: S201: Call the field segment permission rules and field segment number sequence, scan the distributed server nodes, parse the node feedback data to extract data block tags, compare the permission rule check code to extract matching tags, and obtain the data segment identifier; S202: Based on the data segment identifier and the permission matrix row vector, align the field segment number sequence with the matrix permission flag and perform a bit-by-bit comparison operation to extract the network address of the corresponding node that matches the operation and obtain a candidate node set; S203: Extract network addresses from the candidate node set, call the internal segment index number of the field segment number sequence, concatenate the segment index number with the network address, construct a mapping table topology structure to store the number mapping items, and generate node filtering results.

[0010] As a further aspect of the present invention, the specific steps of S3 are as follows: S301: Call the node filtering results, extract the node network address and segment number parameters, set the segment number parameter as the sorting primary key, perform an ascending sorting and reorganization operation on the mapping records, and generate a segment number ascending node sequence. S302: For the ascending sequence of segment numbers, traverse the mapping records, extract the segment number parameters of adjacent nodes, perform calculations on the subsequent values ​​and the values, extract the difference between the calculated values ​​of the nodes, and generate a sequence of differences between adjacent segments. S303: Call the adjacent segment difference sequence, compare the calculated numerical difference with a preset constant, filter and retain matching node network addresses, perform pointer linking operations on the filtered node addresses, and generate a continuous node sequence of segments.

[0011] As a further aspect of the present invention, the specific steps of S4 are as follows: S401: Call the continuous node sequence of the segment, scan the network connection configuration table inside the preset data space, extract the port handshake parameters between the corresponding nodes, establish data transmission connectivity, and obtain the communication link structure; S402: For the continuous node sequence of the segment and the communication link structure, compare the node address with the link connectivity status parameter, eliminate blocked link nodes, associate the connected nodes with the link direction, and establish the corresponding relationship of node connection path; S403: Call the node connection path correspondence, extract the segment number associated with the connected node, concatenate adjacent segment numbers into access boundary parameters, construct the field access interval structure and merge the path pointing parameters to generate the data space call path structure.

[0012] As a further aspect of the present invention, the specific steps of S5 are as follows: S501: Call the data space call path structure, read the server node storage space according to the path node addressing parameters, extract the continuous byte stream that matches the boundary of the field access interval structure, extract the corresponding payload content of the interval, and generate a data fragment set; S502: Based on the data fragment set, read the segment number identifier at the head of the data fragment, sort it in ascending order using the segment number as the index, perform the first and last memory address concatenation operation on adjacent data fragments, establish a data block connection topology, and generate a data space structure association relationship. S503: Based on the data space structure association relationship, extract the internal data block connection topology pointing parameters and addressing path parameters, encapsulate the association parameters and write them into a preset configuration form, assign open source shared network protocol interface identifiers, and generate a trusted data space planning scheme.

