WO2023087760A1 - Data sharing method and apparatus, device, and storage medium - Google Patents

Abstract

Embodiments of the present application relate to the technical field of data processing, and provide a data sharing method and apparatus, a device, and a storage medium. The method comprises: a querier system sends a query request to a data side system by means of a coordinator system; the data side system obtains a corresponding response sample attribute on the basis of a target encrypted sample identifier, then encrypts the response sample attribute by means of a querier public key to obtain an encrypted sample attribute, and then generates a query result according to the target encrypted sample identifier and the encrypted sample attribute; the data side system sends the query result to the querier system by means of the coordinator system; the querier system decrypts the encrypted sample attribute in the query result by means of a querier private key, and obtains a target sample attribute corresponding to the target encrypted sample identifier. The coordinator system connects the querier system and data side systems, preventing the querier system from directly sending a query request to the data side systems, and ensuring the privacy of information of the querier and the privacy of data of the data side systems.

Description

A data sharing method, device, equipment and storage medium

Cross References to Related Applications

This application claims the priority of the Chinese patent application with the application number 202111402128.7 and the application title "A data sharing method, device, equipment and storage medium" submitted to the China Patent Office on November 22, 2021, the entire contents of which are incorporated by reference incorporated in this application.

technical field

The embodiments of the present invention relate to the technical field of data processing, and in particular, to a data sharing method, device, device, and storage medium.

Background technique

In the scenario of the Internet of Everything, the data federation between different industries, institutions, and departments will form a huge data alliance. There is a great need to share the data information held by each other among different institutions. However, more and more institutions have strengthened their own data protection requirements in data cooperation. In the current environment of lack of data protection, data sharing among various institutions cannot be realized. This makes it impossible for data to be effectively shared and flowed among different industries, institutions, and departments, and the value of data itself cannot be fully utilized.

Existing data sharing technologies are mainly aimed at the same organization, realizing data sharing between different business systems. For different industries and different organizations, it is impossible to effectively realize data sharing without disclosing their own data.

Contents of the invention

Embodiments of the present application provide a data sharing method, device, device, and storage medium for realizing data sharing between different industries, institutions, and departments.

On the one hand, the embodiment of the present application provides a data sharing method, the method includes:

receiving a query request sent by the querying system, the query request including the target encrypted sample identifier and the public key of the querying party;

sending the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identifier, and uses the query party public key to query the response sample Encrypting attributes to obtain encrypted sample attributes, and generating query results according to the target encrypted sample identifier and the encrypted sample attributes;

receiving query results sent by at least one data-side system, and sending the received query results to the query-side system, so that the query-side system can respectively decrypt the encrypted sample attributes in each query result through the query-side private key, and obtain at least one response sample attribute, and obtain a target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

On the one hand, the embodiment of the present application provides a data sharing method, the method includes:

Receiving the query request sent by the coordinator system, the query request is sent to the coordinator system by the query system, and the query request includes the target encrypted sample identification and the query public key;

Obtain the corresponding response sample attribute based on the target encrypted sample ID, and encrypt the response sample attribute with the public key of the inquiring party to obtain the encrypted sample attribute, and obtain the encrypted sample attribute according to the target encrypted sample ID and the encrypted sample Attributes to generate query results;

sending the query result to the coordinator system, so that the coordinator system sends the query result to the query system, and instructs the query system to encrypt the encrypted sample in the query result through the query party private key The attribute decryption is to obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

On the one hand, the embodiment of the present application provides a data sharing device, the device includes:

The first receiving module is configured to receive a query request sent by the querying system, where the query request includes the target encrypted sample identifier and the public key of the querying party;

The first sending module is configured to send the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier, and adopts the query method The public key encrypts the response sample attribute to obtain the encrypted sample attribute, and generates a query result according to the target encrypted sample identifier and the encrypted sample attribute;

The first receiving module is also used to receive query results sent by at least one data-side system, and send the received query results to the query-side system, so that the query-side system uses the private key of the query-side system to query each query result Decrypt the encrypted sample attribute in, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

Optionally, the at least one data center system is each data center system communicatively connected to the coordinator system; or,

The at least one data cube system is selected from the various data cube systems according to data quality.

Optionally, the query request also includes a target attribute category;

The first sending module is specifically used for:

Sending the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier and the target attribute category respectively.

Optionally, a recording module is also included, and the recording module is specifically used for:

Recording the identity information of the inquiring system, the query request of the inquiring system, and the received query results.

Optionally, the target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, and the encryption algorithm used by the query system and each data system is the same.

