TWI812366B - A data sharing method, device, equipment and storage medium - Google Patents

Abstract

Embodiments of the present invention provide a data sharing method, device, equipment and storage medium, belonging to the field of data processing technology. The method includes: the querying party system sends a query request to the data party system through the coordinator system. The data party system obtains the corresponding response sample attributes based on the target encrypted sample identification, then uses the querying party's public key to encrypt the response sample attributes, obtains the encrypted sample attributes, and then generates query results based on the target encrypted sample identification and encrypted sample attributes. The data party system sends the query results to the query party system through the coordinator system. The querying party's system decrypts the encrypted sample attributes in the query result through the querying party's private key, and obtains the target sample attributes corresponding to the target encrypted sample identification. The coordinator system connects the querying party system and each data party system, avoiding the querying party system from directly sending query requests to each data party system, ensuring the privacy of the querying party's information and the privacy of the data party's system data.

Description

A data sharing method, device, equipment and storage medium

Embodiments of the present invention belong to the field of data processing technology, and particularly relate to a data sharing method, device, equipment and storage medium.

In the scenario of the Internet of Everything, the data federation between different industries, institutions, and departments forms a huge data alliance. There is a huge need for sharing of data and information held by each other between different organizations. However, more and more institutions have strengthened their data protection requirements in data cooperation. In the current environment that lacks data protection, data sharing among various institutions cannot be achieved. This makes it impossible for data to be effectively shared and flowed between different industries, institutions, and departments, and the value of the data itself cannot be fully utilized.

Existing data sharing technologies are mainly aimed at the same organization and realize data sharing between different business systems. For different industries and different institutions, data sharing cannot be effectively achieved without leaking their own data.

Embodiments of the present invention provide a data sharing method, device, equipment and storage medium for realizing data sharing between different industries, institutions and departments.

On the one hand, embodiments of the present invention provide a data sharing method, which method includes: Receive a query request sent by the querying party's system, which includes the target encrypted sample identification and the querying party's public key; Send the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identification, and uses the public key of the querying party to encrypt the response sample attributes, Obtain the encrypted sample attributes, and generate query results based on the target encrypted sample identification and the encrypted sample attributes; Receive query results sent by at least one data party system, and send the received query results to the query party system, so that the query party system decrypts the encrypted sample attributes in each query result using the query party's private key to obtain at least A response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

On the one hand, embodiments of the present invention provide a data sharing method, which method includes: Receive a query request sent by the coordinator system. The query request is sent by the query party system to the coordinator system. The query request includes the target encrypted sample identification and the query party's public key; Based on the target encrypted sample identification, obtain the corresponding response sample attributes, use the public key of the query party to encrypt the response sample attributes, obtain the encrypted sample attributes, and generate a query based on the target encrypted sample identification and the encrypted sample attributes. result; Send the query result to the coordinator system, so that the coordinator system sends the query result to the query party system, and instructs the query party system to decrypt the encrypted sample attributes in the query result using the query party's private key to obtain at least A response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

On the one hand, embodiments of the present invention provide a data sharing device, which includes: The first receiving module is used to receive a query request sent by the querying party's system. The query request includes the target encrypted sample identification and the querying party's public key; The first sending module is used to send the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identification, and uses the public key of the query party Encrypt the response sample attributes to obtain the encrypted sample attributes, and generate query results based on the target encrypted sample identification and the encrypted sample attributes; The first receiving module is also used to receive query results sent by at least one data party system, and send the received query results to the query party system, so that the query party system can process each query result through the query party's private key. Decrypt the encrypted sample attributes in, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

Optionally, the at least one data party system is each data party system communicatively connected with the coordinator system; or, The at least one data party system is selected from each of the data party systems according to data quality.

Optionally, the query request also includes the target attribute category; The first sending module is specifically used for: The query request is sent to at least one data party system, so that the at least one data party system obtains corresponding response sample attributes based on the target encrypted sample identification and the target attribute category respectively.

Optionally, a recording module is also included, which is specifically used for: Record the identity information of the querying party system, the querying request of the querying party system, and the received query results.

Optionally, the target encrypted sample identification is obtained by encrypting the target sample identification using an encryption algorithm, and the encrypting algorithm used by the querying party system and each data party system is the same.

On the one hand, embodiments of the present invention provide a data sharing device, which includes: The second receiving module is used to receive a query request sent by the coordinator system. The query request is sent by the query party system to the coordinator system. The query request includes the target encrypted sample identification and the query party's public key; The encryption module is used to encrypt the sample identification based on the target, obtain the corresponding response sample attributes, and use the public key of the query party to encrypt the response sample attributes, obtain the encrypted sample attributes, and encrypt the sample identification based on the target and the Encrypt sample attributes and generate query results; The second sending module is used to send the query result to the coordinating party system, so that the coordinating party system sends the query result to the querying party system, and instructs the querying party system to enter the query result through the querying party's private key. Decrypt the encrypted sample attributes, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

Optionally, the encryption module is specifically used for: If there is a reference encrypted sample identifier matching the target encrypted sample identifier in the data source system, at least one sample attribute corresponding to the reference encrypted sample identifier will be used as the response sample attribute.

