Data processing methods and systems, electronic device, and storage medium

Abstract

The present disclosure relates to the technical field of databases. Provided are data processing methods and systems, an electronic device, and a storage medium. A method comprises: receiving encrypted data sent by a data sender, wherein key information of the encrypted data has been registered by the data sender in a key information management service; in response to a data operation request of a data requester, when it is determined that a target operation corresponding to the data operation request has been authorized by the data sender, acquiring from the encrypted data target data corresponding to the target operation, and acquiring key information of the target data; and executing a decryption operation on the target data on the basis of the key information of the target data, executing the target operation on the decrypted target data, and sending an execution result to the data requester. In the present embodiment, the security and privacy of data transmission and operations are realized by means of data encryption and uploading, key information registration, and authorization confirmation of the target operation, and the requirements of data sharing and circulation between different participants are met.

Description

Data processing method and system, electronic device and storage medium

[0001] The present disclosure claims priority to Chinese Patent Application No. 202410881905.8, filed on July 2, 2024 with the Chinese Patent Office, entitled “Data processing method and system, electronic device and storage medium”, the entire contents of which are incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of database, and particularly relates to a data processing method, system, electronic device and storage medium. BACKGROUND

[0003] With the development of cloud computing, big data and artificial intelligence technologies, machine learning, deep learning, large-scale data processing and analysis, etc. application scenarios are becoming more and more widespread, and these applications have extremely demanding requirements for computing, network, storage and other capabilities. In related development modes, developers often need to host application tasks to third-party services for processing, and these services often need to run in the cloud because they require a large amount of computing resources, such as graphics processing units (GPUs) accelerators or high-performance server clusters, etc. On the other hand, with the advent of the data element era, the value of data sharing and trading is increasingly prominent, and more and more enterprises obtain greater data value through the circulation of data. Traditional data sharing relies on third-party service providers, and data is hosted to third-party services for circulation and exchange according to predetermined functions or ranges.

[0004] However, whether it is a single-party data hosting computing scenario or a multi-party data sharing scenario, the existing mode may have a data leakage risk, especially the third-party service has a privacy protection problem in sensitive data processing. With the increasing demand for data computing and processing, how to effectively utilize third-party computing resources while ensuring data security and privacy, and have the ability to circulate and share, has become a problem to be solved. SUMMARY

[0005] The embodiments of the present disclosure provide a data processing method, system, electronic device and storage medium to realize the hosting of data computing by fully utilizing third-party computing resources while ensuring the security and privacy of data, and to meet the needs of data sharing and circulation among different parties.

[0006] In a first aspect, the embodiments of the present disclosure provide a data processing method, which is applied to a data hosting computing service, and includes: receiving encrypted data sent by a data sender, key information of the encrypted data having been registered by the data sender in a key information management service; in response to a data operation request of a data invoker, in a case where it is determined that a target operation corresponding to the data operation request has been authorized by the data sender, obtaining target data corresponding to the target operation from the encrypted data, and obtaining key information of the target data from the key management service; performing a decryption operation on the target data based on the key information of the target data, performing the target operation on the decrypted target data, and sending an execution result to the data invoker.

[0007] In a second aspect, the embodiments of the present disclosure provide a data processing method, which is applied to a data sender, and includes: performing encryption processing on data, and registering key information in a key information management service; sending the encrypted data to a data hosting computing service; receiving an authorization request for an operation on the encrypted data sent by the data hosting computing service, and sending an authorization result to the data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, in a case where it is determined that a target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation from the encrypted data, and obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data invoker.

[0008] In a third aspect, the embodiments of the present disclosure provide a data processing method, which is applied to a data invoker, and includes: sending a data operation request to a data hosting computing service, so that the data hosting computing service, in a case where it is determined that a target operation corresponding to the data operation request has been authorized by a data sender, obtains target data corresponding to the target operation from encrypted data sent by the data sender, and obtains key information of the target data from a key management service, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data; and receiving an execution result of the target operation sent by the data hosting computing service.

[0009] In a fourth aspect, the embodiments of the present disclosure provide a data processing system, which includes a data sender, a data invoker, and a data hosting computing service; the data hosting computing service is configured to implement any of the methods described above; the data sender is configured to implement any of the methods described above; and the data invoker is configured to implement any of the methods described above.

[0010] In a fifth aspect, the embodiments of the present disclosure provide an electronic device, which includes a memory, a processor, and a computer program stored in the memory, and the processor implements any of the methods described above when executing the computer program.

[0011] In a sixth aspect, the embodiments of the present disclosure provide a computer readable storage medium, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement the method of any one of the above.

[0012] In a seventh aspect, the embodiments of the present disclosure provide a computer program product, and the computer program product comprises a computer program. The computer program is executed by a processor to implement the method of any one of the above.

[0013] Compared with the prior art, the present disclosure has the following advantages:

[0014] The present disclosure provides a data processing method, system, electronic device and storage medium. A data hosting computing service receives encrypted data sent by a data sender. Key information of the encrypted data has been registered by the data sender in a key information management service. In response to a data operation request of a data invoker, in a case where it is determined that a target operation corresponding to the data operation request has been authorized by the data sender, target data corresponding to the target operation is obtained from the encrypted data, and key information of the target data is obtained from the key management service. A decryption operation is performed on the target data based on the key information of the target data. The target operation is performed on the decrypted target data, and the execution result is sent to the data invoker. In this embodiment, the data sender encrypts the data and uploads it to the data hosting computing service, and registers the key information in the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sender before performing the target operation, performs the authorized target operation, and then sends the execution result to the data invoker, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different participants.