[0013] As a further aspect of the present invention, the payload content refers to the core valid data that constitutes the data fragment after extracting a continuous byte stream that matches the boundary of the field access interval from the server node storage space.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, permission rules for field segments are generated by parsing the row vectors of the permission matrix based on access requests, and the permission rules are compared to establish the dynamic filtering results of segments and nodes. Nodes are arranged to obtain ascending sequence comparison and adjacent difference filtering to establish a continuous segment node sequence. The communication link structure mapping number of data sharing nodes is matched to establish a dedicated connection path relationship. Based on the call path structure, the execution order of scattered fragments is organized and spliced ​​to construct a deep data association structure. This effectively breaks the limitations of static permissions and solidified storage, accurately reconstructs the underlying communication connectivity dependency relationship of fragments among multi-source nodes, and greatly improves the data reorganization and circulation efficiency in a cross-entity distributed sharing and collaborative circulation environment. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the steps of the present invention; Figure 2 This is a detailed schematic diagram of S1 of the present invention; Figure 3 This is a detailed schematic diagram of S2 of the present invention; Figure 4 This is a detailed schematic diagram of S3 of the present invention; Figure 5 This is a detailed schematic diagram of S4 of the present invention; Figure 6 This is a detailed schematic diagram of S5 of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0018] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0019] Please see Figure 1 This invention provides an open-source data trusted data space planning method integrating privacy computing, comprising the following steps: S1: Obtain data call requests through business terminal devices, parse the access subject identifier and target field set, extract the permission matrix row vector corresponding to the access subject identifier, perform bitwise logical judgment on the permission matrix row vector and establish field segment permission correspondence, and at the same time perform interval division processing on the target field set and mark the segment number to generate field segment permission rules and field segment number sequence. S2: Based on the field segment permission rules and field segment number sequence, scan the distributed server nodes to obtain the data segment identifier corresponding to the server node. Perform a bit-by-bit comparison and judgment on the field segment number sequence and the field segment permission rules in the row vector of the permission matrix to filter the server nodes, establish the correspondence between the segment number and the server node, and generate the node filtering results. S3: Based on the node filtering results, the nodes are sorted into segments to obtain the ascending sequence of segment numbers. The adjacent segment difference is judged and continuous segments are filtered on the ascending sequence of segment numbers to establish the continuous relationship between segments and generate a continuous node sequence of segments. S4: Based on the continuous node sequence of the segment, match the connection relationship of nodes in the data space, obtain the communication link structure corresponding to the set of privacy computing data sharing nodes, perform path filtering on the continuous node sequence of the segment and the communication link structure and establish the corresponding relationship of node connection path, and at the same time map the segment number to form the field access interval structure and generate the data space call path structure. S5: Based on the data space call path structure, perform data fragment organization processing on the server node, obtain the data fragment set corresponding to the field access interval structure, perform segment order splicing calculation on the data fragment set and construct the data space structure association relationship, and generate a reliable data space planning scheme.

[0020] The field segment permission rules and field segment number sequence include a fine-grained read / write permission list, segment start and end indexes, and target field encryption mask. The node filtering results include the matching server IP address, segment storage physical sector, and node load parameters. The segment continuous node sequence includes a linearly sorted node set, adjacent segment boundary cursors, and a coherent data retrieval queue. The data space call path structure includes a directional encrypted communication tunnel, node hop routing details, and cross-domain data flow to the network. The trusted data space planning scheme includes a multi-party collaborative computing architecture, a data usability-but-not-visible protection mechanism, and a full data stitching presentation view.

[0021] Please see Figure 2 The specific steps of S1 are as follows: S101: Collect data call requests from business devices, parse the data call requests to extract the access subject identifier and target field set, read the preset policy table, match the access subject identifier with the associated primary key attribute, and reorganize the permission parameters by dimension to obtain the permission matrix row vector; The system receives concurrent data call requests from business terminals via a distributed message queue interface. It extracts the source Internet Protocol address, timestamp, session token, and payload signature parameters from the request packet header and parses the received data call request byte stream. The byte stream is then unpacked according to a preset Hypertext Transfer Protocol (HTTP) field delimiter, extracting a 16-bit access subject identifier string and a target field set consisting of multiple data column names. For the extracted target field set, null characters and illegal special characters are removed, and regular expression matching is used to verify the field naming conventions, ensuring the validity of the target field set. A low-level connection to the distributed database is established, and a preset strategy table stored within the relational database is read. A query operation is initiated against the preset strategy table using the 16-bit access subject identifier as the primary key. The associated primary key attribute record returned by the strategy table is obtained. This record contains the corresponding subject's department level parameter, job level parameter, and project affiliation code parameter. The department level parameter is converted to an 8-bit unsigned integer, the job level parameter is converted to an 8-bit unsigned integer, and the project affiliation code parameter is converted to a 16-bit unsigned integer. These three types of integer parameters are then sequentially placed into a memory array. The permission weight allocation logic is invoked, multiplying the department-level parameter by the preset department base weight value to obtain the department permission score, multiplying the job level parameter by the job coefficient to obtain the job permission score, and multiplying the project affiliation code parameter by the project sensitivity coefficient to obtain the project permission score. The advantage of this logic is that by multiplying the department-level parameter by the preset department base weight value, and by multiplying the job level parameter by the job coefficient, discrete identity attributes can be transformed into continuous, quantifiable permission indicators. For example, if a subject has a department-level parameter of 3, a department base weight value of 10, a job level parameter of 4, a job coefficient of 5, a project affiliation code parameter of 2, and a project sensitivity coefficient of 8, multiplying the department-level parameter 3 by the department base weight value of 10 yields a department permission score of 30, multiplying the job level parameter 4 by the job coefficient of 5 yields a job permission score of 20, and multiplying the project affiliation code parameter 2 by the project sensitivity coefficient of 8 yields a project permission score of 16. The obtained departmental permission score (30), job permission score (20), and project permission score (16) are summed to obtain a comprehensive permission evaluation score of 66. The difference between the comprehensive permission evaluation score of 66 and the basic permission threshold of 50 is calculated to obtain a permission overflow of 16. This overflow is then ratioed to the standardized divisor of 10 to obtain a standardized permission feature value of 1.6. Based on the comprehensive permission evaluation score and the scores of each sub-item, the score parameters are concatenated and recombined according to a set dimensional sequence to form a one-dimensional data sequence consisting of multiple values, resulting in the permission matrix row vector.