Optionally, the encryption module is also used for: If there is no reference encrypted sample ID matching the target encrypted sample ID in the data party's system, a random sequence is generated and used as the response sample attribute.

Optionally, the encryption module is also used for: If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party system, and the random sequence generation probability corresponding to the data party system is greater than the preset threshold, a random sequence is generated.

Optionally, the query request also includes the target attribute category; This encryption module is also used for: If there is a reference encrypted sample ID that matches the target encrypted sample ID in the data provider's system, the sample attribute that matches the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID will be used as the response sample attribute.

Optionally, the query results also include optional field information; This encryption module is also used for: The querying party's public key is used to encrypt the response sample attributes and optional field information to obtain the encrypted sample attributes.

Optionally, the target encrypted sample identification is obtained by encrypting the target sample identification using an encryption algorithm, and the encrypting algorithm used by the querying party system and each data party system is the same.

On the one hand, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the above data sharing method are implemented. .

On the one hand, embodiments of the present invention provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the steps of the above data sharing method.

On the one hand, embodiments of the present invention provide a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer device, the computer program causes the Computer equipment performs the steps of the data sharing method described above.

In the embodiment of the present invention, the querying party system sends a query request to the coordinator system, and the coordinator system then sends the query request to the data provider system. The data party system obtains the corresponding response sample attributes based on the target encrypted sample identification, then uses the querying party's public key to encrypt the response sample attributes, obtains the encrypted sample attributes, and then generates query results based on the target encrypted sample identification and encrypted sample attributes. The data party system sends the query results to the coordinator system, and the coordinator system sends the query results to the query party system. The querying party's system decrypts the encrypted sample attributes in the query result using the querying party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample identification from at least one response sample attribute. The coordinator system connects the querying party system and each data party system, avoiding the querying party system from directly sending query requests to each data party system, ensuring the privacy of the querying party's information and the privacy of the data party's system data. At the same time, since the query request sent by the query party is encrypted data, the query results sent by each data party system are also encrypted data. Therefore, the coordinator system does not know the specific data received and sent, which guarantees the query request and query The safety of the results.

In order to help the review committee understand the technical features, content and advantages of the present invention and the effects it can achieve, the present invention is described in detail below in the form of embodiments with the accompanying drawings and attachments, and the drawings used therein are , its purpose is only for illustration and auxiliary description, and may not represent the actual proportions and precise configurations after implementation of the present invention. Therefore, the proportions and configuration relationships of the attached drawings should not be interpreted or limited to the actual implementation of the present invention. The scope shall be stated first.

In the description of the embodiments of the present invention, it should be understood that the terms "length", "width", "upper", "lower", "front", "back", "left", "right", "vertical" ", "level", "top", "bottom", "inside", "outside", etc. indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of description and simplification of the embodiments of the present invention. The description does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore is not to be construed as a limitation of the invention.

In addition, the terms “first” and “second” are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the quantity of indicated technical features. Thus, features defined as “first” and “second” may explicitly or implicitly include one or more of the described features. In the description of the embodiments of the present invention, "plurality" means two or more than two, unless otherwise explicitly and specifically limited.

In the embodiments of the present invention, unless otherwise expressly stipulated and limited, the terms "installation", "connection", "connection", "fixing" and other terms should be understood in a broad sense. For example, it can be a fixed connection or a removable connection. Disassembly and connection, or integration; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be an internal connection between two elements or an interaction between two elements. For those with ordinary knowledge in the art, the specific meanings of the above terms in the embodiments of the present invention can be understood according to specific circumstances.

In order to make the purpose, technical solutions and beneficial effects of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention.

Referring to Figure 1, it is a system architecture diagram applicable to the embodiment of the present invention. The system architecture at least includes a terminal device 101, an inquiry party system 102, a coordinator system 103, and a data party system 104~1, a data party system 104~2, ..., data party system 104~X, where X is an integer greater than 0.

The terminal device 101 is installed with a target application for querying data. The application may be a pre-installed client, a web application, or a small program embedded in other applications. The terminal device 101 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc., but is not limited thereto.

The query party system 102, the coordinator system 103, the data party system 104~1 to the data party system 104~X are the backend servers of the target application and provide services for the target application. The querying party system 102 may be an independent entity server, a server cluster or a distributed system composed of multiple entity servers, or it may provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, Cloud servers for basic cloud computing services such as network services, cloud communications, intermediary software services, functional variable name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms.