[0015] The above description is only a summary of the technical solutions of the present disclosure. In order to more clearly understand the technical means of the present disclosure, the description can be implemented in accordance with the content of the specification, and in order to make the above and other purposes, features and advantages of the present disclosure more obvious and easy to understand, the specific implementation manner of the present disclosure is described below. BRIEF DESCRIPTION OF DRAWINGS

[0016] In the drawings, the same reference signs represent the same or similar components or elements throughout the drawings unless otherwise specified. The drawings are not necessarily drawn to scale. It should be understood that the drawings only depict some embodiments according to the present disclosure, and should not be regarded as limiting the scope of the present disclosure.

[0017] FIG. 1 is a schematic diagram of an application scenario of a data processing method according to an embodiment of the present disclosure;

[0018] FIG. 2 is a flowchart of a data processing method according to an embodiment of the present disclosure;

[0019] FIG. 3 is a flowchart of a data processing method according to an embodiment of the present disclosure;

[0020] FIG. 4 is a flowchart of a data processing method according to an embodiment of the present disclosure;

[0021] FIG. 5 is a structural block diagram of a data processing apparatus according to an embodiment of the present disclosure;

[0022] FIG. 6 is a structural block diagram of a data processing apparatus according to an embodiment of the present disclosure;

[0023] FIG. 7 is a structural block diagram of a data processing apparatus according to an embodiment of the present disclosure;

[0024] FIG. 8 is a block diagram of an electronic device for implementing an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] In the following, only certain exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the concept or scope of the present disclosure. Therefore, the drawings and the description are considered to be exemplary in nature, rather than limiting.

[0026] To facilitate understanding of the technical solutions of the embodiments of the present disclosure, the related technologies of the embodiments of the present disclosure are described below. The following related technologies can be combined with the technical solutions of the embodiments of the present disclosure in any manner as optional solutions, which all belong to the protection scope of the embodiments of the present disclosure.

[0027] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation portal for user to choose authorization or refusal.

[0028] FIG. 1 is a schematic diagram of one application scenario of the data processing method provided by the present disclosure. The terminal device of the data owner, i.e., the data sender, the data hosting computing service can be a third-party computing resource deployed in the cloud, the terminal device of the data user, i.e., the data caller, and the key management service can be deployed in the data hosting computing service, or can be separately deployed in other servers.

[0029] In this embodiment, the data owner provides data and has the right to control how the data is used. The data user performs computation on the data and obtains the result of the computation. In a single-party data hosting computation scenario, the data owner and the data user are terminal devices of the same subject, for example, an enterprise transmits its data to a big data platform on a third-party cloud (i.e., a data hosting computation service) for computation. In a multi-party data hosting circulation scenario, the data owner and the data user are terminal devices of different subjects, for example, hospital A provides its case data as the data owner, and hospital B uses the data provided by hospital A as the data user to jointly train a more accurate artificial intelligence model related to diagnosis.

[0030] The data hosting computation service provides three core interface capabilities for the data owner and the data user, specifically including: a function registration interface. The interface is used by the data user, and the data user registers or removes a function to the data hosting computation service. The interface parameters include the name, calling address, version, and digest (for security authentication) of the function, and further include a list of callable methods and corresponding input / output formats. A function authorization interface. The interface is used by the data owner, and the data owner authorizes the function registered by the data user to the data hosting computation service. The authorization information includes the name, calling address, version, and digest of the function, a list of callable methods and corresponding input / output formats, data to be accessed, data processing logic, and the like. A function calling interface. The interface is used by the data user, and if the registered function is authorized by the data owner, the data user can call the function; if the registered function is not authorized by the data owner, the call is rejected.

[0031] As shown in FIG. 1, the data interaction process of the data owner, the data user, the data hosting computation service, and the key management service is as follows:

[0032] 1. When using the data hosting computation service, the data owner first encrypts the data owned by the data owner. The key information for encrypting the data can be generated according to an encryption algorithm or issued by the key management service. The data is encrypted before being uploaded to the data hosting computation service, to ensure the security of the data in the transmission and storage process.

[0033] 2. The "data owner" registers the key information of the data into the key management service (as shown in Fig. 1, "register data key"), and if the key information is generated according to an encryption algorithm, the registration information of the key information includes: the user, the encryption algorithm, the expiration time, etc. The key information and the identification information of the data are stored in the key management service. The key management service protects the data key and increases the security of the data.

[0034] 3. The "data owner" uploads the encrypted data to the data hosting computing service.

[0035] 4. The data hosting service returns the data upload result to the "data owner".

[0036] 5. The "data user" registers a "function" to the data hosting computing service, and the registration information of the "function" includes: the name of the "function", the calling address, the version, the abstract (for security authentication), and also contains the list of callable methods and the corresponding input / output format, the number of "function" calls, the expiration time of the "function", whether the product of the "function" can be output, etc.

