WO2022151888A1 - 数据共享方法及装置 - Google Patents

数据共享方法及装置 Download PDF

Info

Publication number
WO2022151888A1
WO2022151888A1 PCT/CN2021/137473 CN2021137473W WO2022151888A1 WO 2022151888 A1 WO2022151888 A1 WO 2022151888A1 CN 2021137473 W CN2021137473 W CN 2021137473W WO 2022151888 A1 WO2022151888 A1 WO 2022151888A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
analyzed
user
encrypted
sharing platform
Prior art date
Application number
PCT/CN2021/137473
Other languages
English (en)
French (fr)
Inventor
闫建斌
杜然
赵婀姿
黄三文
Original Assignee
中国农业科学院深圳农业基因组研究所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国农业科学院深圳农业基因组研究所 filed Critical 中国农业科学院深圳农业基因组研究所
Publication of WO2022151888A1 publication Critical patent/WO2022151888A1/zh
Priority to US18/202,462 priority Critical patent/US20230308290A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/17—Details of further file system functions
    • G06F16/176—Support for shared access to files; File sharing support
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/23—Updating
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/50—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using hash chains, e.g. blockchains or hash trees

Definitions

  • the present application relates to the technical field of data sharing, and in particular, to a data sharing method and device.
  • Data sharing can reasonably achieve the purpose of resource allocation, save social costs and create more wealth. It is an important means to improve the utilization rate of data resources and avoid repeated waste in data collection, storage and management.
  • NCBI National Center for Biotechnology Information
  • the embodiments of the present application provide a data sharing method and apparatus, which can ensure the security of the shared data during the data sharing process and improve the data analysis efficiency.
  • a data sharing method comprising: acquiring encrypted data to be analyzed in a data sharing platform selected by a data user; decrypting the encrypted data to be analyzed by using a trusted execution program and decrypting the encrypted data to be analyzed. Perform data analysis on the encrypted data to be analyzed, and obtain the data analysis result of the encrypted data to be analyzed, wherein the trusted execution program has built-in identity authentication information of the data user, and the execution process of the trusted execution program is invisible to the data user.
  • the trusted execution program is generated by compiling the identity authentication information of the data user, the business code selected by the data user, and the encryption-decryption function through the data sharing platform, wherein the data sharing The platform stores a variety of business codes that can be selected by data users, and each business code in the various business codes is a code used for analyzing data that has been reviewed by members of the alliance chain.
  • the encrypted data to be analyzed is retrieved based on metadata stored in the data sharing platform that meets a preset data standard, wherein the metadata includes description information of the encrypted data.
  • the above data sharing method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes data ID information of the encrypted data to be analyzed; wherein, The above-mentioned obtaining the encrypted data to be analyzed in the data sharing platform selected by the data user includes: using a trusted execution program to obtain the encrypted data to be analyzed according to the data ID information of the encrypted data to be analyzed.
  • the data sharing method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes data summary information about the encrypted data to be analyzed; Regarding the data digest information of the encrypted data to be analyzed, a trusted execution program is used to perform data digest verification.
  • the above data sharing method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes information of data contributors of the encrypted data to be analyzed; According to the information of the data contributor, the trusted execution program is used to apply to the data contributor client for the decryption key of the encrypted data to be analyzed; the decryption key returned by the data contributor client is received; wherein, the trusted execution program is used to analyze the decryption key.
  • Decrypting the encrypted data and performing data analysis on the decrypted data includes: decrypting the encrypted data to be analyzed according to the decryption key returned by the data contributor client, and performing data analysis on the decrypted data.
  • the above-mentioned data sharing method further includes: using a trusted execution program to invoke a smart contract to realize point transfer and ledger update.
  • a data sharing method including: the data sharing platform receives the identity authentication information of the data user; based on the identity authentication information of the data user, the data sharing platform generates a trusted execution program, so as to The trusted execution program is used to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data to obtain the data analysis result of the encrypted data to be analyzed.
  • the execution process of the letter executor is not visible to the data consumer.
  • the above data sharing method further includes: the data sharing platform determines a service code selected by the data user, wherein the data sharing platform stores a variety of service codes that can be selected by the data user.
  • Each business code in the business codes is a code used for analyzing data that has been reviewed by members of the alliance chain; wherein, based on the identity authentication information of the data user, the data sharing platform generates a trusted execution program, including: the data sharing platform The identity authentication information of the data user, the business code selected by the data user, and the encryption-decryption function are compiled to generate a trusted executable program.
  • the data sharing method further includes: the data sharing platform receives metadata and encrypted data sent by the data contributor client that meet the preset data standards in the data sharing platform, wherein the metadata includes encrypted data The description information of the data, so that the data user can search based on the metadata and select the encrypted data to be analyzed according to the search result.
  • a data sharing device including: an acquisition module for acquiring encrypted data to be analyzed in a data sharing platform selected by a data user; an analysis module for using a trusted execution program Decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data to obtain the data analysis result of the encrypted data to be analyzed, wherein the trusted executive program has built-in identity authentication information of the data user, and the execution process of the trusted executive program Not visible to data consumers.
  • a data sharing device comprising: a receiving module, for the data sharing platform to receive the identity authentication information of the data user;
  • the data sharing platform generates a trusted execution program, so as to use the trusted execution program to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data, and obtain the data analysis result of the encrypted data to be analyzed.
  • the identity authentication information of the data user, and the execution process of the trusted executive program is invisible to the data user.
  • a computer-readable storage medium on which computer-executable instructions are stored, characterized in that, when the executable instructions are executed by a processor, the data sharing method as described above is implemented .
  • an electronic device includes: a processor; a memory for storing instructions executable by the processor; and a processor for executing the data of any one of the above shared method.
  • the data can be directly obtained without frequent communication with data contributors during the data analysis process.
  • the data analysis result of the encrypted data to be analyzed can improve the data analysis efficiency.
  • the trusted executive program has built-in identity authentication information of the data user, which can ensure that only authorized users can interact with the data through the trusted executive program; moreover, the execution process of the trusted executive program is invisible to the data user. , which can ensure that data will not be leaked to users during the interaction process, thereby ensuring the security of shared data.
  • FIG. 1 is a schematic diagram of a scene to which the embodiment of the present application is applied.
  • FIG. 2 is a schematic flowchart of a data sharing method provided by an embodiment of the present application.
  • FIG. 3 shows a schematic flowchart of obtaining encrypted data to be analyzed according to an embodiment of the present application.
  • FIG. 4 shows a schematic flowchart of decrypting encrypted data to be analyzed according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a data sharing system provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of a data sharing method provided by another embodiment of the present application.
  • FIG. 7 is a block diagram of a data sharing apparatus according to an embodiment of the present application.