The coordinator system 103 can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, Cloud servers for basic cloud computing services such as network services, cloud communications, intermediary software services, functional variable name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. It should be noted that the number of the querying party system 102 and the coordinator system 103 may also be multiple, and the present invention does not specifically limit the number of the querying party system 102 and the coordinator system 103.

The data party system 104~1 to the data party system 104~X can be an independent physical server, a server cluster or a distributed system composed of multiple physical servers, or they can provide cloud services, cloud databases, Cloud computing, cloud functions, cloud storage, network services, cloud communications, intermediary software services, functional variable name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms and other basic clouds Cloud server for computing services.

The terminal device 101 and the inquiry party system 102 can be connected directly or indirectly through wired or wireless communication methods, and the present invention is not limited here. The inquiry party system 102 and the coordinator system 103 can be connected directly or indirectly through wired or wireless communication methods, and the present invention is not limited here. The coordinator system 103 is connected to the data party systems 104~1 to 104~X respectively, and can be connected directly or indirectly through wired or wireless communication methods. The present invention is not limited here.

In response to the user's data query operation, the terminal device 101 sends a data query command to the querying system 102. The data query command includes the target sample identifier.

The querying system 102 receives the data query instruction, uses an encryption algorithm to encrypt the target sample identification, and obtains the target encrypted sample identification. The querying party system 102 sends a query request to the coordinator system 103, where the query request includes the target encrypted sample identification and the querying party's public key. The coordinator system 103 receives the inquiry request sent by the inquiry party system 102, and sends inquiry requests to the data party systems 104~1,..., data party systems 104~X respectively.

At least one of the data party systems 104 ~ 1 to 104 ~ Encrypt, obtain the encrypted sample attributes, and generate query results based on the target encrypted sample identification and encrypted sample attributes.

The above-mentioned at least one data party system sends the query results to the coordinator system 103 respectively, and the coordinator system 103 sends each query result to the query party system 102.

The querying party system 102 decrypts the encrypted sample attributes in each query result using the querying party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

In practical applications, the solutions in the embodiments of the present invention are suitable for the data sharing query requirements of different industries. For example, the establishment of a data security sharing alliance in the financial industry can be safely shared within the alliance and ensure the security of the privacy data of all parties.

Based on the system architecture diagram shown in Figure 1, the embodiment of the present invention provides a process of a data sharing method, as shown in Figure 2. The process of this method consists of the querying party system 102, the coordinator system 103 and the data sharing system shown in Figure 1. The interactive execution from party system 104~1 to data party system 104~X includes the following steps: Step S201: The querying system sends a query request to the coordinator system.

Specifically, the query request includes the target encrypted sample identification and the querying party's public key. The target encrypted sample identifier is obtained by encrypting the target sample identifier using an encryption algorithm, where the target sample identifier can be an ID number, a phone number, etc. The querying party system uses the same encryption algorithm as each data party system. Among them, the encryption algorithm can be a symmetric encryption algorithm, an asymmetric encryption algorithm, or a hash algorithm. The encryption algorithm is used to encrypt the target sample identification to obtain the target encrypted sample identification, which enhances the security of query information.

The querying party's system determines the querying party's public key and the querying party's private key based on an asymmetric encryption algorithm. Among them, the asymmetric encryption algorithm can be any one of RSA algorithm, Elgamal algorithm, elliptic curve encryption algorithm, etc.

In one possible implementation, see Figure 3. The query request includes the target encrypted sample identification and the public key of the querying party.

In another possible implementation, see Figure 4. The query request includes the target encrypted sample identification, the querying party's public key, and the target attribute category. Target attribute categories can limit different scenarios and determine the attributes of response samples in specific scenarios.

Step S202: The coordinator system sends a query request to the data provider system.

Specifically, the coordinator system receives the query request sent by the querying party system, and records the querying party's identity information and the corresponding query request.

The coordinator system can send the query request to each data party system in the data sharing network in the form of broadcast. The coordinator system can also select the data party system for broadcast according to a certain probability value.

In one possible implementation, the coordinator system sends a query request to each data party system connected through communication.

For example, set up three data party systems to connect to the coordinator system, namely data party system 1, data party system 2, and data party system 3. The coordinator system sends query requests to data party system 1, data party system 2, and data party system 3 respectively.

In the embodiment of the present invention, the coordinator system sends query requests to each data party system connected through communication, which can effectively improve the matching degree of the query requests and improve the quality of the query results.

In another possible implementation, the coordinator system sends a query request to some data party systems connected through communication.

In the first case, some data party systems are randomly selected by the coordinator system from various data party systems.

Specifically, the coordinator system generates a random number for each data party system, compares the random number corresponding to each data party system with the preset value, and uses the data party system corresponding to the random number that meets the preset conditions as part of the data. square system.

For example, set up three data party systems to connect to the coordinator system, namely data party system 1, data party system 2, and data party system 3.