[0037] In this embodiment, the operation on the data is called "function". For example, the "function" can be an operation of querying, downloading, modifying, etc. on the data, or can be a model training, etc. using the data. The terminal device of the "data user" can determine the specific "function" according to the specific needs and register it to the data hosting computing service, which has flexibility and scalability.

[0038] 6. The data hosting computing service returns the "function" registration result (registration success or failure due to missing part of the information, etc.) to the "data user".

[0039] 7. The "data owner" authorizes the "function" registered in the data hosting computing service. At least one of the following needs to be authenticated when authorizing: the name of the "function", the version, the abstract, the list of callable methods and the corresponding input / output format, the data to be accessed, the data processing logic, etc.

[0040] 8. The data hosting service returns the "function" authorization result to the "data owner". For example, if the "function" version and abstract pre-stored by the "data owner" do not match the "function" version and abstract registered in the data hosting computing service, the authorization fails.

[0041] The "function" registration and authorization mechanism enables new data usage modes to be flexibly accessed, supports the computing needs of different "data users", and at the same time, the "data owner" can accurately control the specific use of the data.

[0042] 9. The "data user" requests to call a "function" to the data hosting computing service.

[0043] 10. The data hosting computing service first checks the authorization status of the "function". If the authorization status information indicates that the authorization fails, it returns failure information; if the authorization status information indicates that the authorization succeeds, it finds the call address of the target "function" (i.e., the target operation) from the registration information of the "function".

[0044] 11. The data hosting computing service uses the call address to obtain the target data corresponding to the target operation from the encrypted data, and based on the identification information of the target data, obtains the key information of the target data operated by the authorized "function" from the key management service (such as "obtain data decryption key" shown in FIG. 1).

[0045] 12. The data hosting computing service uses the key information to decrypt the target data in a secure environment, and performs the operation corresponding to the "function" on the target data. For example, the target operation corresponding to the "function" is a data modification operation, and the data hosting computing service performs a decryption operation on the target data based on the key information, and then performs a data modification operation on the decrypted data to obtain an execution result.

[0046] 13. The data hosting computing service returns the "function" execution result to the "data user".

[0047] In the above process, steps 1-4, steps 5-6, steps 7-8, and steps 9-13 are independent operations, i.e., the "data owner" can upload data multiple times (repeat steps 1-4 multiple times), the "data user" can register multiple "functions" (repeat steps 5-6 multiple times), and call the "function" multiple times (repeat steps 9-13 multiple times).

[0048] In this embodiment, the security of the data hosting computing service is guaranteed by the following methods:

[0049] 1. The code of the data hosting computing service itself is in an open source form, which receives audits from data users to prevent malicious behavior in the code implementation.

[0050] 2. The data hosting computing service runs in a Trusted Execution Environment (TEE), such as Trust Domain Extensions (TDX), Software Guard Extensions (SGX), China Security Virtualization (CSV), Secure Encrypted Virtualization (SEV), etc. The service ensures runtime security and provides hardware-level security protection to avoid attacks at the infrastructure level and data leakage risks. The data hosting computing service is deployed in the cloud, and small and medium-sized enterprises or individual developers do not need to build and maintain large-scale computing resources and infrastructure locally, do not need to worry about the details of using TEE, reduce investment and operation and maintenance requirements, and save additional overheads for enterprises in security guarantees.

[0051] 3. The behavior logic of the "function" registered by the "data user" to the data hosting computing service is authorized by the "data owner". The executed "function" runs in an isolated secure sandbox, and even if there are undiscovered security vulnerabilities, it will not pose a danger to the data hosting computing service itself.

[0052] When auditing is needed, the running records of all operations in the data hosting computing service can be recorded in the form of logs. These logs can be further secured by encryption and saved in tamper-proof data. When auditors need to audit the historical behavior of the data hosting computing service, the encrypted logs are decrypted by the key, and the integrity of the log data is verified to ensure that the historical behavior records in the data hosting computing service are real and complete.

[0053] It should be noted that in a single-participant scenario, the "data owner" and the "data user" are the same subject, and there is no need to prevent malicious attacks and data theft between the two. Therefore, the process can be appropriately simplified, for example, the steps of "registration" and "authorization" of the function can be ignored. In a multi-participant scenario, in addition to being deployed on the cloud, the data hosting computing service can also be deployed on the "data owner" or "data user" side. Because the data hosting computing service uses TEE to protect runtime security, even if the "data owner" or "data user" gains access to the data hosting computing service infrastructure, they cannot obtain the plaintext data.

[0054] In this embodiment, the security and privacy of data during transmission, storage and calculation are ensured through data encryption, key management service and secure trusted execution environment, and the problems of data leakage and privacy protection are solved. In addition, the "function" registration, authorization and calling process in the data use process is proposed, and a safe, flexible, easy-to-use and extensible data calculation and sharing mode is realized, so that the use of data is subject to the explicit control and authorization of the data owner, meeting the sharing and circulation needs of different participants for data, while improving the processing efficiency of data.

[0055] The embodiment of the present disclosure provides a data processing method, the method in the embodiment can be applied to a computing device, and the computing device can include a server and the like. As shown in FIG. 2, a flowchart of a data processing method according to an embodiment of the present disclosure is shown, which includes the following steps:

[0056] In step S201, encrypted data sent by a data sender is received, and key information of the encrypted data has been registered by the data sender in a key information management service.