On the one hand, the embodiment of the present application provides a data sharing device, the device includes:

The second receiving module is configured to receive a query request sent by the coordinator system, the query request is sent to the coordinator system by the query system, and the query request includes the target encrypted sample identifier and the query public key;

An encryption module, configured to obtain corresponding response sample attributes based on the target encryption sample ID, and encrypt the response sample attributes with the queryer public key to obtain encrypted sample attributes, and obtain the encrypted sample attributes according to the target encryption sample ID and the encrypted sample attributes to generate query results;

The second sending module is configured to send the query result to the coordinator system, so that the coordinator system sends the query result to the inquirer system, and instructs the inquirer system to pair the query result with the inquirer private key decrypt the encrypted sample attribute in the query result, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.

Optionally, the encryption module is specifically used for:

If there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, at least one sample attribute corresponding to the reference encrypted sample ID is used as a response sample attribute.

Optionally, the encryption module is also used for:

If there is no reference encrypted sample ID matching the target encrypted sample ID in the data party system, a random sequence is generated, and the random sequence is used as a response sample attribute.

Optionally, the encryption module is also used for:

If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data cube system, and the random sequence generation probability corresponding to the data cube system is greater than a preset threshold, a random sequence is generated.

Optionally, the query request also includes a target attribute category;

The encryption module is also used for:

If there is a reference encrypted sample ID that matches the target encrypted sample ID in the data party system, the sample attribute that matches the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID is used as Response sample properties.

Optionally, the query result also includes optional field information;

The encryption module is also used for:

Encrypting the response sample attributes and optional field information by using the inquiring party's public key to obtain encrypted sample attributes.

Optionally, the target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, and the encryption algorithm used by the query system and each data system is the same.

On the one hand, an embodiment of the present application provides a computer device, including a memory, a processor, and a computer program stored on the memory and operable on the processor, and the processor implements the above data sharing method when executing the program. step.

On the one hand, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program is run on the computer device, the computer device executes the above-mentioned data sharing method. step.

On the one hand, an embodiment of the present application provides a computer program product, the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer device , causing the computer device to execute the steps of the above data sharing method.

In this embodiment of the application, the inquiring system sends a query request to the coordinator system, and the coordinator system then sends the query request to the data side system. The data cube system obtains the corresponding response sample attributes based on the target encrypted sample ID, and then uses the public key of the query party to encrypt the response sample attributes to obtain the encrypted sample attributes, and then generates query results based on the target encrypted sample ID and encrypted sample attributes. The data side system sends the query result to the coordinator system, and the coordinator system sends the query result to the query side system. The inquiring system decrypts the encrypted sample attribute in the query result through the inquiring party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample ID from the at least one response sample attribute. The coordinator system connects the query system and each data system, avoiding the query request from the query system directly to each data system, and ensuring the privacy of the query information and the data privacy of the data system. At the same time, since the query request sent by the querying party is encrypted data, the query results sent by each data system are also encrypted data. Therefore, the coordinating system does not know the specific data received and sent, which ensures that the query request and query Security of Results.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For Those skilled in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

FIG. 2 is a schematic flow diagram of a data sharing method provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a query request provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a query request provided by an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a query result provided by an embodiment of the present application;

FIG. 6 is a schematic structural diagram of a query result provided by an embodiment of the present application;

FIG. 7 is a schematic flow diagram of a data sharing method provided by an embodiment of the present application;

FIG. 8 is a schematic structural diagram of a data sharing device provided by an embodiment of the present application;

FIG. 9 is a schematic structural diagram of a data sharing device provided by an embodiment of the present application;

FIG. 10 is a schematic structural diagram of a computer device provided by an embodiment of the present application.

Detailed ways

In order to make the object, technical solution and beneficial effects of the present invention more clear, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

Referring to FIG. 1 , it is a system architecture diagram applicable to the embodiment of the present application. The system architecture includes at least a terminal device 101, an inquiring system 102, a coordinating system 103, a data system 104-1, and a data system 104-2. , . . . the data cube system 104-X, where X is an integer greater than 0.

The terminal device 101 is installed with a target application for querying data, and the application may be a pre-installed client, a web application, or a small program embedded in other applications. The terminal device 101 may be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc., but is not limited thereto.

The query system 102, the coordinator system 103, the data system 104-1 to the data system 104-X are background servers of the target application and provide services for the target application. The inquiring system 102 can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

The coordinator system 103 can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud Cloud servers for basic cloud computing services such as communications, middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and big data and artificial intelligence platforms. It should be noted that there may be multiple inquiring party systems 102 and coordinating party systems 103 , and the present application does not specifically limit the number of inquiring party systems 102 and coordinating party systems 103 .