  • FIG. 8 is a block diagram of a data sharing apparatus provided by another embodiment of the present application.
  • FIG. 9 shows a block diagram of an electronic device according to another embodiment of the present application.
  • FIG. 1 is a schematic diagram of a scene to which the embodiment of the present application is applied. As shown in FIG. 1 , a scenario to which the embodiments of the present application are applicable includes a data sharing platform 110 , a data contributor client 120 , and a data user client 130 .
  • the data sharing platform 110 is created based on blockchain technology, and can provide alliance chain services such as membership authentication, ledger, and smart contracts.
  • Membership authentication may use asymmetric encryption, and use the public key in the public key/private key pair to identify the user's identity. It should be understood that this application does not specifically limit this. Specifically, a client (eg, a data contributor client, a data consumer client, etc.) generates a public/private key pair, and uses the public key to register on the data sharing platform.
  • a client eg, a data contributor client, a data consumer client, etc.
  • the consortium chain can adopt Hyperledger technology to provide member management and authentication services.
  • the Hyperledger can record information such as the data user's decryption key application record and the point transfer record after successful decryption. This application does not limit the specific record content in the Hyperledger.
  • Smart contracts specify triggers for changes to the Hyperledger.
  • Trusted executive programs can call smart contracts through the application programming interface (SDK) provided by Hyperledger.
  • SDK application programming interface
  • Data standards for metadata and encrypted data are preset in the data sharing platform 110, and metadata and encrypted data satisfying the preset data standards are stored.
  • the data contributor can use the data contributor client 120 to upload metadata and encrypted data that meet preset data standards to the data sharing platform 110 .
  • the metadata includes description information of encrypted data. Metadata can usually be disclosed and can be used as tags for data users to query or retrieve data, so that data users can select the required encrypted data according to the metadata information.
  • the data sharing platform 110 also stores a variety of business codes that can be selected by the data user, and each business code in the multiple business codes is a code used for analyzing data that has been reviewed by members of the alliance chain.
  • the data user can select the service code in the data sharing platform 110 through the data user client 130 with built-in user identity authentication.
  • the data sharing platform 110 determines the business code selected by the data user, and receives the data user's identity authentication information (eg, public key) uploaded by the data user client 130, the data sharing platform 110 verifies the data user's identity authentication information. , Compile the business code and encryption-decryption function selected by the data user to generate a trusted executable program whose execution process is invisible to the data user.
  • the trusted execution program can ensure that only authorized users can interact with the data through the program, and the data will not be leaked to the user during the interaction process, which can ensure the security of the data.
  • the data user can download the trusted execution program and the selected encrypted data through the data user client 130, use the local computing power to decrypt the encrypted data through the trusted execution program, and perform data analysis on the decrypted data to obtain data analysis. result. It should be understood that the data analysis can also be completed by using the computing power of the data sharing platform 110 after encrypting the data and the trusted execution program, which is not specifically limited in this application.
  • FIG. 2 is a schematic flowchart of a data sharing method provided by an embodiment of the present application.
  • the method may be performed by a computer device (eg, a server). As shown in Figure 2, the method includes the following contents.
  • S110 Obtain the encrypted data to be analyzed in the data sharing platform selected by the data user.
  • Shareable encrypted data is stored in the data sharing platform, and data users can select the required encrypted data (ie, encrypted data to be analyzed) for analysis according to personal needs.
  • Encrypted data refers to data obtained by encrypting primary data using an encryption algorithm.
  • a decryption key is required to decrypt the encrypted data to obtain the master data.
  • the main data may be important data such as scientific research data and medical data, and the type of the main data is not specifically limited in this application.
  • the data contributor can independently choose the encryption algorithm and use the data contributor client to encrypt the main data.
  • the encryption algorithm can be symmetric encryption or asymmetric encryption, which is not specifically limited in this application.
  • the data contributor can periodically modify the key of encrypted data, and synchronously update the encrypted data in the data sharing platform, which is not specifically limited in this application.
  • Master data is the core of the data and usually needs to be kept confidential. Therefore, in the embodiment of the present application, the data sharing platform only saves the encrypted master data (that is, encrypted data) to provide a centralized data transmission service, and the data contributor saves the decryption key, which can ensure the integrity of the master data. safety.
  • an expert group formed by members of the alliance chain with identification capabilities may also review the master data, so as to ensure the quality of the shared data.
  • S120 Decrypt the encrypted data to be analyzed by using a trusted execution program and perform data analysis on the decrypted data to obtain a data analysis result of the encrypted data to be analyzed, wherein the trusted execution program has built-in identity authentication information of the data user, and The execution of the Trusted Executor is invisible to the data consumer.
  • the trusted execution program can use the decryption key to decrypt the encrypted data to be analyzed to obtain master data; then, the trusted execution program performs data analysis on the master data to obtain the data analysis result. It should be understood that the present application does not specifically limit the decryption key acquisition process and the data analysis process.
  • the trusted executable program may be a binary trusted executable program generated after compilation, which can realize that the execution process of the trusted executable program is invisible to data users, and ensures that data will not be leaked to data users. At the same time, it can also prevent the trusted executable program from being cracked by reverse engineering, thereby ensuring the security of shared data.
  • the trusted execution program can be generated by the data sharing platform based on the identity authentication information of the data user.
  • the data sharing platform can compile the received identity authentication information (for example, public key) of the data user into the trusted execution program to ensure the one-to-one correspondence between authorized users and trusted execution programs, so that only authorized users Only then can the trusted executive program interact with the data to further ensure the security of the shared data.
  • identity authentication information for example, public key
  • execution subject of the above steps S110 and S120 may be a data sharing platform or a data user client, which is not specifically limited in this application.
  • the data sharing platform determines the encrypted data to be analyzed according to the selection of the data user; Decrypt and perform data analysis on the decrypted data to obtain the data analysis result, that is, use the computing power of the data sharing platform to complete the data analysis.
  • the data user client can download the trusted execution program and the encrypted data to be analyzed selected by the data user from the data sharing platform; and use the trusted execution
  • the program decrypts the encrypted data to be analyzed and analyzes the decrypted data to obtain the data analysis result. That is, the encrypted data to be analyzed can also be downloaded to the data user client, and the data analysis can be completed by using the local computing power.
  • the data can be directly obtained without frequent communication with data contributors during the data analysis process.
  • the data analysis result of the encrypted data to be analyzed can improve the data analysis efficiency.
  • the trusted executive program has built-in identity authentication information of the data user, which can ensure that only authorized users can interact with the data through the trusted executive program; moreover, the execution process of the trusted executive program is invisible to the data user. , which can ensure that data will not be leaked to users during the interaction process, thereby ensuring the security of shared data.