[0022] S102: Perform bitwise logical operations on the row vectors of the permission matrix, compare the non-zero state of the bits to mark the permission flag, retrieve the segment location index from the policy table, associate the segment location index with the permission flag to construct a mapping structure, and establish the field segment permission correspondence. Extract the values ​​of each dimension from the row vector of the permission matrix and convert them into the corresponding binary data stream representation. Perform a bitwise AND operation on this binary data stream and a preset global permission mask sequence. This operation iterates through each bit of the binary data stream, performing a logical multiplication operation between the current bit value of the row vector and the corresponding bit value in the global permission mask sequence. If both are 1, output 1; otherwise, output 0, thus generating a filtered valid permission bitmap. Based on the generated valid permission bitmap, perform a bit state scan operation, comparing the state of each bit within the bitmap one by one. When a bit is detected to be in a non-zero state (i.e., its value is 1), extract the absolute position sequence number of that bit and use it as an authorized permission flag for marking. Use the set of permission flags generated by the marking as query parameters to search the policy table in the database again, matching data segment records with the corresponding permission level. Extract the start sector address and end sector address of the data segment recorded in the policy table, and concatenate these two address values ​​to obtain the segment position index. The obtained segment location indexes and corresponding permission flags are loaded into a memory-mapped dictionary structure to establish a one-to-one association, constructing a key-value pair mapping structure. This mapping structure is then further traversed, appending the field name attributes from the target field set to the key-value pairs, ultimately establishing the field segment permission mapping relationship.

[0023] S103: Call the target field set to divide the data range, extract the data block address offset to mark the segment number, aggregate the number to obtain the segment number set, match the segment number set according to the field segment permission correspondence, and generate the field segment permission rule and field segment number sequence; Extract the start and end storage pointers of each target field in physical memory, and calculate the physical length occupied by the target field using the difference between these two pointers. Divide this physical length by a preset fixed length step of 512 bytes to obtain the number of intervals into which the target field is segmented, thus dividing the data into discrete intervals. For each segmented data interval, extract its starting physical address relative to the entire data file to obtain the data block address offset. Ratio this data block address offset to the baseline offset step, and use the integer result as the segment number for that interval. For example, if the data block address offset is 2048 bytes and the baseline offset step is 512 bytes, dividing them gives the segment number 4. Store the segment numbers of each data interval sequentially into a dynamic array, aggregating them to generate a segment number set. Call the field segment permission mapping relationship and traverse each segment number in the segment number set. Search the field segment permission mapping relationship for a permission flag that matches the current segment number. If a match exists, the segment number is set to the allowed access status. At the same time, its corresponding security check hash value is extracted and combined into a field segment permission rule. All segment numbers with the allowed access status are arranged in order to generate the final field segment number sequence.