The data cube system 104~1 to the data cube system 104~X can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or provide cloud services, cloud databases, cloud computing, cloud Cloud servers for basic cloud computing services such as function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, content delivery network (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

The terminal device 101 and the inquiring system 102 may be directly or indirectly connected through wired or wireless communication, which is not limited in this application. The inquiring system 102 and the coordinating system 103 may be directly or indirectly connected through wired or wireless communication, which is not limited in this application. The coordinator system 103 is connected to the data system 104-1 to the data system 104-X respectively, and can be connected directly or indirectly through wired or wireless communication, which is not limited in this application.

In response to the user's data query operation, the terminal device 101 sends a data query command to the querying system 102, and the data query command includes the target sample identifier.

The inquiring system 102 receives the data query instruction, encrypts the target sample ID with an encryption algorithm, and obtains the target encrypted sample ID. The queryer system 102 sends a query request to the coordinator system 103, wherein the query request includes the target encrypted sample identifier and the queryer public key. The coordinator system 103 receives the query request sent by the query system 102, and sends query requests to the data-side systems 104-1, ..., and the data-side systems 104-X respectively.

At least one of the data cube systems 104~1 to data cube systems 104~X obtains corresponding response sample attributes based on the target encrypted sample identifier in the query request, and encrypts the response sample attributes with the query party public key , obtain the encrypted sample attribute, and generate a query result according to the target encrypted sample ID and the encrypted sample attribute.

The above-mentioned at least one data-side system respectively sends query results to the coordinator system 103 , and the coordinator system 103 sends each query result to the query-side system 102 .

The querying system 102 decrypts the encrypted sample attributes in each query result with the private key of the querying party, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample ID from the at least one response sample attribute.

In practical applications, the solutions in the embodiments of the present application are applicable to the data sharing query requirements of different industries. For example, the establishment of a financial industry data security sharing alliance, etc., can be safely shared within the alliance, and the privacy data security of all parties can be guaranteed.

Based on the system architecture diagram described in FIG. 1, the embodiment of the present application provides a flow of a data sharing method, as shown in FIG. Data cube system 104~1 to data cube system 104~X execute interactively, including the following steps:

Step S201, the inquiring system sends an inquiry request to the coordinating system.

Specifically, the query request includes the target encrypted sample ID and the public key of the querying party. The target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, wherein the target sample ID can be an ID card number, a telephone number, and the like. The encryption algorithm used by the query system and each data system is the same. Wherein, the encryption algorithm may be a symmetric encryption algorithm, an asymmetric encryption algorithm, or a hash algorithm. The encryption algorithm is used to encrypt the target sample ID to obtain the target encrypted sample ID, which enhances the security of query information.

The inquiring party system determines the inquiring party's public key and inquiring party's private key based on an asymmetric encryption algorithm. Wherein, the asymmetric encryption algorithm may be any one of RSA algorithm, Elgamal algorithm, elliptic curve encryption algorithm and the like.

For a possible implementation manner, referring to FIG. 3 , the query request includes the target encrypted sample identifier and the public key of the querying party.

For another possible implementation, referring to FIG. 4 , the query request includes the target encrypted sample identifier, the public key of the querying party, and the target attribute category. The target attribute category can restrict different scenarios and determine the response sample attributes in a specific scenario.

Step S202, the coordinating system sends a query request to the data system.

Specifically, the coordinator system receives the query request sent by the query system, and records the identity information of the query party and the corresponding query request.

The coordinator system can send the query request to each data party system in the data sharing network in the form of broadcast. The coordinator system can also select the broadcast data party system according to a certain probability value.

In a possible implementation manner, the coordinator system sends a query request to each data-side system connected by communication.

For example, it is assumed that three data cube systems are connected to the coordinator system, namely, data cube system 1, data cube system 2, and data cube system 3. The coordinating party system sends query requests to data party system 1, data party system 2, and data party system 3 respectively.

In the embodiment of the present application, the coordinating system sends query requests to each data system connected by communication, which can effectively improve the matching degree of query requests and improve the quality of query results.

In another possible implementation manner, the coordinator system sends a query request to some of the data-side systems connected by communication.

In the first case, some data cube systems are randomly selected by the coordinator system from each data cube system.

Specifically, the coordinator system generates a random number for each data cube system, compares the random number corresponding to each data cube system with the preset value, and uses the data cube system corresponding to the random number that meets the preset conditions as part of the data square system.

For example, it is assumed that three data cube systems are connected to the coordinator system, namely, data cube system 1, data cube system 2, and data cube system 3.

The coordinator system generates a random number for each data cube system, and the random numbers corresponding to data cube system 1, data cube system 2, and data cube system 3 are 0.6, 0.4, and 0.9, respectively. Comparing each random number with the preset value 0.5, the random number 0.6 corresponding to the data cube system 1 is greater than 0.5, and the random number 0.9 corresponding to the data cube system 3 is greater than 0.5. Therefore, the data cube system 1 and the data cube system 3 are selected as part of the data cube systems, and the coordinating system sends query requests to the data cube system 1 and the data cube system 3.