  • the trusted execution program is generated by compiling the identity authentication information of the data user, the business code selected by the data user, and the encryption-decryption function through the data sharing platform, wherein the data sharing The platform stores a variety of business codes that can be selected by data users, and each business code in the various business codes is a code used for analyzing data that has been reviewed by members of the alliance chain.
  • Business code refers to the code for analyzing data, which can be reviewed offline by members of the alliance chain to ensure that its execution process is invisible to data users and there is no other function of leaking and decrypting data.
  • the business code may be the code of scientific research data analysis methods such as biology and chemistry.
  • the business code may be a code of a general data analysis method, or may be a code developed to meet the user's personalized data analysis requirements, or the like. It should be understood that this application does not specifically limit this.
  • the user can swipe up and down in the service code list on the user interface of the data user client to select the desired service code name, or use the service code retrieval function to quickly select the desired service code name by entering the desired service code name. It should be understood that this application does not specifically limit the required business code.
  • the data user client uploads the data user's identity authentication information (for example, public key) to the data sharing platform; the data sharing platform receives the data user's identity authentication information, and provides The business code selected by the data user, the identity authentication information of the data user and the encryption-decryption function are compiled to generate a trusted execution program.
  • the data user's identity authentication information for example, public key
  • business code can be uploaded to the data sharing platform by the business code developer. It should be understood that a data user or a data contributor may also be a business code developer, which is not specifically limited in this application.
  • the encrypted data to be analyzed is retrieved based on metadata stored in the data sharing platform that meets a preset data standard, wherein the metadata includes description information of the encrypted data.
  • the data contributor may also upload the metadata corresponding to the encrypted data to the data sharing platform.
  • Metadata is information that describes encrypted data. Metadata can usually be made public and can be used as tags for data query or retrieval by data consumers. Data users can retrieve data on the data sharing platform in an anonymous manner, and select the required encrypted data according to the retrieved metadata information.
  • a data standard for metadata is preset in the data sharing platform.
  • the data standard can be data for a specific field or a data standard formulated by experts in the industry, which specifies what metadata should contain and its value range, etc. .
  • Data contributors need to make metadata according to this standard and upload it to the data sharing platform through the data contributor client.
  • the metadata information may be as shown in Table 1. It should be understood that the present application does not limit the specific data standards and data content of the metadata.
  • the data user cannot directly view the encrypted data, but selects the required encrypted data by retrieving metadata, which can ensure the security of the encrypted data.
  • the data sharing platform in addition to storing encrypted data and metadata, can also store system attribute information corresponding to the encrypted data.
  • the system attribute information specifies the usage rules for encrypted data.
  • the system attribute information can include the unique data ID of the encrypted data, the data contributor, the credits required to use the data, and/or the data digest used to verify the data (for example, encrypted data MD5 value, decrypted data MD5 value, decryption key MD5 value, etc.), etc., as shown in Table 2. It should be understood that what is shown in Table 2 is only an exemplary description, and the present application does not limit the specific content of the system attribute information.
  • a data digest is a string used to indicate the uniqueness of a data file.
  • the character string is generated by the data digest algorithm. Any modification to the data file will result in different data digests.
  • Commonly used data digests include MD5, SHA1, etc. The specific types of data digests are not limited in this application.
  • the method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes the encrypted data to be analyzed. Analyzing the data ID information of the encrypted data; wherein, acquiring the encrypted data to be analyzed in the data sharing platform selected by the data user includes: using a trusted execution program to obtain the encrypted data to be analyzed according to the data ID information of the encrypted data to be analyzed.
  • the data user downloads the data list information (such as Table 2 above) from the data sharing platform through the data user client; and the trusted execution program in the data user client can be based on the data ID information in the data list information , download the encrypted data to be analyzed from the data sharing platform.
  • the data list information such as Table 2 above
  • the acquisition process of the encrypted data to be analyzed may include the following:
  • S210 The data user client downloads data list information corresponding to the data to be analyzed.
  • this step may not require identity verification, which is not limited in this application.
  • S220 The data user client parses the data list information to obtain the data ID of the encrypted data to be analyzed.
  • the trusted execution program in the data user client uses the user public key to apply to the data sharing platform for encrypted data.
  • S240 The data sharing platform verifies the user's public key for authentication.
  • the data consumer client can use the trusted execution program to decrypt the encrypted data, and perform data analysis on the decrypted data.
  • the trusted execution program in the data sharing may obtain the encrypted data to be analyzed according to the data ID information in the data list information, which is not specifically limited in this application.
  • the above data sharing method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes data summary information about the encrypted data to be analyzed; Regarding the data digest information of the encrypted data to be analyzed, a trusted execution program is used to perform data digest verification.
  • the data user downloads the data list information (such as Table 2 above) from the data sharing platform through the data user client, and the trusted execution program in the data user client can obtain the The received data is subjected to data summary verification to ensure the accuracy of the data.
  • the data list information such as Table 2 above
  • the trusted execution program downloads the encrypted data from the data sharing platform, it can check the encrypted data according to the data digest (for example, the MD5 value) of the encrypted data in the data list information.
  • the data digest for example, the MD5 value
  • the decrypted data can be verified according to the data digest (eg, MD5 value) of the decrypted data in the data list information.
  • data digest eg, MD5 value
  • the decryption key After the trusted execution program obtains the decryption key, the decryption key can be verified according to the data digest (eg, MD5 value) of the decryption key in the data list information. By verifying the decryption key, the problem of data unavailability due to wrong decryption key can be avoided.
  • the key application record may also be written into the blockchain for storage, which is not limited in this application.
  • the relevant data is verified according to the data abstract through the trusted execution program, which can ensure the accuracy of the data.
  • the above data sharing method further includes: acquiring data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes information of data contributors of the encrypted data to be analyzed; According to the information of the data contributor, the trusted executive program is used to apply to the data contributor client for the decryption key of the encrypted data to be analyzed; the decryption key returned by the data contributor client is received; wherein, the trusted executive program is used to encrypt the data to be analyzed.
  • Decrypting the data and performing data analysis on the decrypted data includes: decrypting the encrypted data to be analyzed according to the decryption key returned by the data contributor client, and performing data analysis on the decrypted data.
  • the decryption process of the encrypted data to be analyzed may include the following contents.
  • the trusted execution program After downloading the encrypted data, the trusted execution program uses the public key to apply to the data contributor client for a decryption key of the encrypted data to be analyzed according to the data contributor information in the data list information.
  • the decryption key application record of the data user may be recorded in the blockchain ledger.
  • S320 The data contributor client receives the user public key sent by the trusted execution program, and sends the public key verification information to the data sharing platform.
  • S340 The trusted executive program verifies the data digest of the decryption key.