[0057] The method in the embodiment is applied to a data hosting computing service. The data hosting computing service runs in a trusted execution environment (Trusted Execution Environment, TEE), for example, a Trust Domain Extensions (TDX), a Software Guard Extensions (SGX), a China Security Virtualization (CSV), a Secure Encrypted Virtualization (SEV) or the like. The TEE can ensure the security of the service runtime, provide hardware-level security protection, and avoid the risk of data leakage caused by attacks at the infrastructure level.

[0058] The key information can be generated according to an encryption algorithm or issued by a key management service. After the data sender encrypts the data, the key information is registered in the key management service, and then the encrypted data is sent to the data hosting computing service.

[0059] In step S202, in response to a data operation request of a data invoker, if it is determined that a target operation corresponding to the data operation request is authorized by the data sender, target data corresponding to the target operation is obtained from the encrypted data, and key information of the target data is obtained from the key management service.

[0060] The target operation can be querying, downloading, modifying, etc. of the data, or model training using the data, etc. The data calling party can configure specific operations on the data according to specific needs, and register with the data hosting computing service.

[0061] In step S203, decryption is performed on the target data based on the key information of the target data, the target operation is performed on the decrypted target data, and the execution result is sent to the data calling party.

[0062] After receiving the data operation request sent by the data calling party, the data hosting computing service parses the data operation request, obtains the target operation corresponding to the data operation request, performs authorization checking on the target operation, determines whether the target operation has been authorized by the data sending party, if yes, obtains the target data and the key information corresponding to the target operation, performs decryption on the target data, performs the target operation, and sends the execution result to the data calling party. If not, a call failure notification message is sent to the data calling party.

[0063] The encryption mode includes symmetric encryption and asymmetric encryption, and the corresponding decryption mode is different. Symmetric encryption uses the same key for encryption and decryption. Asymmetric encryption uses a pair of keys: a public key and a private key. The public key is used for encryption, and the private key is used for decryption.

[0064] Optionally, if the data calling party needs to modify the data, after the data hosting computing service obtains the target data to be modified, the data hosting computing service first performs decryption to obtain the decrypted plaintext data, then performs the modification operation, and sends the modified data to the data calling party.

[0065] The data processing method provided by the embodiments of the present disclosure, the data hosting computing service receives encrypted data sent by the data sending party, the key information of the encrypted data has been registered by the data sending party in the key information management service; in response to a data operation request of a data calling party, in a case where it is determined that a target operation corresponding to the data operation request has been authorized by the data sending party, the target data corresponding to the target operation is obtained from the encrypted data, and the key information of the target data is obtained from the key management service; decryption is performed on the target data based on the key information of the target data, the target operation is performed on the decrypted target data, and the execution result is sent to the data calling party. In this embodiment, the data sending party encrypts the data and uploads it to the data hosting computing service, and registers the key information in the key information management service. The data hosting computing service confirms whether the target operation has been authorized by the data sending party before performing the target operation, performs the target operation that has been authorized, and then sends the execution result to the data calling party, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different parties.

[0066] The specific implementation process of each step is introduced below through various implementations.

[0067] In an implementation, in the case where it is determined that the target operation corresponding to the data operation request is authorized by the data sender, the target data corresponding to the target operation is obtained from the encrypted data, and the key information of the target data is obtained from the key management service, including: obtaining the authorization state information of the target operation, and if the authorization state information indicates that the authorization is successful, obtaining the registration information of the target operation in the data hosting computing service; based on the calling address in the registration information, obtaining the target data corresponding to the target operation from the encrypted data; and based on the identification information of the target data, obtaining the key information of the target data from the key management service.

[0068] After the data hosting computing service receives the data operation request sent by the data invoker, it first determines whether the target operation corresponding to the data operation request has been authorized by the data sender, determines whether it has been authorized through the authorization state information, if it has been authorized, the target operation is an operation that has been registered by the data invoker in the data hosting computing service, the calling address is obtained from the registration information, the target data is obtained according to the calling address, and the key information stored in association is obtained from the key management service according to the identification information of the target data, which is used for decryption processing of the target data.

[0069] In this embodiment, the data hosting computing service confirms whether the target operation is authorized by the data sender, for the authorized operation, the target data and the key information are obtained, which are used for executing the authorized target operation, which can guarantee the security and privacy of the data operation.

[0070] In an implementation, before responding to the data operation request of the data invoker, the data processing method further includes: in response to the operation registration request of the data invoker, registering the data operation corresponding to the operation registration request; sending the registration information of the registered data operation to the data sender, so that the data sender authorizes the data operation based on the registration information; and receiving the authorization result sent by the data sender.

[0071] In actual application, the data invoker registers the data operation before sending the data operation request to the data hosting computing service. The data operation can be determined by the data invoker according to specific needs, which has flexibility and scalability.

[0072] The data hosting computing service receives an operation registration request of a data invoker, and registers the data operation. It is checked whether the registration information meets preset registration conditions, for example, whether the information is complete, whether the format meets the requirements, etc. If the registration is successful, the registration information is sent to the data sender, the data sender matches the registration information sent by the data hosting computing service with the pre-stored registration information, if the matching is successful, the authorization is successful, and the authorization result is sent to the data hosting computing service, and the data hosting computing service generates authorization state information corresponding to the data operation according to the authorization result.