In the second case, some data cube systems are selected by the coordinator system from various data cube systems according to the data quality.

Specifically, each data cube system determines a corresponding data quality score based on the data quality in each system. Data quality is related to the data value of the data cube system and the credit of the data cube. Based on the data quality scores of each data cube system, the coordinator system regards the data cube systems corresponding to the data quality scores that meet the preset conditions as part of the data cube systems.

For example, it is assumed that three data cube systems are connected to the coordinator system, namely, data cube system 1, data cube system 2, and data cube system 3. The data quality scores corresponding to each data cube system are 90 points, 78 points, and 93 points respectively.

Set the default condition to select the data cube system with a data quality score greater than 85 as part of the data cube system. Therefore, select data cube system 1 and data cube system 3 as part of the data cube system, and send data to data cube system 1 and data cube system Party system 3 sends a query request.

It should be noted that, in addition to selecting the data party system that receives the query request from various data party systems according to the data quality, it can also be based on factors such as data party credit and network delay.

In the embodiment of the present application, the coordinator system sends query requests to some of the data-side systems in the communication connection, which effectively reduces the network load. When some data cube systems are selected from various data cube systems according to data quality, while reducing the network load, it also ensures the matching degree of query requests and improves the quality of query results.

Step S203, the data party system obtains the corresponding response sample attributes based on the target encrypted sample identifier.

Specifically, the data cube system queries the desensitization database according to the target encrypted sample ID, and obtains the response sample attributes.

Embodiment 1. When the query request includes the target encrypted sample ID and the public key of the inquiring party, if there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, at least one sample corresponding to the reference encrypted sample ID will be referenced. attributes as response sample attributes.

If there is no reference encrypted sample ID matching the target encrypted sample ID in the data cube system, in a possible implementation manner, the data cube system generates a random sequence and uses the random sequence as a response sample attribute.

In another possible implementation, the data cube system generates a random number, which is the probability of generating a random sequence, and then compares the random number with a preset threshold. If the random number is greater than the preset threshold, the data cube system Generate a random sequence and use this random sequence as a response sample attribute; otherwise, the data cube system will not do anything.

For example, it is assumed that the data cube system includes data cube system 1 and data cube system 2, and the target encrypted sample identifier is aa.

As shown in Table 1, the data cube system 1 includes three sets of reference encrypted sample IDs, and each set of reference encrypted sample IDs corresponds to two sample attributes, namely whether it is A or not.

The three sets of reference encrypted sample IDs are aa, bb, and cc, respectively, and the sample attributes corresponding to the reference encrypted sample ID aa are A and B respectively. The sample attributes corresponding to the reference encrypted sample ID bb are non-A and non-B respectively. The sample attributes corresponding to the reference encrypted sample ID cc are A and non-B respectively.

Table 1.

Refer to encrypted sample ID	Is it A	Is it B
aa	A	B
bb	Not A	non-B
cc	A	non-B

The data side system 1 queries Table 1 according to the target encrypted sample ID aa, determines that there is a reference encrypted sample ID matching the target encrypted sample ID aa in Table 1, and uses the sample attributes "A and B" corresponding to the reference encrypted sample ID aa as Response sample properties.

As shown in Table 2, the data cube system 2 includes two sets of reference encrypted sample IDs, and each set of reference encrypted sample IDs corresponds to a sample attribute, that is, whether it is A or not.

The two sets of reference encrypted sample IDs are bb and cc respectively, and the sample attribute corresponding to the reference encrypted sample ID bb is not A. The sample attribute corresponding to the reference encrypted sample ID cc is A.

Table 2.

Refer to encrypted sample ID	Is it A
bb	Not A
cc	A

The data side system 2 queries Table 2 according to the target encrypted sample ID aa, and determines that there is no reference encrypted sample ID matching the target encrypted sample ID aa in Table 2, then the data side system 2 generates a random sequence and takes the random sequence as a response Sample properties.

Embodiment 2: When the query request includes the marked encrypted sample ID, the public key of the querying party, and the target attribute category, if there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, the reference encrypted sample ID will be correspondingly Among at least one sample attribute of , the sample attribute matching the target attribute category is used as the response sample attribute.

If there is no reference encrypted sample ID matching the target encrypted sample ID in the data cube system, in a possible implementation manner, the data cube system generates a random sequence and uses the random sequence as a response sample attribute.

In another possible implementation, the data cube system generates a random number, which is the probability of generating a random sequence, and then compares the random number with a preset threshold. If the random number is greater than the preset threshold, the data cube The system generates a random sequence and takes the random sequence as a response sample attribute; otherwise, the data side system does not do any processing.