  • the trusted execution program can verify the decryption key according to the data digest of the decryption key in the data list information.
  • the decryption key sent by the data contributor client is incorrect, and a reminder message can be sent to the data contributor client to make the data contributor client resend the decryption key.
  • the data digest of the encrypted data in the data sharing platform is not updated synchronously. At this time, the data contributor needs to update the data digest and data digest of the encrypted data in the data sharing platform. Encrypt the data, and then the trusted execution program re-downloads the encrypted data in the data sharing platform and the data list information corresponding to the encrypted data.
  • S360 The trusted execution program uses the user's private key to decrypt the encrypted decryption key sent by the data contributor client to obtain the decryption key.
  • S370 The trusted execution program decrypts the encrypted data to be analyzed by using the decryption key to obtain decrypted data.
  • the trusted executive program runs the business code to perform data analysis on the decrypted data, and obtains a data analysis result.
  • the process of downloading encrypted data and decrypting encrypted data by the trusted executable program can be separated, that is, the encrypted data can be downloaded in advance, and the encrypted data can be decrypted when used; Instantly decrypt encrypted data, etc. It should be understood that this application does not specifically limit this.
  • the above-mentioned data sharing method further includes: using a trusted execution program to invoke a smart contract to realize point transfer and ledger update.
  • the embodiment of the present application uses points to realize the transfer of benefits in the process of data use.
  • smart contracts can be used to handle the process of transferring points after a user successfully accesses encrypted data.
  • a trusted executive can invoke a smart contract to transfer credits from a data consumer's account to at least one data contributor's account; transfer credits from a data consumer's account to a consortium chain member account that audits metadata and master data; and / Or, transfer the points of the business code developer account to the consortium chain member account that reviews the business code, etc.
  • this application does not specifically limit the rules of point allocation.
  • the above descriptions are only exemplary descriptions, and the object of point transfer is not specifically limited in the present application.
  • Smart contracts can take the form of one-to-one or one-to-many, for example, one data user account transfers points to one or more data contributor accounts; in addition, smart contracts can also take the form of many-to-one, for example, multiple A data user account transfers credits to a data contributor account. It should be understood that this application does not specifically limit this.
  • the point transfer record may be recorded in the blockchain ledger.
  • the trusted execution program invokes the smart contract to transfer points and update the ledger, which can realize the transparency and sharing incentives of the data sharing process in combination with the blockchain technology.
  • FIG. 5 is a schematic diagram of a data sharing system provided by an embodiment of the present application.
  • the data sharing system includes a data sharing platform 510 , a data contributor client 520 , a business code developer client 530 and a data consumer client 540 .
  • the data sharing process will be described in detail below with reference to FIG. 5 .
  • data contributors provide metadata and master data. Among them, data contributors can select members of the alliance chain to conduct offline audits of metadata and master data to ensure the quality of shared data.
  • the data contributor uses the data contributor client 520 to package the master data and generate a data summary (eg, MD5 value).
  • data contributors can also agree with the members of the alliance chain participating in the audit on the rules for the distribution of points, that is, how many members of the alliance chain are allocated to each time the data user uses the transferred points.
  • alliance chain member information, agreed point distribution rules and data summaries can be written into the blockchain ledger.
  • the metadata standard verification module 521 in the data contributor client 520 can call the preset data standard in the data standard module 511 to verify the metadata, and after the data standard verification is successful, it can be uploaded to the data sharing platform 510 .
  • the master data encryption module 522 in the data contributor client 520 may encrypt the packaged master data to generate encrypted data.
  • the data encryption/decryption key management module 523 in the data contributor client 520 may manage decryption keys for encrypted data.
  • the data contributor can periodically modify the key of the encrypted data through the data contributor client 520, and update the encrypted data and the data digest to the data sharing platform 510 synchronously.
  • the data contributor uploads the encrypted data and metadata to the platform 510 through the data contributor client 520 with built-in user identity authentication, and uploads the system attribute information of the encrypted data, such as: points required to use the data; data digest of the packaged data ( It may also be referred to as the data digest of the decrypted data) to prevent the data contributor from tampering with the data; the data digest of the encrypted data; the data digest of the decryption key, etc., which are not specifically limited in this application.
  • Data contributors can specify that only trusted executive programs that have been audited by specific consortium chain members can access the data.
  • the business code developer develops compilable business code according to the data standards and sample data specified by the data sharing platform 510, and submits the developed business code to the data sharing platform through the business code developer client 530.
  • the data standard module 511 of the data sharing platform 510 is preset with data standards in this field (such as metadata standards, encrypted data standards, etc.), and the data provided by data contributors must meet the standards .
  • the data sharing platform 510 is created based on blockchain technology, and can provide alliance chain services such as membership authentication, ledger, and smart contracts.
  • the data storage module 512 of the data sharing platform 510 stores metadata, encrypted data and system attribute information uploaded by the data contributor client 520 (eg, Table 1 above).
  • the data sharing platform 510 can provide centralized storage and download functions of encrypted data, which can avoid the data transmission bottleneck of the blockchain network and speed up the data transmission efficiency.
  • a data retrieval website is established on the data sharing platform 510, which can facilitate the data submitted by the data contributor to be discovered by the data user.
  • Data consumers can select the desired encrypted data by retrieving metadata in the data retrieval website.
  • the identity authentication & authorization module 513 in the data sharing platform 510 can provide identity authentication & authorization services, and consortium chain participants (eg, data contributors, data users, business code developers, etc.) can submit identity authentication information to the data sharing platform
  • consortium chain participants eg, data contributors, data users, business code developers, etc.
  • the platform 510 is synchronized to each node/client by the data sharing platform 510 .
  • the data sharing platform 510 provides service code retrieval and auditing services. That is, the data sharing platform can invite members of the alliance chain to review and test the security of the business code (for codes with confidentiality requirements, the business code developer can designate members of the alliance chain for review) to ensure that its output will not leak the input data .
  • the review information can be written into the blockchain ledger (for example, the ID of the business code; the members of the alliance chain participating in the review; and the data user agreed between the business code developer and the code reviewer to call the business code, and the credits will be collected. Allocation mechanism between business code developers and code reviewers).
  • the trusted executable program generation module 514 in the data sharing platform 510 may generate a binary trusted executable program. Specifically, after the data user selects the required business code, the trusted execution program submits the data user's identity authentication information (public key), and the trusted execution program generation module 514 encrypts-decrypts the data user's identity authentication information, encryption-decryption The program and the business code selected by the data user are compiled into a trusted execution program and sent to the data user client 540 . Wherein, when the data user accesses the data through the trusted execution program, the identity authentication information built in the trusted execution program is used as the data user mark.