[0073] For example, the registration information includes at least one of the following: operation name, call address, version, digest, list of callable methods and corresponding input / output format, operation call times, operation expiration time, and whether the operation product can be output.

[0074] In actual application, the data sender determines whether to authorize the operation based on the registration information in the above multiple dimensions, so that more fine-grained permission control of the data hosting computing service can be realized.

[0075] In an implementation manner, in step S203, the decryption operation is performed on the target data based on the key information of the target data, and the target operation is performed on the decrypted target data, including: performing the decryption operation on the target data based on the key information of the target data in a sandbox environment, and performing the target operation on the decrypted target data.

[0076] The sandbox environment refers to a safe and isolated test environment in which software programs or codes can be run without affecting other parts of the main system or network.

[0077] Running the data decryption and the target operation in the isolated sandbox environment will not pose a danger to the data hosting computing service even if there is an undiscovered security vulnerability.

[0078] The embodiment of the present disclosure provides a data processing method, and the method in the embodiment can be applied to a computing device, which can include a server, a user terminal, etc. As shown in FIG. 3, a flowchart of a data processing method according to an embodiment of the present disclosure is shown, which includes the following steps:

[0079] In step S301, the data is encrypted, and the key information is registered in a key information management service.

[0080] In step S302, the encrypted data is sent to a data hosting computing service.

[0081] In step S303, the authorization request for the operation on the encrypted data sent by the data hosting computing service is received, and the authorization result is sent to the data hosting computing service, so that the data hosting computing service, in response to the data operation request sent by the data invoker, determines that the target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation in the encrypted data, obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends the execution result to the data invoker.

[0082] The method in this embodiment is applied to a data sender. The key information can be generated according to an encryption algorithm or issued by the key management service. After the data sender encrypts the data, the data sender registers the key information in the key management service, and then sends the encrypted data to the data hosting computing service.

[0083] After the data hosting computing service receives the data operation request sent by the data invoker, the data operation request is parsed to obtain a target operation corresponding to the data operation request, the target operation is authorized to determine whether the target operation has been authorized by the data sender, if the target operation has been authorized, the target data and the key information corresponding to the target operation are obtained, the target operation is performed, and the execution result is sent to the data invoker. If not, a call failure notification message is sent to the data invoker.

[0084] The data processing method provided in the embodiments of the present disclosure encrypts the data and registers the key information in the key information management service, sends the encrypted data to the data hosting computing service, receives the authorization request for the operation on the encrypted data sent by the data hosting computing service, and sends the authorization result to the data hosting computing service, so that the data hosting computing service, in response to the data operation request sent by the data invoker, determines that the target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation in the encrypted data, obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends the execution result to the data invoker. In this embodiment, the data sender encrypts and uploads the data to the data hosting computing service, and registers the key information in the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sender before performing the target operation, performs the authorized target operation, and then sends the execution result to the data invoker, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different participants.

[0085] The embodiment of the present disclosure provides a data processing method. The method in the embodiment can be applied to a computing device, which can include a server, a user terminal, and the like. As shown in FIG. 4, a flowchart of the data processing method according to an embodiment of the present disclosure is shown, which includes the following steps.

[0086] In step S401, a data operation request is sent to a data hosting computing service, so that the data hosting computing service acquires target data corresponding to a target operation from encrypted data sent by a data sender and acquires key information of the target data from a key management service, in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sender, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data.

[0087] In step S402, an execution result of the target operation sent by the data hosting computing service is received.

[0088] The method in the embodiment is applied to a data invoker.

[0089] Before the data invoker sends a data operation request to the data hosting computing service, the data sender encrypts data, registers key information into the key management service, and then sends the encrypted data to the data hosting computing service. The key information can be generated according to an encryption algorithm or issued by the key management service.

[0090] The data invoker registers a plurality of operations on the encrypted data to the data hosting computing service, the data hosting computing service acquires authorization from the data sender for the plurality of operations, and accepts an authorization result returned by the data sender.

[0091] After the data hosting computing service receives the data operation request sent by the data invoker, the data operation request is parsed to obtain a target operation corresponding to the data operation request, the target operation is authorized and checked to determine whether the target operation has been authorized by the data sender, if the target operation has been authorized, target data and key information corresponding to the target operation are acquired, the target operation is performed, and an execution result is sent to the data invoker. If the target operation has not been authorized, a call failure notification message is sent to the data invoker.

[0092] The data processing method provided in the embodiments of the present disclosure is that a data calling party sends a data operation request to a data hosting computing service, so that the data hosting computing service acquires target data corresponding to a target operation from encrypted data sent by a data sending party and acquires key information of the target data from a key management service in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sending party, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data; and the data hosting computing service sends an execution result of the target operation to the data calling party. In the embodiments, the data sending party encrypts data and uploads the data to the data hosting computing service, and registers the key information to the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sending party before performing the target operation, performs the authorized target operation, and then sends the execution result to the data calling party, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different parties.

[0093] Corresponding to the application scenario of the method and the method provided in the embodiments of the present disclosure, the embodiments of the present disclosure further provide a data processing system. The data processing system comprises a data sending party, a data calling party and a data hosting computing service.