For example, the data cube system includes data cube system 1 and data cube system 2, the target encrypted sample identifier is aa, and the target attribute type is B or not.

The data in Data Cube System 1 is shown in Table 1. The data side system 1 queries Table 1 according to the target encrypted sample ID aa, and determines that there is a reference encrypted sample ID matching the target encrypted sample ID aa in Table 1, then selects the sample from the two sample attributes corresponding to the reference encrypted sample ID aa Attribute "B", as a response sample attribute.

The data in Data Cube System 2 is shown in Table 2. Data side system 1 queries table 2 according to target encrypted sample ID aa, and determines that there is no reference encrypted sample ID matching target encrypted sample ID aa in table 2, then data side system 2 generates a random number 0.3, and stores the random number Compared with the preset threshold 0.5, since the random number 0.3 is smaller than the preset threshold 0.5, the data party system 2 does not perform any processing.

In this embodiment of the application, the target attribute category limits different scenarios, and the target attribute category is used to filter the sample attributes to obtain the response sample attributes, which can more accurately match the sample attributes and obtain more accurate response sample attributes. When there is no reference encrypted sample ID matching the target encrypted sample ID in the data cube system, a random sequence can be generated and returned according to the probability, which effectively reduces the network load and improves the network operation efficiency.

Step S204, the data party system encrypts the response sample attributes by using the query party's public key to obtain the encrypted sample attributes.

In the embodiment of this application, the data cube system can use the public key of the query party to encrypt only the response sample attributes to obtain encrypted sample attributes, and the data cube system can also use the query party public key to encrypt the response sample attributes and optional field information. Get encrypted sample properties.

Specifically, the optional field information may be any one or combination of timestamps, random numbers, random character strings, and the like.

In this embodiment of the application, when the response sample attributes are the same, by encrypting the response sample attributes and optional field information, different encrypted sample attributes can be obtained, which can effectively solve the problem of third party intercepting encrypted sample attributes, cracking and obtaining Responding to questions about sample properties improves security during data transmission.

Step S205, the data side system generates a query result according to the target encrypted sample identifier and the encrypted sample attribute.

A possible implementation manner, referring to FIG. 5 , when the data side system encrypts the response sample attribute with the queryer public key, the query result includes the target encrypted sample ID and the encrypted sample attribute, wherein the encrypted sample attribute includes the response sample attribute.

Another possible implementation, referring to Figure 6, when the data party system uses the public key of the query party to encrypt the response sample attributes and optional field information, the query result includes the target encrypted sample identifier and encrypted sample attributes, where the encrypted sample Properties include response sample properties and optional field information.

Step S206, the data party system sends the query result to the coordinator system.

The coordinating party system receives the query results sent by the data party system, and records each data party system and the corresponding query results sent. At the same time, the previously recorded identity information of the inquiring party and the querying request of the inquiring party correspond to the query results sent by each data party system.

In this embodiment of the application, the coordinator system records the identity information of the querying party, the querying request of the querying party, and each query result corresponding to the querying request, which ensures that the query information is traceable and cannot be tampered with, and is convenient for information verification and review.

Step S207, the coordinating system sends the query result to the querying system.

Optionally, the coordinator system also provides a billing function, charges the corresponding fee to the query party, and pays the corresponding fee to the data system that provides the query result, effectively improving the enthusiasm of the data system to participate and promoting data sharing development of.

Step S208, the inquiring party system decrypts the encrypted sample attribute in the query result by using the inquiring party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample ID from the at least one response sample attribute.

If the encrypted sample attributes only include the response sample attributes, the inquiring party system decrypts the encrypted sample attributes through the inquiring party's private key to obtain the response sample attributes.

If the encrypted sample attributes include response sample attributes and optional field information, the inquiring party system decrypts the encrypted sample attributes through the inquiring party's private key, and obtains the concatenated field information of the response sample attributes and optional field information. The optional field information in the concatenated field information is removed, that is, the response sample attributes are obtained.

Further, for each response sample attribute, if the response sample attribute is the sample attribute corresponding to the reference encrypted sample ID obtained from the data party system, the response sample attribute is used as the target sample attribute corresponding to the target encrypted sample ID . If the response sample attribute is a response sample attribute of a random sequence, the response sample attribute is removed.

In the embodiment of the present application, the system composed of the inquiring system, the coordinating system and each data system realizes the data sharing of the data in each data system without leaving the database. The query system can only obtain query results, but it is not clear which data system provides the query results. At the same time, the attributes of the response samples acquired by the inquiring system are only known to the inquiring system and the data system, and cannot be obtained by any third party, thereby improving the security of the query information and protecting the privacy of the identity information of the inquiring system.