  • the data sharing platform 510 may also generate a trusted executable program list for the generated trusted executable program, which is not specifically limited in this application.
  • the data user client 540 with built-in user identity authentication is used to download the data list corresponding to the encrypted data, and the data list information may contain data ID, data contributor, points required to use data, MD5 value of encrypted data, MD5 value of decrypted data, MD5 value of decryption key, etc., which are not specifically limited in this application.
  • the data user selects the business code on the data sharing platform 510 through the data user client 540, and uploads the personal identity authentication information through the data user client 540, so that the data sharing platform 510 encrypts the data user's identity authentication information, encryption -
  • the decryption program and the business code selected by the data user are compiled into a trusted executable program and sent to the data user client 540 .
  • the data user client 540 uses the obtained trusted executable program to download encrypted data, decrypt the encrypted data, and perform data analysis on the decrypted data, and output the data analysis result.
  • the execution steps of the trusted execution program in the data user client 540 are:
  • the trusted execution program parses the data list information, downloads the encrypted data according to the data ID in the data list information, and verifies the data integrity according to the MD5 value of the encrypted data in the data list information.
  • the encrypted data and data list information can be downloaded from the data sharing platform again.
  • the trusted executable program can use the public key to apply to the data encryption/decryption key management module 523 in the data contributor client 520 for the encrypted data to be analyzed according to the information of the data contributor in the data list information.
  • Decryption key the data contributor client 520 receives the public key sent by the trusted executive program, and sends the public key verification information to the identity authentication & authorization module 513 in the data sharing platform 510; when the verification is successful, the data contributor client 520 is to encrypt the decryption key with the public key and send it to the trusted executive program (the underlying gRPC network in Hyperledger provides the function of transmitting the decryption key); the trusted executive program uses the decryption key MD5 in the data list information Value check decryption key.
  • the verification information can be written into the blockchain ledger, and the content can be "the received decryption key MD5 value, the MD5 value registered by the platform", it should be understood that this application does not specifically limit this.
  • the decryption key By verifying the decryption key, the problem of data unavailability caused by the wrong key provided by the data contributor can be avoided; by writing the verification information into the blockchain, the key application record can be saved, and the process does not involve the transfer of points .
  • the trusted executive program decrypts the encrypted data with the decryption key to obtain the decrypted data; and verifies the decrypted data according to the MD5 value of the decrypted data, and if the decryption is successful, writes the point transfer information into the block Chain ledger.
  • the ledger structure can be:
  • the data user client 540 can send the verified data list information back to the data sharing platform 510, and attach the identity authentication and timestamp.
  • the data sharing platform 510 may store data access records and write data summaries of the data access records into the blockchain ledger.
  • the business code in the trusted execution program uses the decrypted data as input to perform data analysis, and provides the data analysis result as output to the data user.
  • the business code call information can be written into the blockchain ledger.
  • the trusted execution program can transfer the points of the data user account to the business code developer account by calling the smart contract. Whether to write into the blockchain ledger is determined by the business code developer during the business code review, and this application does not specifically limit this.
  • the data contributor client 520 , the business code developer client 530 and the data user client 540 may be App clients or web clients, which are not specifically limited in this application.
  • the data contributor and the data user may also be business code developers; the data contributor client 520 and the data user client 540 may also be the business code developer client 530, which is not specifically limited in this application.
  • the centralized and secure data storage and downloading functions are provided through the data sharing platform, which avoids the problem that the blockchain network is not suitable for large data storage and transmission;
  • the standardized metadata retrieval function is provided through the data sharing platform , which is convenient for data users to find the data they need; by using the data contributor client to perform localized encryption and save the key, the security of the data can be ensured; the data digest verification through the trusted executable program can ensure that the data is to be used. data accuracy.
  • the data sharing process can be achieved without data leakage or reverse cracking; the transparency, intelligent sharing and incentives of the data sharing process can be achieved through blockchain technology.
  • the embodiment of the present application organically integrates the trusted execution program and the alliance chain, which simplifies the human operation in the data sharing process, improves the sharing security and convenience, and improves the user experience.
  • FIG. 6 is a schematic flowchart of a data sharing method provided by another embodiment of the present application. As shown in Figure 6, the method includes the following contents.
  • S610 The data sharing platform receives the identity authentication information of the data user.
  • the data sharing platform Based on the identity authentication information of the data user, the data sharing platform generates a trusted execution program, so as to use the trusted execution program to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data to obtain the data of the encrypted data to be analyzed According to the analysis result, the trusted executive program has built-in identity authentication information of the data user, and the execution process of the trusted executive program is invisible to the data user.
  • the trusted execution program is used to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data, without needing to communicate with data contributors in the process of data analysis.
  • the data analysis result of the encrypted data to be analyzed can be directly obtained, which can improve the data analysis efficiency.
  • the trusted executive program has built-in identity authentication information of the data user, which can ensure that only authorized users can interact with the data through the trusted executive program; moreover, the execution process of the trusted executive program is invisible to the data user. , which can ensure that data will not be leaked to users during the interaction process, thereby ensuring the security of shared data.
  • the above data sharing method further includes: the data sharing platform determines a service code selected by the data user, wherein the data sharing platform stores a variety of service codes that can be selected by the data user.
  • Each business code in the business codes is a code used for analyzing data that has been reviewed by members of the alliance chain; wherein, based on the identity authentication information of the data user, the data sharing platform generates a trusted execution program, including: the data sharing platform The identity authentication information of the data user, the business code selected by the data user, and the encryption-decryption function are compiled to generate a trusted executable program.
  • the data sharing method further includes: the data sharing platform receives metadata and encrypted data sent by the data contributor client that meet the preset data standards in the data sharing platform, wherein the metadata includes encrypted data The description information of the data, so that the data user can search based on the metadata and select the encrypted data to be analyzed according to the search result.
  • FIG. 7 is a block diagram of a data sharing apparatus according to an embodiment of the present application. As shown in FIG. 7 , the data sharing apparatus 700 includes:
  • the obtaining module 710 is configured to obtain the encrypted data to be analyzed in the data sharing platform selected by the data user.
  • the analysis module 720 is used to decrypt the encrypted data to be analyzed by using a trusted execution program and perform data analysis on the decrypted data to obtain a data analysis result of the encrypted data to be analyzed, wherein the trusted execution program has a built-in identity of the data user Authentication information, and the execution process of the trusted executive program is invisible to the data user.
  • the data can be directly obtained without frequent communication with data contributors during the data analysis process.
  • the data analysis result of the encrypted data to be analyzed can improve the data analysis efficiency.
  • the trusted executive program has built-in identity authentication information of the data user, which can ensure that only authorized users can interact with the data through the trusted executive program; moreover, the execution process of the trusted executive program is invisible to the data user. , which can ensure that data will not be leaked to users during the interaction process, thereby ensuring the security of shared data.