The coordinator system generates a random number for each data party system. The random numbers corresponding to data party system 1, data party system 2, and data party system 3 are 0.6, 0.4, and 0.9 respectively. Compare each random number with the preset value 0.5. The random number 0.6 corresponding to data source system 1 is greater than 0.5, and the random number 0.9 corresponding to data source system 3 is greater than 0.5. Therefore, data party system 1 and data party system 3 serve as some of the selected data party systems, and the coordinator system sends query requests to data party system 1 and data party system 3.

In the second case, some data party systems are selected by the coordinator system from various data party systems based on data quality.

Specifically, each data provider system determines the corresponding data quality score based on the data quality in its respective system. Data quality is related to the data value of the data party's system and the credit of the data party. Based on the data quality scores of each data party system, the coordinator system uses the data party systems corresponding to the data quality scores that meet the preset conditions as partial data party systems.

For example, set up three data party systems to connect to the coordinator system, namely data party system 1, data party system 2, and data party system 3. The data quality scores corresponding to each data source system are 90 points, 78 points, and 93 points respectively.

Set the default condition to select data party systems with a data quality score greater than 85 points as partial data party systems. Therefore, select data party system 1 and data party system 3 as partial data party systems, and send data to data party system 1 and data party system 3. System 3 sends a query request.

It should be noted that in addition to selecting the data party system to receive the query request from each data party system according to the data quality, it can also be based on factors such as the data party's credit and network delay.

In the embodiment of the present invention, the coordinator system sends query requests to some data party systems connected by communication, which effectively reduces the network load. When some data party systems are selected from various data party systems based on data quality, while reducing the network load, it also ensures the matching degree of query requests and improves the quality of query results.

Step S203: The data party system obtains the corresponding response sample attributes based on the target encrypted sample identification.

Specifically, the data source system queries the desensitization database according to the target encrypted sample identification and obtains the response sample attributes.

Embodiment 1: When the query request includes the target encrypted sample identifier and the querying party's public key, if there is a reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, at least one corresponding to the reference encrypted sample identifier will be Sample attributes as response sample attributes.

If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party system, in one possible implementation, the data party system generates a random sequence and uses the random sequence as a response sample attribute.

Another possible implementation is that the data side system generates a random number, which is the probability of generating a random sequence, and then compares the random number with a preset threshold. If the random number is greater than the preset threshold, then the data side system generates Random sequence, and use this random sequence as the response sample attribute; otherwise, the data provider system will not perform any processing.

For example, set the data party system to include data party system 1 and data party system 2, and the target encryption sample identifier is aa.

As shown in Table 1, the data source system 1 includes three sets of reference encrypted sample identifiers. Each set of reference encrypted sample identifiers corresponds to two sample attributes, namely whether it is A and whether it is B.

The three sets of reference encrypted sample identifiers are aa, bb, and cc, and the sample attributes corresponding to the reference encrypted sample identifier aa are A and B respectively. The sample attributes corresponding to the reference encrypted sample identifier bb are non-A and non-B respectively. The sample attributes corresponding to the reference encrypted sample identifier cc are A and non-B respectively. Table 1. Reference encryption sample identification Is it A Is it B aa A B bb Not A Not B cc A Not B The data party system 1 queries Table 1 based on the target encrypted sample ID aa, determines that there is a reference encrypted sample ID matching the target encrypted sample ID aa in Table 1, and sets the sample attributes "A and B" corresponding to the reference encrypted sample ID aa as Response sample properties.

As shown in Table 2, the data source system 2 includes two sets of reference encrypted sample identifiers, and each set of reference encrypted sample identifiers corresponds to a sample attribute, that is, whether it is A.

The two sets of reference encrypted sample identifiers are bb and cc respectively, and the sample attribute corresponding to the reference encrypted sample identifier bb is non-A. The sample attribute corresponding to the reference encrypted sample identifier cc is A. Table 2. Reference encryption sample identification Is it A bb Not A cc A The data party system 2 queries Table 2 based on the target encrypted sample identifier aa and determines that there is no reference encrypted sample identifier matching the target encrypted sample identifier aa in Table 2. Then the data party system 2 generates a random sequence and uses the random sequence as a response. Sample properties.

Embodiment 2: When the query request includes the standard encrypted sample ID, the querying party's public key and the target attribute category, if there is a reference encrypted sample ID that matches the target encrypted sample ID in the data party's system, the reference encrypted sample ID will be used Among the corresponding at least one sample attribute, the sample attribute that matches the target attribute category is used as the response sample attribute.

If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party system, in one possible implementation, the data party system generates a random sequence and uses the random sequence as a response sample attribute.

Another possible implementation is that the data side system generates a random number, which is the probability of generating a random sequence, and then compares the random number with a preset threshold. If the random number is greater than the preset threshold, then the data side system Generate a random sequence and use the random sequence as the response sample attribute; otherwise, the data provider system will not perform any processing.