[0024] Please see Figure 3 The specific steps of S2 are as follows: S201: Call the field segment permission rules and field segment number sequence, scan the distributed server nodes, parse the node feedback data to extract data block tags, compare the permission rule check code to extract matching tags, and obtain the data segment identifier; The system uses a network socket interface to call field segment permission rules and field segment number sequences, and employs a multi-threaded concurrency mechanism to send heartbeat probe data packets to pre-configured distributed server nodes within the local area network. It receives node feedback data from each server node within a specified timeout period. The system performs deserialization on the node feedback data, extracting a 128-bit data block tag contained in the metadata header. It extracts the rule checksum sequence from the field segment permission rules, splits each data block tag into high 64 bits and low 64 bits, and compares each part byte-by-byte with the rule checksum sequence. If the content of the data block tag completely matches the rule checksum, the matching data block tag is truncated, and a 16-bit substring is extracted from the end of the tag. This substring is converted to a decimal value to obtain the data segment identifier corresponding to the data fragment.

[0025] S202: Based on the data segment identifier and the row vector of the permission matrix, align the field segment number sequence with the matrix permission flag and perform bit-by-bit comparison operation to extract the network address of the corresponding node matching operation and obtain the candidate node set; The process involves obtaining the data segment identifier and the pre-reconstructed permission matrix row vector. Each element in the field segment number sequence is then aligned with the permission flag extracted from the permission matrix row vector. For each aligned pair, a numerical comparison and Boolean equality verification are performed. This logic allows for the rapid removal of invalid data nodes that do not meet permission requirements. For example, if a data segment identifier is associated with number 15 and the corresponding permission flag is set to 15, subtracting the two results in a difference of 0, indicating an equality match. If the verification is true, the Internet Protocol (IP) address and corresponding Transmission Control Protocol (TCP) port number of the underlying server node containing the currently matched data segment are extracted. All successfully matched IP addresses are aggregated and stored in a hash table structure, and duplicate address records are removed to obtain a candidate node set.

[0026] S203: Extract network addresses from the candidate node set, call the internal segment index number of the segment number sequence, concatenate the segment index number with the network address, construct a mapping table topology structure to store the number mapping items, and generate node filtering results; The algorithm iterates through each Internet Protocol address element within the candidate node set, extracting the network address string for each node sequentially. Simultaneously, it calls the segment index number stored within the segment number sequence field, converts the segment index number to a string format, inserts an underscore separator between the segment index number string and the network address string, and performs a string concatenation operation. The resulting concatenated string is used as the key, and the node's working status parameters and remaining bandwidth parameters are used as the values ​​to construct a hierarchical topology mapping table. Each concatenated string and its corresponding value are then written sequentially into this constructed mapping table topology structure as numbered mapping entries. This mapping table topology structure is saved to the disk cache, completing the record fixing operation, and finally generating a node filtering result file containing detailed filtering criteria for each node.

[0027] Please see Figure 4 The specific steps of S3 are as follows: S301: Call the node filtering results, extract the node network address and segment number parameters, set the segment number parameter as the sorting primary key, perform an ascending sorting and reorganization operation on the mapping records, and generate a sequence of nodes with ascending segment numbers. The generated node filtering result file is parsed, and the node network address and corresponding segment number parameter are extracted one by one from the data structure containing multiple number mapping items. The extracted segment number parameter is converted into a long integer value type and set as the primary key reference index for the bubble sort logic. Based on this sorting primary key, a value comparison operation is performed on all extracted mapping records. When the primary key value of the preceding mapping record is found to be greater than that of the following mapping record, their physical storage positions in the memory queue are swapped, completing the ascending order reorganization operation. The advantage of this operation logic is that, through a strict ascending order reorganization operation, the unordered distributed data block index can be transformed into a logical sequence with a coherent time and physical order. For example, if the segment number parameter of the first record is 45 and the segment number parameter of the second record is 12, a comparison is performed between 45 and 12. 45 is determined to be greater than 12, and the two records are then swapped in the queue, so that 12 is placed before 45. After iterating and swapping the data, a strictly increasing sequence structure is output, generating an ascending sequence of segment numbers.