[0094] The data sending party is configured to encrypt data, register key information to a key information management service, send the encrypted data to the data hosting computing service, receive an authorization request for an operation on the encrypted data sent by the data hosting computing service, and send an authorization result to the data hosting computing service, so that the data hosting computing service determines that a target operation corresponding to a data operation request has been authorized based on the authorization result in response to the data operation request sent by the data calling party, acquires target data corresponding to the target operation from the encrypted data, acquires key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data calling party.

[0095] The data hosting computing service is configured to receive encrypted data sent by the data sending party, the key information of the encrypted data having been registered by the data sending party in the key information management service, in response to a data operation request of the data calling party, acquire target data corresponding to a target operation from the encrypted data in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sending party, and acquire key information of the target data from the key management service, perform a decryption operation on the target data based on the key information of the target data, perform the target operation on the decrypted target data, and send an execution result to the data calling party.

[0096] The data invoker is configured to send a data operation request to the data hosting computing service, so that the data hosting computing service acquires target data corresponding to a target operation from encrypted data sent by the data sender and acquires key information of the target data from the key management service, in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sender, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and receives an execution result of the target operation sent by the data hosting computing service.

[0097] The data processing system provided in the embodiment can ensure the security and privacy of data transmission and operation, and meet the needs of data sharing and circulation among different participants.

[0098] Corresponding to the application scenario and method of the method provided in the embodiment of the disclosure, the embodiment of the disclosure further provides a data processing apparatus. As shown in FIG. 5, a structural block diagram of a data processing apparatus according to an embodiment of the disclosure is shown. The apparatus includes:

[0099] The receiving module 501 is configured to receive encrypted data sent by the data sender, and key information of the encrypted data has been registered by the data sender in the key information management service.

[0100] The obtaining module 502 is configured to, in response to a data operation request of the data invoker, acquire target data corresponding to a target operation from the encrypted data and acquire key information of the target data from the key management service, in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sender.

[0101] The execution module 503 is configured to perform a decryption operation on the target data based on the key information of the target data, perform the target operation on the decrypted target data, and send an execution result to the data invoker.

[0102] The data processing apparatus provided in the embodiments of the present disclosure receives encrypted data sent by a data sender, key information of the encrypted data has been registered by the data sender in a key information management service; in response to a data operation request of a data invoker, in a case where it is determined that a target operation corresponding to the data operation request has been authorized by the data sender, target data corresponding to the target operation is obtained from the encrypted data, and key information of the target data is obtained from the key management service; a decryption operation is performed on the target data based on the key information of the target data, the target operation is performed on the decrypted target data, and an execution result is sent to the data invoker. In the embodiments, the data sender uploads data to a data hosting computing service after encrypting the data, and registers the key information in the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sender before performing the target operation, performs the authorized target operation, and then sends the execution result to the data invoker, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different participants.

[0103] In an implementation manner, the execution module 503 is configured to: in the sandbox environment, perform a decryption operation on the target data based on the key information of the target data, and perform the target operation on the decrypted target data.

[0104] In an implementation manner, the data processing apparatus is further configured to: before responding to the data operation request of the data invoker, in response to an operation registration request of the data invoker, register a data operation corresponding to the operation registration request; send registration information of the registered data operation to the data sender, so that the data sender authorizes the data operation based on the registration information; and receive an authorization result sent by the data sender.

[0105] In an implementation manner, the registration information includes at least one of the following: an operation name, a calling address, a version, a digest, a list of callable methods and corresponding input / output formats, a number of operation calls, an expiration time of the operation, and whether the product of the operation can be output.

[0106] In an implementation manner, the obtaining module 502 is configured to: obtain authorization state information of the target operation, and if the authorization state information indicates that authorization is successful, obtain registration information of the target operation in the data hosting computing service; based on the calling address in the registration information, obtain target data corresponding to the target operation from the encrypted data; and based on the identification information of the target data, obtain key information of the target data from the key management service.

[0107] The functions of each module in the embodiments of the present disclosure can be referred to the corresponding description in the above method, and have the corresponding beneficial effects, which will not be repeated here.

[0108] Corresponding to the application scenarios of the method and the method provided in the embodiments of the present disclosure, the embodiments of the present disclosure further provide a data processing apparatus. As shown in FIG. 6, a structural block diagram of a data processing apparatus according to an embodiment of the present disclosure is shown, which comprises:

[0109] The encryption module 601 is configured to encrypt the data and register the key information into a key information management service.

[0110] The sending module 602 is configured to send the encrypted data to a data hosting computing service.

[0111] The receiving module 603 is configured to receive an authorization request for an operation on the encrypted data sent by the data hosting computing service, and send an authorization result to the data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, determines that a target operation corresponding to the data operation request has been authorized based on the authorization result, acquires target data corresponding to the target operation from the encrypted data, acquires key information of the target data from the key management service, executes a decryption operation on the target data based on the key information of the target data, executes the target operation on the decrypted target data, and sends an execution result to the data invoker.