For example, the data party system includes data party system 1 and data party system 2, the target encryption sample identifier is aa, and the target attribute category is whether it is B.

The data in the data source system 1 is shown in Table 1. The data source system 1 queries Table 1 based on the target encrypted sample ID aa and determines that there is a reference encrypted sample ID matching the target encrypted sample ID aa in Table 1, and then selects the sample from the two sample attributes corresponding to the reference encrypted sample ID aa. Attribute "B", as a response sample attribute.

The data in the data source system 2 is shown in Table 2. The data party system 1 queries Table 2 based on the target encrypted sample identifier aa and determines that there is no reference encrypted sample identifier matching the target encrypted sample identifier aa in Table 2. Then the data party system 2 generates a random number 0.3 and converts the random number Compared with the preset threshold 0.5, since the random number 0.3 is smaller than the preset threshold 0.5, the data source system 2 does not perform any processing.

In the embodiment of the present invention, the target attribute category limits different scenarios. By filtering the sample attributes through the target attribute category and obtaining the response sample attributes, the sample attributes can be matched more accurately and more accurate response sample attributes can be obtained. When there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, a random sequence can be generated based on probability and returned, effectively reducing the network load and improving network operation efficiency.

Step S204: The data party system uses the query party's public key to encrypt the response sample attributes to obtain the encrypted sample attributes.

In the embodiment of the present invention, the data party system can use the query party's public key to encrypt only the response sample attributes and obtain the encrypted sample attributes. The data party system can also use the query party's public key to encrypt the response sample attributes and optional field information. Encrypt and obtain the encrypted sample attributes.

Specifically, the optional field information can be any one or more combinations of timestamps, random numbers, random strings, etc.

In the embodiment of the present invention, when the response sample attributes are the same, different encrypted sample attributes are obtained by encrypting the response sample attributes and optional field information, which can effectively solve the problem of cracking after a third party intercepts the encrypted sample attributes. The issue of obtaining response sample attributes improves security during data transmission.

Step S205: The data provider system generates query results based on the target encrypted sample identification and encrypted sample attributes.

One possible implementation, see Figure 5, when the data party system uses the public key of the query party to encrypt the response sample attributes, the query results include the target encrypted sample identification and the encrypted sample attributes, where the encrypted sample attributes include the response sample attributes.

Another possible implementation, see Figure 6, when the data party system uses the public key of the query party to encrypt the response sample attributes and optional field information, the query results include the target encrypted sample identification and the encrypted sample attributes, where the encryption Sample properties include response sample properties and optional field information.

Step S206: The data party system sends the query results to the coordinator system.

The coordinator system receives the query results sent by the data party system, and records each data party system and the corresponding query results sent. At the same time, the previously recorded identity information of the inquiry party and the inquiry request of the inquiry party are corresponding to the inquiry results sent by each data party system.

In the embodiment of the present invention, the coordinator system records the identity information of the inquiry party, the inquiry request of the inquiry party, and each inquiry result corresponding to the inquiry request, ensuring that the inquiry information is traceable and cannot be tampered with, which facilitates information verification and review.

Step S207: The coordinator system sends the query result to the querying system.

Optionally, the coordinator system also provides a billing function, charging corresponding fees to the inquiry party, and paying corresponding fees to the data party system that provides the query results, which effectively increases the enthusiasm of the data party system to participate and promotes data sharing. development.

Step S208: The querying party's system decrypts the encrypted sample attributes in the query result using the querying party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

If the encrypted sample attributes only include the response sample attributes, the querying party's system decrypts the encrypted sample attributes using the querying party's private key, that is, obtains the response sample attributes.

If the encrypted sample attributes include response sample attributes and optional field information, the querying party's system decrypts the encrypted sample attributes using the querying party's private key to obtain the concatenated field information of the response sample attributes and optional field information. Remove the optional field information from the splicing field information to obtain the response sample attributes.

Further, for each response sample attribute, if the response sample attribute is the sample attribute corresponding to the reference encrypted sample ID obtained from the query in the data provider system, then the response sample attribute is used as the target sample attribute corresponding to the target encrypted sample ID. . If the response sample attribute is a random sequence of response sample attributes, the response sample attribute is removed.

In the embodiment of the present invention, the system composed of the inquiry party system, the coordinator system and each data party system realizes the sharing of data in each data party system without leaving the database. The querying party system can only obtain the query results, but it is not clear which data party system provides the query results. At the same time, the response sample attributes obtained by the querying system are only known by the querying system and the data provider system, and cannot be obtained by any third party, thereby improving the security of query information and protecting the privacy of the identity information of the querying system.

The data party system only provides query results, but it is not clear which query party system provides the query results. At the same time, the data party system cannot know the query results generated by other data party systems, thereby protecting the data privacy of the data party system.