  • the above-mentioned trusted execution program is generated by compiling the identity authentication information of the data user, the business code selected by the data user, and the encryption-decryption function through the data sharing platform, wherein the data
  • the sharing platform stores a variety of business codes for data users to choose from, and each business code in the multiple business codes is a code used for analyzing data that has been reviewed by members of the alliance chain.
  • the above encrypted data to be analyzed is retrieved based on metadata stored in the data sharing platform that meets a preset data standard, wherein the metadata includes description information of the encrypted data.
  • the obtaining module 710 is configured to obtain data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes data ID information of the encrypted data to be analyzed; The data ID information of the data, use the trusted execution program to obtain the encrypted data to be analyzed.
  • the obtaining module 710 is configured to obtain data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes data summary information about the encrypted data to be analyzed; the above data sharing
  • the apparatus further includes a verification module 730 for performing data digest verification using a trusted execution program according to the data digest information about the encrypted data to be analyzed.
  • the obtaining module 710 is configured to obtain data list information corresponding to the encrypted data to be analyzed in the data sharing platform, wherein the data list information includes information of data contributors of the encrypted data to be analyzed; the above data
  • the sharing device further includes an application module 740 for applying a decryption key of the encrypted data to be analyzed to the client of the data contributor by using a trusted execution program according to the information of the data contributor; a receiving module for receiving the return from the client of the data contributor wherein, the analysis module is used to decrypt the encrypted data to be analyzed according to the decryption key returned by the data contributor client, and perform data analysis on the decrypted data.
  • the above-mentioned data sharing apparatus further includes a calling module 750 for calling the smart contract by using the trusted execution program, so as to realize the transfer of points and the update of the ledger.
  • FIG. 8 is a block diagram of a data sharing apparatus provided by another embodiment of the present application. As shown in Figure 8, the data sharing apparatus 800 includes:
  • the receiving module 810 is used for the data sharing platform to receive the identity authentication information of the data user.
  • the generating module 820 is used for generating a trusted execution program based on the identity authentication information of the data user, so as to use the trusted execution program to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data to obtain the data to be analyzed.
  • the data analysis result of the encrypted data wherein the trusted executive program has built-in identity authentication information of the data user, and the execution process of the trusted executive program is invisible to the data user.
  • the trusted execution program is used to decrypt the encrypted data to be analyzed and perform data analysis on the decrypted data, without needing to communicate with data contributors in the process of data analysis.
  • the data analysis result of the encrypted data to be analyzed can be directly obtained, which can improve the data analysis efficiency.
  • the trusted executive program has built-in identity authentication information of the data user, which can ensure that only authorized users can interact with the data through the trusted executive program; moreover, the execution process of the trusted executive program is invisible to the data user. , which can ensure that data will not be leaked to users during the interaction process, thereby ensuring the security of shared data.
  • the above-mentioned data sharing apparatus further includes a determination module 830, which is used for the data sharing platform to determine the business code selected by the data user, wherein the data sharing platform stores a plurality of service codes that can be selected by the data user.
  • a determination module 830 which is used for the data sharing platform to determine the business code selected by the data user, wherein the data sharing platform stores a plurality of service codes that can be selected by the data user.
  • the generation module 820 is used by the data sharing platform for the identity authentication information of the data user, the data user