[0028] S302: For the ascending sequence of nodes with segment numbers, traverse the mapping records, extract the segment number parameters of adjacent nodes, perform operations on the subsequent values ​​and the values, extract the difference between the calculated values ​​of the nodes, and generate a sequence of differences between adjacent segments. For the constructed ascending sequence of segment numbers, a cursor is used to traverse all the mapping records contained within it. During traversal, the segment number parameter of the current node record and the segment number parameter of the next node record are extracted simultaneously using index shifting. The segment number parameter of the next node record is used as the follow-up value, and the segment number parameter of the current node record is used as the precede-up value. A subtraction difference operation is performed on the follow-up value and the precede-up value, and the calculated difference of the node is obtained by subtracting the precede-up value from the follow-up value. For example, if the segment number parameter of the current record is 15 and the segment number parameter of the next record is 18, subtracting 18 from 15 yields a calculated difference of 3. The calculated differences of each node are sequentially appended to a temporary array for storage, and the difference results of all adjacent positions are collected in order to generate a sequence of differences between adjacent segments.

[0029] Table 1. Detailed list of parameter differences in node sections Table 1 records the segment number parameters of adjacent nodes, as well as the corresponding difference calculation results and judgment conditions, which are used to show the generation details of the difference sequence.

[0030] S303: Call the adjacent segment difference sequence, compare the calculated numerical difference with the preset constant, filter and retain matching node network addresses, perform pointer linking operation on the filtered node addresses, and generate a continuous node sequence of segments; The process involves obtaining a sequence of differences between adjacent segments and reading a preset constant value for continuity determination stored in the environment configuration file. For each calculated difference in the adjacent segment difference sequence, a conditional comparison logic is executed to determine whether the calculated difference is less than or equal to the preset constant value. The advantage of this logic is that by comparing the calculated difference with the preset constant value, discrete nodes with excessively large network hop counts or excessively large storage spans can be accurately eliminated. For example, if the preset constant value is set to 5, and a calculated difference of 3 is read, a comparison shows that 3 is less than 5, thus meeting the requirement; if a calculated difference of 8 is read, a comparison shows that 8 is greater than 5, thus not meeting the requirement. For calculated differences that meet the requirement, the node network addresses of the two associated mapping records are extracted and moved to a reserved buffer pool. For the node network addresses in the reserved buffer pool, the pointer variable of the next node in the preceding address record is set to point to the memory address of the following address record, completing the pointer linking operation, and finally generating a sequence of continuous nodes with a singly linked list data structure.

[0031] Please see Figure 5 The specific steps of S4 are as follows: S401: Call the continuous node sequence of the segment, scan the network connection configuration table inside the preset data space, extract the port handshake parameters between the corresponding nodes, establish data transmission connectivity, and obtain the communication link structure; The system receives a sequence of consecutive nodes with completed pointer links, accesses the relational storage engine within the pre-defined data space, and retrieves the network connection configuration table. Based on the adjacent node pairs recorded in the sequence, it extracts the port handshake parameters between the source and target nodes from the network connection configuration table. These port handshake parameters include the target communication port number, default transmission timeout in milliseconds, maximum retransmission attempts, and link encryption type identifier. For each pair of adjacent nodes, using the extracted target communication port number and transmission control protocol interface, it initializes a virtual communication socket object in memory, sets its peer's Internet Protocol address and port, and establishes a data transmission connection. It integrates the established transmission connection connections between adjacent nodes to form a graph structure model containing multiple directed edges, and obtains the corresponding communication link structure.