The coordinator system connects the querying party system and each data party system, avoiding the querying party system from directly sending query requests to each data party system, ensuring the privacy of the querying party's information and the privacy of the data party's system data. At the same time, since the query request sent by the query party is encrypted data, the query results sent by each data party system are also encrypted data. Therefore, the coordinator system does not know the specific data received and sent, which guarantees the query request and query The safety of the results.

In order to better explain the embodiments of the present invention, the following takes a specific embodiment scenario as an example to introduce the process of a data sharing method provided by embodiments of the present invention, as shown in Figure 7: Step S301: The querying party system sends a query request to the coordinator system, where the query request includes the target encrypted sample identification, the querying party's public key and the target attribute category; Step S302: The coordinator system records the identity information of the querying party and the querying request of the querying party; Step S303: The coordinator system sends a query request to the data provider system; Step S304: The data party system determines whether there is a reference encrypted sample identifier that matches the target encrypted sample identifier. If so, execute step S305; otherwise, execute step S306; Step S305: The data source system uses the sample attribute matching the target attribute category among at least one sample attribute corresponding to the reference encrypted sample identifier as the response sample attribute, and jumps to step S308; Step S306: The data source system generates a random number and determines whether the random number is greater than the preset threshold. If so, execute step S307; otherwise, end; Step S307: The data source system generates a random sequence and uses the random sequence as a response sample attribute; Step S308: The data party system uses the query party's public key to encrypt the response sample attributes and optional field information to obtain the encrypted sample attributes.

Among them, optional field information can be timestamps, random numbers, random strings, etc.

Step S309: The data provider system generates query results based on the target encrypted sample identification and encrypted sample attributes.

Step S310: The data party system sends the query results to the coordinator system.

Step S311: The coordinator system records each data party system and the corresponding query results sent.

Step S312: The coordinator system sends the query result to the querying system.

Step S313: The querying party decrypts the encrypted sample attributes in the query result using the querying party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute.

In the embodiment of the present invention, the system composed of the inquiry party system, the coordinator system and each data party system realizes the sharing of data in each data party system without leaving the database. The coordinator system connects the querying party system and each data party system, avoiding the querying party system from directly sending query requests to each data party system, ensuring the privacy of the querying party's information and the privacy of the data party's system data. At the same time, since the query request sent by the query party is encrypted data, the query results sent by each data party system are also encrypted data. Therefore, the coordinator system does not know the specific data received and sent, which guarantees the query request and query The safety of the results.

The target attribute category limits different scenarios. By filtering the sample attributes through the target attribute category and obtaining the response sample attributes, the sample attributes can be matched more accurately and more accurate response sample attributes can be obtained. When there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, a random sequence can be generated based on probability and returned, effectively reducing the network load and improving network operation efficiency. When the response sample attributes are the same, by encrypting the response sample attributes and optional field information to obtain different encrypted sample attributes, it can effectively solve the problem of a third party intercepting the encrypted sample attributes and cracking the response sample attributes. Improved security during data transmission. The coordinator system records the identity information of the inquiry party, the inquiry request of the inquiry party, and each inquiry result corresponding to the inquiry request, ensuring that the inquiry information is traceable and cannot be tampered with, making it easy for information verification and review.

Based on the same technical concept, an embodiment of the present invention provides a data sharing device. As shown in Figure 8, the data sharing device 800 includes: The first receiving module 801 is used to receive a query request sent by the querying party system. The query request includes the target encrypted sample identification and the querying party's public key; The first sending module 802 is used to send the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identification, and uses the query party's public funds. Use the key to encrypt the response sample attributes, obtain the encrypted sample attributes, and generate query results based on the target encrypted sample identification and the encrypted sample attributes; The first receiving module 801 is also used to receive query results sent by at least one data party system, and send the received query results to the query party system, so that the query party system can separately process each query through the query party's private key. Decrypt the encrypted sample attributes in the result, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

Optionally, the at least one data party system is each data party system communicatively connected with the coordinator system; or, The at least one data party system is selected from each of the data party systems according to data quality.

Optionally, the query request also includes the target attribute category; The first sending module 802 is specifically used for: The query request is sent to at least one data party system, so that the at least one data party system obtains corresponding response sample attributes based on the target encrypted sample identification and the target attribute category respectively.

Optionally, a recording module 803 is also included, and the recording module 803 is specifically used for: Record the identity information of the querying party system, the querying request of the querying party system, and the received query results.

Optionally, the target encrypted sample identification is obtained by encrypting the target sample identification using an encryption algorithm, and the encrypting algorithm used by the querying party system and each data party system is the same.