  • the selected business code and encryption-decryption functions are compiled to generate a trusted executive program.
  • the receiving module 810 is configured for the data sharing platform to receive metadata and encrypted data sent by the data contributor client that meet the preset data standards in the data sharing platform, wherein the metadata includes encrypted data Description information, so that data users can search based on metadata and select encrypted data to be analyzed according to the search results.
  • FIG. 9 shows a block diagram of an electronic device 900 according to an embodiment of the present application.
  • an electronic device 900 includes a processing component 910, which further includes one or more processors, and a memory resource, represented by memory 920, for storing instructions executable by the processing component 910, such as an application program.
  • An application program stored in memory 920 may include one or more modules, each corresponding to a set of instructions.
  • the processing component 910 is configured to execute instructions to perform the data sharing method described above.
  • the electronic device 900 may also include a power supply assembly configured to perform power management of the electronic device 900, a wired or wireless network interface configured to connect the electronic device 900 to a network, and an input output (I/O) interface.
  • Electronic device 900 may operate based on an operating system stored in memory 920, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM or the like.
  • a non-transitory computer-readable storage medium when the instructions in the storage medium are executed by the processor of the electronic device 900, the electronic device 900 can execute the data sharing method.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other various programs that can store check codes medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Storage Device Security (AREA)

Abstract

一种数据共享方法及装置。该数据共享方法包括：获取数据使用者选择的数据共享平台中的待分析加密数据（S110）；利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见（S120），能够保证数据共享过程中共享数据的安全性，并提高数据分析效率。

Description

数据共享方法及装置 技术领域
本申请涉及数据共享技术领域，具体涉及一种数据共享方法及装置。
发明背景
数据共享能够合理地达到资源配置，节约社会成本，创造更多财富的目的，是提高数据资源利用率，避免在数据采集、存储和管理上重复浪费的一个重要手段。
然而，尽管存在类似于NCBI(美国国家生物技术信息中心)的数据共享平台，但是，在共享和使用数据的过程中，数据不可避免的暴露在外，数据的安全性无法保证。虽然联邦学习，零知识证明等技术提供了数据“可用不可见”的可能性，但是，在数据分析使用过程中，数据使用方与数据贡献方需要频繁通信，影响了数据分析效率。
发明内容
有鉴于此，本申请实施例提供了一种数据共享方法及装置，能够保证数据共享过程中共享数据的安全性，并提高数据分析效率。
根据本申请实施例的第一方面，提供一种数据共享方法，包括：获取数据使用者选择的数据共享平台中的待分析加密数据；利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
在本申请的另一个实施例中，可信执行程序是通过数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译后生成的，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码。
在本申请的另一个实施例中，上述待分析加密数据是基于数据共享平台中存储的满足预设数据标准的元数据检索得到的，其中，元数据包括加密数据的描述信息。
在本申请的另一个实施例中，上述数据共享方法还包括：获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据ID信息；其中，上述获取数据使用者选择的数据共享平台中的待分析加密数据，包括：根据待分析加密数据的数据ID信息，利用可信执行程序获取待分析加密数据。
在本申请的另一个实施例中，上述数据共享方法还包括：获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括关于待分析加密数据的数据摘要信息；根据关于待分析加密数据的数据摘要信息，利用可信执行程序进行数据摘要校验。
在本申请的另一个实施例中，上述数据共享方法还包括：获取数据共享平台中与待分析加 密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据贡献者的信息；根据数据贡献者的信息，利用可信执行程序向数据贡献者客户端申请待分析加密数据的解密密钥；接收数据贡献者客户端返回的解密密钥；其中，上述利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，包括：根据数据贡献者客户端返回的解密密钥对待分析加密数据进行解密，并对解密后的数据进行数据分析。
在本申请的另一个实施例中，上述数据共享方法还包括：利用可信执行程序调用智能合约，以实现积分转移和账本更新。
根据本申请实施例的第二方面，提供一种数据共享方法，包括：数据共享平台接收数据使用者的身份认证信息；基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，以便于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
在本申请的另一个实施例中，上述数据共享方法还包括：数据共享平台确定数据使用者选择的业务代码，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码；其中，上述基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，包括：数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译，生成可信执行程序。
在本申请的另一个实施例中，上述数据共享方法还包括：数据共享平台接收数据贡献者客户端发送的满足数据共享平台中预设数据标准的元数据和加密数据，其中，元数据包括加密数据的描述信息，以便于数据使用者基于元数据进行检索，并根据检索结果选择待分析加密数据。
根据本申请实施例的第三方面，提供一种数据共享装置，包括：获取模块，用于获取数据使用者选择的数据共享平台中的待分析加密数据；分析模块，用于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
根据本申请实施例的第四方面，提供一种数据共享装置，包括：接收模块，用于数据共享平台接收数据使用者的身份认证信息；生成模块，用于基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，以便于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
根据本申请实施例的第五方面，提供一种计算机可读存储介质，其上存储有计算机可执行指令，其特征在于，可执行指令被处理器执行时实现如上述任一项的数据共享方法。
根据本申请实施例的第六方面，提供一种电子设备，其特征在于，电子设备包括：处理器；用于存储处理器可执行指令的存储器；处理器，用于执行上述任一项的数据共享方法。
根据本申请实施例提供的技术方案，通过利用可信执行程序对待分析加密数据进行解密并 对解密后的数据进行数据分析，无需在数据分析的过程中与数据贡献者通信频繁，即可直接获得待分析加密数据的数据分析结果，能够提高数据分析效率。另外，可信执行程序内置有数据使用者的身份认证信息，可以确保只有经过授权的用户才能够通过可信执行程序与数据进行交互；而且，可信执行程序的执行过程对数据使用者不可见，可以保证在交互过程中不会将数据泄露给用户，从而能够保证共享数据的安全性。
附图简要说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1所示为本申请实施例所适用的一场景示意图。
图2所示为本申请一实施例提供的数据共享方法的流程示意图。
图3所示为本申请一实施例提供的获取待分析加密数据的流程示意图。
图4所示为本申请一实施例提供的解密待分析加密数据的流程示意图。