[0032] S402: For the continuous node sequence and communication link structure of the segment, compare the node address with the link connectivity status parameters, eliminate nodes that block the link, associate the connected nodes with the link direction, and establish the corresponding relationship of node connection path; The link connectivity parameters of each directed edge in the communication link structure are extracted. These parameters are dynamically updated by the underlying heartbeat detection mechanism to indicate connectivity or blockage. The addresses of each node in the continuous node sequence of a segment are traversed, and the link connectivity parameters of the node as a source or destination are compared by querying the communication link structure. If any link connectivity parameter involving this node is marked as blocked (value 0), a node memory release instruction is executed, directly removing the blocked link node from the continuous node sequence of the segment, and performing cascading connection processing on the affected preceding and following nodes. For nodes whose link connectivity parameters are marked as connected (value 1), their Internet Protocol address is bound to the currently connected directed edge data object, clarifying the link path parameters from the current node to the next target node. This binding relationship between nodes and valid link paths is written into a two-dimensional array table to establish the node connection path correspondence.

[0033] S403: Call the node connection path correspondence, extract the segment number associated with the connected node, concatenate adjacent segment numbers into access boundary parameters, construct the field access interval structure and merge the path pointing parameters to generate the data space call path structure; The process iterates through the node connection path mappings, extracting data dictionary records for confirmed connected nodes and reading the initially assigned segment numbers for each node. For two adjacent connected nodes in the linked list, their segment numbers are extracted, with the segment number of the preceding node serving as the left boundary and the segment number of the following node as the right boundary. The left and right boundary values ​​are concatenated using a dash as a separator to generate access boundary parameters. Based on each set of access boundary parameters, a closed interval data object is instantiated in memory to construct the field access interval structure. Simultaneously, the next-hop Internet Protocol address recorded in the node connection path mappings is extracted as a path pointing parameter. The path pointing parameter is assigned as an attribute field to the aforementioned field access interval structure object, and object data fusion is performed. After completing the fusion processing of all objects, they are serialized into a general data format file, ultimately generating the data space call path structure.

[0034] Please see Figure 6 The specific steps of S5 are as follows: S501: Call the data space call path structure, read the server node storage space according to the path node addressing parameters, extract the continuous byte stream that matches the field access interval structure boundary, extract the corresponding payload content of the interval, and generate a data fragment set; The data space call path structure is parsed, and the next-hop Internet Protocol address and corresponding port number of each entry are extracted as path node addressing parameters. A physical storage read command is sent to the server node corresponding to the Internet Protocol address using the Remote Procedure Call protocol to access its underlying storage device. During the read operation, the field access interval structure containing left and right boundary values ​​is parsed. The starting offset for disk head addressing is set to the left boundary value multiplied by the base block size, and the read length is the difference between the right and left boundary values ​​multiplied by the base block size. Based on the calculated starting offset and read length, a memory copy command is executed in the server node's storage space to extract a continuous byte stream at the target location. The extracted continuous byte stream is decompressed and unpacked, removing the additional checksum headers attached to the underlying transport protocol to extract the clean interval-corresponding payload content. The interval-corresponding payload content returned by multiple nodes is appended one by one to the memory cache queue to generate a data fragment set.

[0035] S502: Based on the data fragment set, read the segment number identifier in the header of the data fragment, sort it in ascending order using the segment number as the index, perform the first and last memory address concatenation operation on adjacent data fragments, establish the data block connection topology, and generate the data space structure association relationship; For the set of data segments in the memory cache queue, the metadata area of ​​each data segment is traversed sequentially, and the reserved 16-bit segment number identifier in the header of each data segment is read. The read segment number identifier value is extracted into the comparator of the quicksort algorithm. Using this segment number identifier as the index, all object elements in the data segment set are sorted in ascending order. For each adjacent data segment object after sorting, the hexadecimal value of the tail memory address of the preceding data segment in memory is obtained, and the hexadecimal value of the head memory address of the following data segment in memory is also obtained. The advantage of this operation logic is that by directly concatenating the hexadecimal memory address values ​​and calculating the offset, the memory fragmentation interval caused by discrete reads can be eliminated. For example, if the tail memory address of the preceding data segment is hexadecimal 4000 and the head memory address of the following data segment is hexadecimal 8000, the offset distance between the head and tail memory address hexadecimal values ​​is calculated to be hexadecimal 4000. The tail pointer of the preceding data segment is set to the head address of the following data segment, and a memory address concatenation operation is performed. Through the memory pointer redirection process of full permutation, a data block connection topology with logically adjacent relationships is constructed in memory. The relevant node guidance information of this topology is recorded in a mapping table to generate a complete data space structure association.