Based on the same technical concept, an embodiment of the present invention provides a data sharing device. As shown in Figure 9, the data sharing device 900 includes: The second receiving module 901 is used to receive a query request sent by the coordinator system. The query request is sent by the query party system to the coordinator system. The query request includes the target encrypted sample identification and the query party's public key; The encryption module 902 is used to encrypt the sample identification based on the target, obtain the corresponding response sample attributes, and use the public key of the query party to encrypt the response sample attributes, obtain the encrypted sample attributes, and encrypt the sample identification and The encrypted sample attributes generate query results; The second sending module 903 is used to send the query result to the coordinating party system, so that the coordinating party system sends the query result to the querying party system, and instructs the querying party system to use the querying party's private key to query the query result. Decrypt the encrypted sample attributes in, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

Optionally, the encryption module 902 is specifically used for: If there is a reference encrypted sample identifier matching the target encrypted sample identifier in the data source system, at least one sample attribute corresponding to the reference encrypted sample identifier will be used as the response sample attribute.

Optionally, the encryption module 902 is also used for: If there is no reference encrypted sample ID matching the target encrypted sample ID in the data party's system, a random sequence is generated and used as the response sample attribute.

Optionally, the encryption module 902 is also used for: If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party system, and the random sequence generation probability corresponding to the data party system is greater than the preset threshold, a random sequence is generated.

Optionally, the query request also includes the target attribute category; The encryption module 902 is also used for: If there is a reference encrypted sample ID that matches the target encrypted sample ID in the data provider's system, the sample attribute that matches the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID will be used as the response sample attribute.

Optionally, the query results also include optional field information; The encryption module 902 is also used for: The querying party's public key is used to encrypt the response sample attributes and optional field information to obtain the encrypted sample attributes.

Optionally, the target encrypted sample identification is obtained by encrypting the target sample identification using an encryption algorithm, and the encrypting algorithm used by the querying party system and each data party system is the same.

Based on the same technical concept, an embodiment of the present invention provides a computer device. The computer device can be a terminal or a server. As shown in Figure 10, it includes at least one processor 1001 and a memory 1002 connected to the at least one processor. The embodiment of the present invention does not limit the specific connection medium between the processor 1001 and the memory 1002. In FIG. 10, the processor 1001 and the memory 1002 are connected through a bus as an example. Buses can be divided into address buses, data buses, control buses, etc.

In the embodiment of the present invention, the memory 1002 stores instructions that can be executed by at least one processor 1001. By executing the instructions stored in the memory 1002, at least one processor 1001 can perform the steps included in the above-mentioned data sharing method.

Among them, the processor 1001 is the control center of the computer equipment. It can use various interfaces and lines to connect various parts of the computer equipment, and perform operations by running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002. Data sharing. Optionally, the processor 1001 may include one or more processing units. The processor 1001 may integrate an application processor and a modem processor. The application processor mainly processes operating systems, user interfaces, applications, etc., and modulation The demodulation processor mainly handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate wafers.

The processor 1001 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete Gates, transistor logic devices, and discrete hardware components can implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present invention can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

As a non-volatile computer-readable storage medium, the memory 1002 can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 1002 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory (SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, magnetic disks, optical discs, etc. Memory 1002 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. The memory 1002 in the embodiment of the present invention can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.

Based on the same inventive concept, embodiments of the present invention provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device executes the steps of the above data sharing method.

Based on the same inventive concept, embodiments of the present invention provide a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by the computer, The computer performs the steps of the data sharing method described above.

It should be understood by those of ordinary skill in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the invention may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk memory, CD-ROM, optical memory, etc.) embodying computer-usable program code therein. .

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine that causes instructions to be executed by the processor of the computer or other programmable data processing device. Means are generated for implementing the functions specified in the process or processes of the flowchart diagram and/or the block or blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. , the instruction device implements the functions specified in one process or multiple processes in the flow chart and/or one block or multiple blocks in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby causing the computer or other programmable device to perform a computer-implemented process. The instructions executed on provide steps for implementing the functions specified in a process or processes of the flow diagrams and/or a block or blocks of the block diagrams.

The above are only preferred embodiments of the present invention and are not intended to limit the implementation scope of the present invention. If the present invention is modified or equivalently substituted without departing from the spirit and scope of the present invention, the protection shall be covered by the patent scope of the present invention. within the range.

101: Terminal equipment 102: Querying party system 103: Coordinator system 104~1: Data source system 104~2: Data source system 104~X: Data source system 800: Data Sharing Device 801: First receiving module 802: First sending module 803: Recording module 900: Data sharing device 901: Second receiving module 902: Encryption module 903: Second sending module 1001: Processor 1002: Memory S201-S208: Steps S301-S313: Steps

Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present invention; Figure 2 is a schematic flow chart of a data sharing method provided by an embodiment of the present invention; Figure 3 is a schematic structural diagram of a query request provided by an embodiment of the present invention; Figure 4 is a schematic structural diagram of a query request provided by an embodiment of the present invention; Figure 5 is a schematic structural diagram of a query result provided by an embodiment of the present invention; Figure 6 is a schematic structural diagram of a query result provided by an embodiment of the present invention; Figure 7 is a schematic flow chart of a data sharing method provided by an embodiment of the present invention; Figure 8 is a schematic structural diagram of a data sharing device provided by an embodiment of the present invention; Figure 9 is a schematic structural diagram of a data sharing device provided by an embodiment of the present invention; Figure 10 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.