[0112] The data processing apparatus provided in the embodiments of the present disclosure encrypts the data and registers the key information into a key information management service, sends the encrypted data to a data hosting computing service, receives an authorization request for an operation on the encrypted data sent by the data hosting computing service, and sends an authorization result to the data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, determines that a target operation corresponding to the data operation request has been authorized based on the authorization result, acquires target data corresponding to the target operation from the encrypted data, acquires key information of the target data from the key management service, executes a decryption operation on the target data based on the key information of the target data, executes the target operation on the decrypted target data, and sends an execution result to the data invoker. In this embodiment, the data sender encrypts and uploads the data to the data hosting computing service, and registers the key information into the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sender before executing the target operation, executes the authorized target operation, and then sends an execution result to the data invoker, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different participants.

[0113] The functions of each module in the embodiments of the present disclosure can be referred to the corresponding description in the above method, and have the corresponding beneficial effects, which will not be repeated here.

[0114] Corresponding to the application scenarios of the method and the method provided in the embodiments of the present disclosure, the embodiments of the present disclosure further provide a data processing apparatus. As shown in FIG. 7, a structural block diagram of a data processing apparatus according to an embodiment of the present disclosure is shown, and the apparatus includes:

[0115] The sending module 701 is configured to send a data operation request to the data hosting computing service, so that the data hosting computing service, in a case where it is determined that a target operation corresponding to the data operation request is authorized by a data sender, acquires target data corresponding to the target operation from encrypted data sent by the data sender, acquires key information of the target data from a key management service, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data.

[0116] The receiving module 702 is configured to receive an execution result of the target operation sent by the data hosting computing service.

[0117] The data processing apparatus provided in the embodiments of the present disclosure sends a data operation request to the data hosting computing service, so that the data hosting computing service, in a case where it is determined that a target operation corresponding to the data operation request is authorized by a data sender, acquires target data corresponding to the target operation from encrypted data sent by the data sender, acquires key information of the target data from a key management service, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data; and receives an execution result of the target operation sent by the data hosting computing service. In this embodiment, the data sender encrypts and uploads data to the data hosting computing service, and registers key information to the key information management service. The data hosting computing service confirms whether the target operation is authorized by the data sender before performing the target operation, performs the authorized target operation, and then sends the execution result to the data invoker, thereby ensuring the security and privacy of data transmission and operation, and meeting the needs of data sharing and circulation among different participants.

[0118] The functions of each module in the embodiments of the present disclosure can be referred to the corresponding description in the above method, and have the corresponding beneficial effects, which will not be described here again.

[0119] FIG. 8 is a block diagram of an electronic device for implementing the embodiments of the present disclosure. As shown in FIG. 8, the electronic device includes a memory 810 and a processor 820, and the memory 810 stores a computer program that can run on the processor 820. The processor 820 implements the method in the above embodiments when executing the computer program. The number of the memory 810 and the processor 820 can be one or more.

[0120] The electronic device further includes:

[0121] The communication interface 830 is configured to communicate with external devices and perform data interaction transmission.

[0122] If the memory 810, the processor 820 and the communication interface 830 are implemented independently, the memory 810, the processor 820 and the communication interface 830 can be connected to each other through a bus and complete communication between each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in FIG. 8, but it does not mean that there is only one bus or only one type of bus.

[0123] Optionally, in a specific implementation, if the memory 810, the processor 820 and the communication interface 830 are integrated on a chip, the memory 810, the processor 820 and the communication interface 830 can complete communication between each other through an internal interface.

[0124] The embodiment of the present disclosure provides a computer readable storage medium, which stores a computer program, and the program is executed by a processor to implement the method provided in the embodiment of the present disclosure.

[0125] The embodiment of the present disclosure provides a computer program product, which includes a computer program, and the computer program is executed by a processor to implement the method provided in the embodiment of the present disclosure.

[0126] The embodiment of the present disclosure also provides a chip, which includes a processor, is used for calling and running instructions stored in a memory, so that a communication device installed with the chip executes the method provided in the embodiment of the present disclosure.

[0127] The embodiment of the present disclosure also provides a chip, which includes an input interface, an output interface, a processor and a memory, the input interface, the output interface, the processor and the memory are connected through an internal connection path, and the processor is used for executing code in the memory, and when the code is executed, the processor is used for executing the method provided in the embodiment of the present disclosure.

[0128] It is to be understood that the above-mentioned processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. It is to be noted that the processor can be a processor supporting an advanced RISC machine (ARM) architecture.

[0129] Further, the memory can include a read-only memory and a random access memory, optionally. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. The non-volatile memory can include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM), or a flash memory, for example. The volatile memory can include a random access memory (RAM) used as an external cache. Many forms of RAM are available by way of example but not limitation. For example, a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a SyncLink DRAM (SLDRAM), and a direct Rambus RAM (DR RAM) can be used.

[0130] In the above-described embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded on a computer, all or part of the processes or functions according to the present disclosure are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium.

[0131] In the description of the present disclosure, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present disclosure. Also, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, different embodiments or examples described in the present disclosure and features of different embodiments or examples can be combined and combined by those skilled in the art without contradiction.

[0132] In addition, the terms "first", "second", etc. are used only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the technical features indicated. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "a plurality of" is two or more, unless otherwise explicitly specified.

[0133] Any process or method described in the flowchart or otherwise described herein can be understood as a representation of code including one or more executable instructions for performing a specific logical function or process. Also, the scope of the preferred embodiments of the present disclosure includes additional implementations, in which the functions can be performed in an order other than that shown or discussed, including in a substantially simultaneous manner or in reverse order, according to the functions involved.