[0036] S503: Based on the data space structure relationship, extract the internal data block connection topology pointing parameters and addressing path parameters, encapsulate the relationship parameters and write them into the preset configuration form, assign open source shared network protocol interface identifiers, and generate a trusted data space planning scheme. The system retrieves the memory table showing the data space structure relationships, extracting internal data block connection topology parameters that guide the logical positions of each data block, as well as physical device addressing path parameters containing Internet Protocol (IP) addresses. These topology parameters and addressing path parameters are packaged into a single configuration object entity using a generic object serialization method. The underlying file writing interface is then invoked to write the attribute content of this configuration object entity into a pre-defined configuration form in a standardized Extensible Markup Language (XML) format, aligned to field alignment. A request is sent to the resource management interface to obtain a free 32-bit globally unique identifier string, which is then allocated as the identifier for the open-source shared network protocol interface and appended to the root node attribute of the pre-defined configuration form. Finally, the pre-defined configuration form is saved, triggering a read-only access lock, and a trusted data space planning scheme is generated. This scheme can be directly used by authorized external applications for trusted invocation via the interface identifier.

[0037] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of protection of the technical solution.

Claims

1. An open-source data trusted data space planning method integrating privacy computing, characterized in that, Includes the following steps: S1: Obtain the data call request sent by the business terminal device, parse the access subject identifier and target field set, extract the row vector of the permission matrix corresponding to the access subject identifier, perform bitwise logical judgment to establish the field segment permission relationship, and generate the field segment permission rule and field segment number sequence. S2: Based on the field segment permission rules and field segment number sequence, scan the distributed server nodes, obtain the data segment identifier corresponding to the server node, compare the field segment number sequence with the field segment permission rules in the row vector of the permission matrix, establish the correspondence between the segment number and the server node, and generate node filtering results; S3: Arrange the server nodes in the node filtering results, obtain the ascending sequence of segment numbers, determine the difference between adjacent segments and filter continuous segments, establish the continuous relationship of segments, and generate a continuous node sequence of segments. S4: Based on the segment continuous node sequence, match the data space node connection relationship, obtain the communication link structure corresponding to the privacy computing data sharing node set, filter the path of the segment continuous node sequence in the communication link structure and establish the node connection path relationship, map the segment number, and generate the data space call path structure. S5: Based on the data space call path structure, organize the data fragments in the server node, obtain the data fragment set corresponding to the field access interval structure, perform segment sequential splicing calculation and construct the data space structure association relationship, and generate a reliable data space planning scheme.

2. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The field segment permission rules and field segment number sequence include a fine-grained read / write permission list, a segment interval start and end index, and a target field encryption mask. The node filtering results include the matching server IP address, segment storage physical sector, and node load parameters. The segment continuous node sequence includes a linearly sorted node set, adjacent segment boundary cursors, and a coherent data retrieval queue. The data space call path structure includes a directional encrypted communication tunnel, node hop routing details, and cross-domain data flow to the network. The trusted data space planning scheme includes a multi-party collaborative computing architecture, a data availability-invisibility protection mechanism, and a full data stitching presentation view.

3. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The field segment permission relationship refers to the access authorization mapping relationship between the access subject and the target data field segment verified by performing bitwise logical judgment on the row vector of the access subject's permission matrix.

4. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The field segment permission rules, generated based on permission relationships, guide and constrain the execution criteria for determining and extracting legal data fragments in distributed nodes.

5. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The specific steps of S1 are as follows: S101: Collect data call requests from business devices, parse the data call requests to extract the access subject identifier and target field set, read the preset policy table, match the access subject identifier with the associated primary key attribute, and reorganize the permission parameters by dimension to obtain the permission matrix row vector; S102: Perform bitwise logical operations on the row vectors of the permission matrix, compare the non-zero state of the bits to mark the permission flag, retrieve the segment location index from the policy table, associate the segment location index with the permission flag to construct a mapping structure, and establish the field segment permission correspondence relationship. S103: Call the target field set to divide the data range, extract the data block address offset to mark the segment number, aggregate the number to obtain the segment number set, match the segment number set according to the field segment permission correspondence, and generate field segment permission rules and field segment number sequence.

6. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The specific steps of S2 are as follows: S201: Call the field segment permission rules and field segment number sequence, scan the distributed server nodes, parse the node feedback data to extract data block tags, compare the permission rule check code to extract matching tags, and obtain the data segment identifier; S202: Based on the data segment identifier and the permission matrix row vector, align the field segment number sequence with the matrix permission flag and perform a bit-by-bit comparison operation to extract the network address of the corresponding node that matches the operation and obtain a candidate node set; S203: Extract network addresses from the candidate node set, call the internal segment index number of the field segment number sequence, concatenate the segment index number with the network address, construct a mapping table topology structure to store the number mapping items, and generate node filtering results.

7. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The specific steps for S3 are as follows: S301: Call the node filtering results, extract the node network address and segment number parameters, set the segment number parameter as the sorting primary key, perform an ascending sorting and reorganization operation on the mapping records, and generate a segment number ascending node sequence. S302: For the ascending sequence of segment numbers, traverse the mapping records, extract the segment number parameters of adjacent nodes, perform calculations on the subsequent values ​​and the values, extract the difference between the calculated values ​​of the nodes, and generate a sequence of differences between adjacent segments. S303: Call the adjacent segment difference sequence, compare the calculated numerical difference with a preset constant, filter and retain matching node network addresses, perform pointer linking operations on the filtered node addresses, and generate a continuous node sequence of segments.

8. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The specific steps of S4 are as follows: S401: Call the continuous node sequence of the segment, scan the network connection configuration table inside the preset data space, extract the port handshake parameters between the corresponding nodes, establish data transmission connectivity, and obtain the communication link structure; S402: For the continuous node sequence of the segment and the communication link structure, compare the node address with the link connectivity status parameter, eliminate blocked link nodes, associate the connected nodes with the link direction, and establish the corresponding relationship of node connection path; S403: Call the node connection path correspondence, extract the segment number associated with the connected node, concatenate adjacent segment numbers into access boundary parameters, construct the field access interval structure and merge the path pointing parameters to generate the data space call path structure.

9. The open-source data trusted data space planning method integrating privacy computing according to claim 1, characterized in that, The specific steps of S5 are as follows: S501: Call the data space call path structure, read the server node storage space according to the path node addressing parameters, extract the continuous byte stream that matches the boundary of the field access interval structure, extract the corresponding payload content of the interval, and generate a data fragment set; S502: Based on the data fragment set, read the segment number identifier at the head of the data fragment, sort it in ascending order using the segment number as the index, perform the first and last memory address concatenation operation on adjacent data fragments, establish a data block connection topology, and generate a data space structure association relationship. S503: Based on the data space structure association relationship, extract the internal data block connection topology pointing parameters and addressing path parameters, encapsulate the association parameters and write them into a preset configuration form, assign open source shared network protocol interface identifiers, and generate a trusted data space planning scheme.

10. The open-source data trusted data space planning method integrating privacy computing according to claim 9, characterized in that, The payload content refers to the core valid data that constitutes the data fragment after extracting a continuous byte stream that matches the boundary of the field access interval from the server node's storage space.

Images