The data cube system only provides query results, but it is not clear which query system is providing the query results. At the same time, the data cube system cannot know the query results generated by other data cube systems, thereby protecting the data privacy of the data cube system.

The coordinator system connects the query system and each data system, avoiding the query request from the query system directly to each data system, and ensuring the privacy of the query information and the data privacy of the data system. At the same time, since the query request sent by the querying party is encrypted data, the query results sent by each data system are also encrypted data. Therefore, the coordinating system does not know the specific data received and sent, which ensures that the query request and query Security of Results.

In order to better explain the embodiment of the present application, the following uses a specific embodiment scenario as an example to introduce the flow of a data sharing method provided by the embodiment of the present application, as shown in Figure 7:

In step S301, the querying system sends a query request to the coordinating system, wherein the query request includes the target encrypted sample identifier, the querying party's public key, and the target attribute category.

Step S302, the coordinating party system records the identity information of the inquiring party and the inquiry request of the inquiring party.

Step S303, the coordinator system sends a query request to the data side system.

In step S304, the data side system judges whether there is a reference encrypted sample ID matching the target encrypted sample ID, and if yes, executes step S305; otherwise, executes step S306.

In step S305, the data side system takes the sample attribute matching the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID as the response sample attribute, and jumps to step S308.

In step S306, the data side system generates a random number, and judges whether the random number is greater than a preset threshold, if yes, executes step S307; otherwise, ends.

In step S307, the data cube system generates a random sequence and uses the random sequence as a response sample attribute.

In step S308, the data party system encrypts the response sample attributes and optional field information using the queryer's public key to obtain encrypted sample attributes.

Among them, the optional field information may be timestamp, random number, random character string, etc.

Step S309, the data cube system generates a query result according to the target encrypted sample identifier and the encrypted sample attribute.

Step S310, the data party system sends the query result to the coordinator system.

In step S311, the coordinator system records each data party system and corresponding query results sent.

Step S312, the coordinating system sends the query result to the querying system.

Step S313, the inquiring party system decrypts the encrypted sample attribute in the query result by using the inquiring party's private key, obtains at least one response sample attribute, and obtains the target sample attribute corresponding to the target encrypted sample ID from the at least one response sample attribute.

In the embodiment of the present application, the system composed of the inquiring system, the coordinating system and each data system realizes the data sharing of the data in each data system without leaving the database. The coordinator system connects the query system and each data system, avoiding the query request from the query system directly to each data system, and ensuring the privacy of the query information and the data privacy of the data system. At the same time, since the query request sent by the querying party is encrypted data, the query results sent by each data system are also encrypted data. Therefore, the coordinating system does not know the specific data received and sent, which ensures that the query request and query Security of Results.

The target attribute category restricts different scenarios. By filtering the sample attributes through the target attribute category and obtaining the response sample attributes, the sample attributes can be matched more accurately and more accurate response sample attributes can be obtained. When there is no reference encrypted sample ID matching the target encrypted sample ID in the data cube system, a random sequence can be generated and returned according to the probability, which effectively reduces the network load and improves the network operation efficiency. In the case of the same response sample attributes, by encrypting the response sample attributes and optional field information to obtain different encrypted sample attributes, it can effectively solve the problem of obtaining the response sample attributes after the third party intercepts the encrypted sample attributes, and improves security during data transmission. The coordinator system records the identity information of the query party, the query request of the query party, and each query result corresponding to the query request, ensuring that the query information is traceable and cannot be tampered with, which is convenient for information verification and review.

Based on the same technical concept, the embodiment of the present application provides a data sharing device, as shown in Figure 8, the device 800 includes:

The first receiving module 801 is configured to receive a query request sent by the querying system, and the query request includes the target encrypted sample identifier and the public key of the querying party;

The first sending module 802 is configured to send the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier, and uses the query The public key of the party encrypts the response sample attribute to obtain the encrypted sample attribute, and generates a query result according to the target encrypted sample identifier and the encrypted sample attribute;

The first receiving module 801 is also used to receive the query result sent by at least one data-side system, and send the received query result to the query-side system, so that the query-side system can use the private key of the query-side system to query each The encrypted sample attribute in the result is decrypted, at least one response sample attribute is obtained, and the target sample attribute corresponding to the target encrypted sample identifier is obtained from the at least one response sample attribute.

Optionally, the at least one data center system is each data center system communicatively connected to the coordinator system; or,

The at least one data cube system is selected from the various data cube systems according to data quality.

Optionally, the query request also includes a target attribute category;

The first sending module 802 is specifically used for:

Sending the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier and the target attribute category respectively.

Optionally, a recording module 803 is also included, and the recording module 803 is specifically used for:

Recording the identity information of the inquiring system, the query request of the inquiring system, and the received query results.