S201-S208: Steps

Claims (14)

A data sharing method, applied to the coordinator's system, is characterized by: receiving a query request sent by the querying party's system, the query request including the target encrypted sample identification and the querying party's public key, as well as the target attribute category; to at least one The data party system sends the query request, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identification and the target attribute category, and uses the public key of the querying party to perform the query on the response sample attributes. Encrypt, obtain the encrypted sample attributes, and generate query results based on the target encrypted sample identification and the encrypted sample attributes; receive the query results sent by at least one data party system, and send the received query results to the query party system to enable The querying party system decrypts the encrypted sample attributes in each query result using the querying party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute. . The data sharing method as described in claim 1, characterized in that the at least one data party system is each data party system communicatively connected with the coordinator system; or, the at least one data party system is obtained from each data party system according to the data quality. Selected from the data source system. The data sharing method described in request item 1 or 2 is characterized in that it also includes: recording the identity information of the querying party system, the query request of the querying party system, and the received query results. The data sharing method according to claim 1 or 2, characterized in that the target encryption sample This identification is obtained by encrypting the target sample identification using an encryption algorithm. The encryption algorithm used by the querying party system and each data party system is the same. A data sharing method, applied to the data party system, characterized by including: receiving a query request sent by the coordinator system, the query request is sent by the query party system to the coordinator system, the query request includes the target encrypted sample Identity and public key of the querying party, as well as the target attribute category; if there is a reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, then at least one sample attribute corresponding to the reference encrypted sample identifier will be used as the response sample attributes, and uses the querying party's public key to encrypt the response sample attributes, obtains the encrypted sample attributes, and generates query results based on the target encrypted sample identification and the encrypted sample attributes; sends the query results to the coordinator's system, So that the coordinator system sends the query result to the querying party system, and instructs the querying party system to decrypt the encrypted sample attributes in the query result through the querying party's private key, obtain at least one response sample attribute, and obtain at least one response sample attribute from the querying party's private key. In the response sample attributes, obtain the target sample attributes corresponding to the target encrypted sample ID. The data sharing method described in claim 5, further comprising: if there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, generating a random sequence and using the random sequence as Response sample properties. The data sharing method described in claim 5, characterized in that if there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party's system, a random sequence is generated, including: If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data party system, and the random sequence generation probability corresponding to the data party system is greater than the preset threshold, a random sequence is generated. The data sharing method described in request item 5 is characterized in that the query result also includes optional field information; the querying party's public key is used to encrypt the response sample attributes to obtain the encrypted sample attributes, including: The querying party's public key is used to encrypt the response sample attributes and optional field information to obtain the encrypted sample attributes. The data sharing method described in claim 5 is characterized in that the target encrypted sample identifier is obtained by encrypting the target sample identifier using an encryption algorithm, and the encryption algorithm used by the querying party system and each data party system is the same. A data sharing device, characterized in that it includes: a first receiving module for receiving a query request sent by the querying party's system, the query request including the target encrypted sample identification and the querying party's public key, as well as the target attribute category; A sending module for sending the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identifier and the target attribute category, and uses the query The party's public key encrypts the response sample attributes, obtains the encrypted sample attributes, and generates query results based on the target encrypted sample identification and the encrypted sample attributes; the first receiving module is also used to receive at least one data sent by the party system query results, and send the received query results to the querying party system, so that the querying party system can Decrypt the encrypted sample attributes in each query result using the querying party's private key to obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute. A data sharing device, characterized in that it includes: a second receiving module for receiving an inquiry request sent by the coordinator system. The inquiry request is sent by the inquiry party system to the coordinator system. The inquiry request includes a target. The encrypted sample ID and the querying party's public key, as well as the target attribute category; the encryption module, if there is a reference encrypted sample ID that matches the target encrypted sample ID in the data party's system, then the reference encrypted sample ID corresponding to the at least A sample attribute is used as the response sample attribute, and the query party's public key is used to encrypt the response sample attribute to obtain the encrypted sample attribute, and generate query results based on the target encrypted sample identification and the encrypted sample attribute; the second sending module The group is used to send the query results to the coordinator system, so that the coordinator system sends the query results to the query party system, and instructs the query party system to use the query party's private key to encrypt the sample attributes in the query results. Decrypt, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identification from the at least one response sample attribute. A computer device, including a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that when the processor executes the program, any one of claims 1 to 9 is achieved The steps of the data sharing method. A computer-readable storage medium, characterized in that it stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute Perform the steps of the data sharing method described in any one of requests 1 to 9. A computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer device, the computer device executes the requested item. The steps of the data sharing method described in any one of 1 to 9.