[0134] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as a list of executable instructions for implementing the logic function, which can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus, such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions, or in conjunction with these instruction execution systems, devices or apparatus.

[0135] It should be understood that each part of the present disclosure can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above-mentioned embodiment method can be completed by a program instructing the relevant hardware, which can be stored in a computer readable storage medium, and the program includes one of the steps of the method embodiment or a combination thereof when executed.

[0136] In addition, each functional unit in various embodiments of the present disclosure can be integrated into one processing module, or each unit can exist physically independently, or two or more units can be integrated into one module. The above integrated module can be realized in the form of hardware or in the form of a software functional module. The above integrated module, if realized in the form of a software functional module and sold or used as an independent product, can also be stored in a computer readable storage medium. The storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0137] The above is only exemplary embodiments of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art can easily think of various changes or replacements within the technical range disclosed in the present disclosure, which should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A data processing method, wherein, The method is applied to a data hosting computing service located in a trusted execution environment, and comprises: receiving encrypted data sent by a data sender, key information of the encrypted data being registered by the data sender in a key information management service; in response to a data operation request of a data invoker, obtaining target data corresponding to a target operation of the data operation request from the encrypted data and obtaining key information of the target data from the key management service, in a case where it is determined that the target operation has been authorized by the data sender; performing a decryption operation on the target data based on the key information of the target data, performing the target operation on the decrypted target data, and sending an execution result to the data invoker.

2. The method of claim 1, wherein, The method comprises: performing a decryption operation on the target data based on the key information of the target data, performing the target operation on the decrypted target data, and sending an execution result to the data invoker.

3. The method of claim 1 or 2, wherein, The method comprises: performing a decryption operation on the target data based on the key information of the target data, performing the target operation on the decrypted target data, and sending an execution result to the data invoker. Before responding to the data operation request of the data invoker, the method further comprises: in response to an operation registration request of a data invoker, registering a data operation corresponding to the operation registration request; 4. The method of claim 3, wherein, sending registration information of the registered data operation to the data sender, so that the data sender authorizes the data operation based on the registration information; receiving an authorization result sent by the data sender.

5. The method according to any one of claims 1 to 4, wherein, The registration information comprises at least one of the following: an operation name, a calling address, a version, a digest, a list of callable methods and corresponding input / output formats, a number of operation calls, an expiration time of the operation, and whether the product of the operation can be output. The method comprises: obtaining authorization state information of the target operation, and if the authorization state information indicates that authorization is successful, obtaining registration information of the target operation in the data hosting computing service; 6. A data processing method, wherein, based on the calling address in the registration information, obtaining target data corresponding to the target operation from the encrypted data; based on identification information of the target data, obtaining key information of the target data from the key management service. The method is applied to a data sender and comprises: encrypting data and registering key information in a key information management service; sending encrypted data to a data hosting computing service; receive an authorization request for an operation on the encrypted data sent by the data hosting computing service, and send an authorization result to the data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, determines that a target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation in the encrypted data, and obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data invoker.

7. A data processing method, wherein, The method is applied to a data invoker, and includes: sending a data operation request to a data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, determines that a target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation in the encrypted data, and obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data invoker. receiving an execution result of the target operation sent by the data hosting computing service.

8. A data processing system, wherein, The system includes a data sender, a data invoker, and a data hosting computing service. The data hosting computing service is configured to receive encrypted data sent by a data sender, and key information of the encrypted data has been registered in a key information management service by the data sender. In response to a data operation request of a data invoker, the data hosting computing service obtains target data corresponding to a target operation in the encrypted data and obtains key information of the target data from the key management service in a case where the target operation corresponding to the data operation request has been authorized by the data sender. The data hosting computing service performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data invoker. The data sender is configured to encrypt data and register key information in a key information management service, and send the encrypted data to a data hosting computing service. receive an authorization request for an operation on the encrypted data sent by the data hosting computing service, and send an authorization result to the data hosting computing service, so that the data hosting computing service, in response to a data operation request sent by a data invoker, determines that a target operation corresponding to the data operation request has been authorized based on the authorization result, obtains target data corresponding to the target operation in the encrypted data, and obtains key information of the target data from the key management service, performs a decryption operation on the target data based on the key information of the target data, performs the target operation on the decrypted target data, and sends an execution result to the data invoker. The data invoker is configured to send a data operation request to the data hosting computing service, so that the data hosting computing service acquires target data corresponding to a target operation from encrypted data sent by the data sender and acquires key information of the target data from a key management service, in a case where it is determined that the target operation corresponding to the data operation request is authorized by the data sender, performs a decryption operation on the target data based on the key information of the target data, and performs the target operation on the decrypted target data. The data invoker receives an execution result of the target operation sent by the data hosting computing service.

9. An electronic device, comprising: The electronic device includes a memory, a processor, and a computer program stored in the memory, and the processor implements the method of any one of claims 1-7 when executing the computer program.

10. A computer readable storage medium, wherein, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method of any one of claims 1-7.

11. A computer program product, wherein, The computer program product includes a computer program, and the computer program is executed by the processor to implement the method of any one of claims 1-7.

Images