Optionally, the target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, and the encryption algorithm used by the query system and each data system is the same.

Based on the same technical concept, the embodiment of this application provides a data sharing device, as shown in Figure 9, the device 900 includes:

The second receiving module 901 is configured to receive a query request sent by the coordinator system, the query request is sent to the coordinator system by the query system, and the query request includes the target encrypted sample identifier and the query party public key ;

An encryption module 902, configured to obtain corresponding response sample attributes based on the target encryption sample identifier, and encrypt the response sample attributes with the queryer public key to obtain encrypted sample attributes, and encrypt the sample attributes according to the target encryption sample Identify and attribute the encrypted sample, and generate a query result;

The second sending module 903 is configured to send the query result to the coordinator system, so that the coordinator system sends the query result to the inquirer system, and instructs the inquirer system to use the inquirer private key pair The encrypted sample attribute in the query result is decrypted to obtain at least one response sample attribute, and the target sample attribute corresponding to the target encrypted sample identifier is obtained from the at least one response sample attribute.

Optionally, the encryption module 902 is specifically configured to:

If there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, at least one sample attribute corresponding to the reference encrypted sample ID is used as a response sample attribute.

Optionally, the encryption module 902 is also used for:

If there is no reference encrypted sample ID matching the target encrypted sample ID in the data party system, a random sequence is generated, and the random sequence is used as a response sample attribute.

Optionally, the encryption module 902 is also used for:

If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data cube system, and the random sequence generation probability corresponding to the data cube system is greater than a preset threshold, a random sequence is generated.

Optionally, the query request also includes a target attribute category;

The encryption module 902 is also used for:

If there is a reference encrypted sample ID that matches the target encrypted sample ID in the data party system, the sample attribute that matches the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID is used as Response sample properties.

Optionally, the query result also includes optional field information;

The encryption module 902 is also used for:

Encrypting the response sample attributes and optional field information by using the inquiring party's public key to obtain encrypted sample attributes.

Optionally, the target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, and the encryption algorithm used by the query system and each data system is the same.

Based on the same technical concept, the embodiment of the present application provides a computer device, which may be a terminal or a server, as shown in FIG. 10 , including at least one processor 1001 and a memory 1002 connected to the at least one processor. The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the application, and the connection between the processor 1001 and the memory 1002 in FIG. 10 is taken as an example. The bus can be divided into address bus, data bus, control bus and so on.

In the embodiment of the present application, the memory 1002 stores instructions executable by at least one processor 1001, and at least one processor 1001 can execute the steps included in the above data sharing method by executing the instructions stored in the memory 1002.

Among them, the processor 1001 is the control center of the computer equipment, which can use various interfaces and lines to connect various parts of the computer equipment, by running or executing the instructions stored in the memory 1002 and calling the data stored in the memory 1002, thereby performing data processing. shared. Optionally, the processor 1001 may include one or more processing units, and the processor 1001 may integrate an application processor and a modem processor. The tuner processor mainly handles wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 1001 . In some embodiments, the processor 1001 and the memory 1002 can be implemented on the same chip, and in some embodiments, they can also be implemented on independent chips.

The processor 1001 can be a general processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.

The memory 1002, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs and modules. The memory 1002 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk , CD, etc. The memory 1002 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present application may also be a circuit or any other device capable of implementing a storage function, and is used for storing program instructions and/or data.

Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program executable by a computer device, and when the program runs on the computer device, the computer device executes the steps of the above data sharing method.

Based on the same inventive concept, an embodiment of the present application provides a computer program product, the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by the computer When executing, the computer is made to execute the steps of the above data sharing method.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

Obviously, those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (17)

1. A data sharing method applied to a coordinating party system, characterized in that it includes:

   receiving a query request sent by the querying system, the query request including the target encrypted sample identifier and the public key of the querying party;

   sending the query request to at least one data party system, so that the at least one data party system obtains the corresponding response sample attributes based on the target encrypted sample identifier, and uses the query party public key to query the response sample Encrypting attributes to obtain encrypted sample attributes, and generating query results according to the target encrypted sample identifier and the encrypted sample attributes;

   receiving query results sent by at least one data-side system, and sending the received query results to the query-side system, so that the query-side system can respectively decrypt the encrypted sample attributes in each query result through the query-side private key, and obtain at least one response sample attribute, and obtain a target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.
2. The method according to claim 1, wherein said at least one data party system is each data party system communicatively connected to said coordinating party system; or,

   The at least one data cube system is selected from the various data cube systems according to data quality.
3. The method according to claim 1, wherein the query request also includes a target attribute category;

   The sending the query request to at least one data-side system, so that the at least one data-side system respectively obtains corresponding response sample attributes based on the target encrypted sample ID includes:

   Sending the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier and the target attribute category respectively.
4. The method according to any one of claims 1 to 3, further comprising:

   Recording the identity information of the inquiring system, the query request of the inquiring system, and the received query results.
5. The method according to any one of claims 1 to 3, wherein the target encrypted sample ID is obtained by encrypting the target sample ID using an encryption algorithm, and the encryption algorithm used by the query system and each data system same.
6. A data sharing method applied to a data cube system, characterized in that it comprises:

   receiving a query request sent by the coordinator system, the query request is sent to the coordinator system by the query system, and the query request includes the target encrypted sample identifier and the query public key;

   Obtain the corresponding response sample attribute based on the target encrypted sample ID, and encrypt the response sample attribute with the public key of the inquiring party to obtain the encrypted sample attribute, and obtain the encrypted sample attribute according to the target encrypted sample ID and the encrypted sample Attributes to generate query results;

   sending the query result to the coordinator system, so that the coordinator system sends the query result to the query system, and instructs the query system to encrypt the encrypted sample in the query result through the query party private key The attribute decryption is to obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.
7. The method according to claim 6, wherein said obtaining corresponding response sample attributes based on said target encrypted sample identification comprises:

   If there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, at least one sample attribute corresponding to the reference encrypted sample ID is used as a response sample attribute.
8. The method of claim 7, further comprising:

   If there is no reference encrypted sample ID matching the target encrypted sample ID in the data party system, a random sequence is generated, and the random sequence is used as a response sample attribute.
9. The method according to claim 8, wherein if there is no reference encrypted sample ID matching the target encrypted sample ID in the data party system, generating a random sequence comprises:

   If there is no reference encrypted sample identifier matching the target encrypted sample identifier in the data cube system, and the random sequence generation probability corresponding to the data cube system is greater than a preset threshold, a random sequence is generated.
10. The method according to claim 7, wherein the query request also includes a target attribute category;

    If there is a reference encrypted sample ID matching the target encrypted sample ID in the data party system, then at least one sample attribute corresponding to the reference encrypted sample ID is used as a response sample attribute, including:

    If there is a reference encrypted sample ID that matches the target encrypted sample ID in the data party system, the sample attribute that matches the target attribute category among at least one sample attribute corresponding to the reference encrypted sample ID is used as Response sample properties.
11. The method according to claim 6, wherein the query result further includes optional field information;

    Encrypting the response sample attributes with the public key of the inquiring party to obtain encrypted sample attributes includes:

    Encrypting the response sample attributes and optional field information by using the inquiring party's public key to obtain encrypted sample attributes.
12. The method according to claim 6, wherein the target encrypted sample ID is obtained by encrypting the target sample ID with an encryption algorithm, and the encryption algorithm used by the query system and each data system is the same.
13. A data sharing device, characterized in that it comprises:

    The first receiving module is configured to receive a query request sent by the querying system, where the query request includes the target encrypted sample identifier and the public key of the querying party;

    The first sending module is configured to send the query request to at least one data-side system, so that the at least one data-side system obtains corresponding response sample attributes based on the target encrypted sample identifier, and adopts the query method The public key encrypts the response sample attribute to obtain the encrypted sample attribute, and generates a query result according to the target encrypted sample identifier and the encrypted sample attribute;

    The first receiving module is also used to receive query results sent by at least one data-side system, and send the received query results to the query-side system, so that the query-side system uses the private key of the query-side system to query each query result Decrypt the encrypted sample attribute in, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.
14. A data sharing device, characterized in that it comprises:

    The second receiving module is configured to receive a query request sent by the coordinator system, the query request is sent to the coordinator system by the query system, and the query request includes the target encrypted sample identifier and the query public key;

    An encryption module, configured to obtain corresponding response sample attributes based on the target encryption sample ID, and encrypt the response sample attributes with the queryer public key to obtain encrypted sample attributes, and obtain the encrypted sample attributes according to the target encryption sample ID and the encrypted sample attributes to generate query results;

    The second sending module is configured to send the query result to the coordinator system, so that the coordinator system sends the query result to the inquirer system, and instructs the inquirer system to pair the query result with the inquirer private key decrypt the encrypted sample attribute in the query result, obtain at least one response sample attribute, and obtain the target sample attribute corresponding to the target encrypted sample identifier from the at least one response sample attribute.
15. A computer device, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, characterized in that, when the processor executes the program, it realizes any of claims 1-12 steps of the method described above.
16. A computer-readable storage medium, characterized in that it stores a computer program executable by a computer device, and when the program is run on the computer device, the computer device executes the method described in any one of claims 1-12 A step of.
17. A computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer device, the The computer equipment executes the steps of the method described in any one of claims 1-12.

Images