图5为本申请一实施例提供的数据共享系统的示意图。
图6所示为本申请另一实施例提供的数据共享方法的流程示意图。
图7所示为本申请一实施例提供的数据共享装置的框图。
图8所示为本申请另一实施例提供的数据共享装置的框图。
图9所示为本申请另一实施例提供的电子设备的框图。
实施本申请的方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
示例性系统
图1所示为本申请实施例所适用的一场景示意图。如图1所示，本申请实施例所适用的场景中包括数据共享平台110、数据贡献者客户端120、数据使用者客户端130。
数据共享平台110是基于区块链技术创建的，可以提供成员身份认证、账本、智能合约等联盟链服务。
成员身份认证可以采用非对称加密的方式，使用公钥/私钥对中的公钥标识用户身份，应当理解，本申请对此不作具体限定。具体地，客户端(例如数据贡献者客户端、数据使用者客户端等)生成公钥/私钥对，并使用公钥在数据共享平台进行注册。
联盟链可以采用超级账本技术，提供成员管理和认证服务。另外，超级账本中可以记录数 据使用者的解密密钥申请记录以及解密成功后的积分转移记录等信息，本申请对超级账本中的具体记录内容不作限定。
智能合约规定了更改超级账本的触发条件。可信执行程序可以通过超级账本提供的应用编程接口(SDK)调用智能合约。
数据共享平台110中预设有元数据和加密数据的数据标准，并存储有满足预设数据标准的元数据和加密数据。具体地，数据贡献者可以利用数据贡献者客户端120将满足预设数据标准的元数据和加密数据上传至数据共享平台110。其中，元数据包括加密数据的描述信息。元数据通常可以公开，可以作为标签供数据使用者进行数据查询或检索，以便于数据使用者根据元数据信息选择需要的加密数据。
另外，数据共享平台110中还存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码。
数据使用者可以通过内置有用户身份认证的数据使用者客户端130选择数据共享平台110中的业务代码。数据共享平台110确定数据使用者选择的业务代码，以及接收数据使用者客户端130上传的数据使用者的身份认证信息(例如，公钥)后，数据共享平台110对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译，生成执行过程对数据使用者不可见的可信执行程序。可信执行程序可以确保只有经过授权的用户可通过程序与数据进行交互，且交互过程不会将数据泄露给用户，能够保证数据的安全性。
数据使用者可以通过数据使用者客户端130下载可信执行程序和选择的加密数据，利用本地算力通过可信执行程序对加密数据进行解密，并对解密后的数据进行数据分析，获得数据分析结果。应当理解，也可以选择加密数据及可信执行程序后，利用数据共享平台110算力完成数据分析，本申请对此不作具体限定。
示例性方法
图2所示为本申请一实施例提供的数据共享方法的流程示意图。该方法可以由计算机设备(例如，服务器)执行。如图2所示，该方法包括如下内容。
S110：获取数据使用者选择的数据共享平台中的待分析加密数据。
数据共享平台中存储有可共享的加密数据，数据使用者可以根据个人需要从中选择需要的加密数据(即，待分析加密数据)进行分析。
加密数据是指使用加密算法对主数据进行加密得到的数据。需要解密密钥对加密数据进行解密才能得到主数据。其中，主数据可以为科研数据、医疗数据等重要数据，本申请对主数据的类型不作具体限定。具体地，数据贡献者可以自主选择加密算法并利用数据贡献者客户端对主数据进行加密。加密算法可以采用对称加密或非对称加密的方式，本申请对此不作具体限定。
在本申请的另一个实施例中，处于数据安全的考虑，数据贡献者可以定期修改加密数据的密钥，并同步更新数据共享平台中的加密数据，本申请对此不作具体限定。
主数据是数据的核心，通常需要保密。因此，在本申请实施例中，数据共享平台只保存加密后的主数据(即，加密数据)，以提供中心化的数据传输服务，以及由数据贡献者保存解密 密钥，可以保证主数据的安全性。
在本申请的另一个实施例中，在对主数据进行加密前，还可以由具有识别能力的联盟链成员组成专家组对主数据等进行审核，从而可以保证共享数据的质量。
S120：利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
具体地，可信执行程序可以利用解密密钥对待分析加密数据进行解密，得到主数据；然后，可信执行程序对主数据进行数据分析，获得数据分析结果。应当理解，本申请对解密密钥获取过程以及数据分析过程不作具体限定。
在本申请的一个实施例中，可信执行程序可以为编译后生成的二进制可信执行程序，能够实现可信执行程序的执行过程对数据使用者不可见，保证不会将数据泄露给数据使用者，同时也能够防止可信执行程序被逆向工程破解，从而保证共享数据的安全性。
具体地，可信执行程序可以由数据共享平台基于数据使用者的身份认证信息生成。数据共享平台可以将接收到的数据使用者的身份认证信息(例如，公钥)编译进可信执行程序，以确保授权用户与可信执行程序的一一对应性，从而使得只有经过授权的用户才能够通过可信执行程序与数据进行交互，进一步保证共享数据的安全性。
需要说明的是，上述步骤S110和步骤S120的执行主体可以是数据共享平台，也可以是数据使用者客户端，本申请对此不作具体限定。
例如，当上述步骤S110和步骤S120的执行主体为数据共享平台时，数据共享平台根据数据使用者的选择确定待分析加密数据；另外，利用数据共享平台生成的可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得数据分析结果，即，利用数据共享平台的算力完成数据分析。
当上述步骤S110和步骤S120的执行主体为数据使用者客户端时，数据使用者客户端可以从数据共享平台中下载可信执行程序和数据使用者选择的待分析加密数据；并利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得数据分析结果。即，也可以将待分析加密数据下载至数据使用者客户端，利用本地算力完成数据分析。
根据本申请实施例提供的技术方案，通过利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，无需在数据分析的过程中与数据贡献者通信频繁，即可直接获得待分析加密数据的数据分析结果，能够提高数据分析效率。另外，可信执行程序内置有数据使用者的身份认证信息，可以确保只有经过授权的用户才能够通过可信执行程序与数据进行交互；而且，可信执行程序的执行过程对数据使用者不可见，可以保证在交互过程中不会将数据泄露给用户，从而能够保证共享数据的安全性。
在本申请的另一个实施例中，可信执行程序是通过数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译后生成的，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成 员审核的用于分析数据的代码。
业务代码是指分析数据的代码，可以经过联盟链成员的线下审核以确定其执行过程对数据使用者不可见且不存在其他泄露解密数据的功能。
业务代码可以为生物学、化学等科研数据分析方法的代码等。另外，业务代码可以为通用数据分析方法的代码，还可以是为满足用户个性化数据分析需求而开发的代码等。应当理解，本申请对此不作具体限定。
具体地，用户可以在数据使用者客户端的用户界面上的业务代码列表中上下滑动来选择所需的业务代码名称，也可以利用业务代码检索功能，通过输入所需的业务代码名称以快速选择所需的业务代码，应当理解，本申请对此不作具体限定。
在数据使用者选择所需的业务代码后，数据使用者客户端上传数据使用者的身份认证信息(例如，公钥)至数据共享平台；数据共享平台接收数据使用者的身份认证信息，并对数据使用者选择的业务代码、数据使用者的身份认证信息和加密-解密功能进行编译，生成可信执行程序。
需要说明的是，业务代码可以由业务代码开发者上传至数据共享平台中。应当理解，数据使用者或数据贡献者也可以为业务代码开发者，本申请对此不作具体限定。
在本申请的另一个实施例中，上述待分析加密数据是基于数据共享平台中存储的满足预设数据标准的元数据检索得到的，其中，元数据包括加密数据的描述信息。
具体地，数据贡献者通过数据贡献者客户端将加密数据上传至数据共享平台的同时，还可以将加密数据对应的元数据上传至数据共享平台中。
元数据是描述加密数据的信息。元数据通常可以公开，可以作为标签供数据使用者进行数据查询或检索。数据使用者可以以匿名的方式在数据共享平台上检索，根据检索到的元数据信息选择需要的加密数据。
数据共享平台中预设有元数据的数据标准，该数据标准可以为针对某一特定领域的数据、由该行业专家制定的数据标准，其规定了元数据应该包含哪些内容及其取值范围等。数据贡献者需要按照该标准制作元数据并通过数据贡献者客户端上传至数据共享平台。在本申请的一个实施例中，元数据信息可以为表1所示，应当理解，本申请对元数据的具体数据标准及数据内容不作限定。
表1
Figure PCTCN2021137473-appb-000001
根据本申请实施例提供的技术方案，数据使用者无法直接查看加密数据，而是通过检索元数据的方式选择需要的加密数据，能够保证加密数据安全性。
在本申请的另一个实施例中，数据共享平台中除了可以存储加密数据、元数据，还可以存储加密数据对应的系统属性信息。
系统属性信息规定了加密数据的使用规则。系统属性信息可以包括加密数据唯一的数据ID、数据贡献者、使用数据所需消耗的积分和/或用来校验数据的数据摘要(例如，加密数据MD5值、解密数据MD5值、解密密钥MD5值等)等，如表2所示。应当理解，表2所示仅为示例性描述，本申请对系统属性信息的具体内容不作限定。
表2
Figure PCTCN2021137473-appb-000002
数据摘要指用来表示数据文件唯一性的字符串。该字符串由数据摘要算法生成，对数据文件进行任何改动，数据摘要算法生成的数据摘要都会不同，常用的数据摘要有MD5，SHA1等，本申请对数据摘要的具体类型不作限定。
在本申请的另一个实施例中，在数据使用者选择所需的待分析加密数据后，还包括：获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据ID信息；其中，获取数据使用者选择的数据共享平台中的待分析加密数据，包括：根据待分析加密数据的数据ID信息，利用可信执行程序获取待分析加密数据。
例如，数据使用者通过数据使用者客户端从数据共享平台中下载数据列表信息(例如上文表2)；以及数据使用者客户端中的可信执行程序可以根据数据列表信息中的数据ID信息，从数据共享平台中下载待分析加密数据。
具体地，如图3所示，待分析加密数据的获取过程可以包括以下内容：
S210：数据使用者客户端下载待分析数据对应的数据列表信息。
需要说明的是，该步骤可以不需要进行身份验证，本申请对此不作限定。
S220：数据使用者客户端解析数据列表信息，获得待分析加密数据的数据ID。
S230：根据数据ID，数据使用者客户端中的可信执行程序使用用户公钥向数据共享平台申请加密数据。
S240：数据共享平台验证用户公钥，以进行身份验证。
S250：当身份验证通过时，可信执行程序下载加密数据至数据使用者客户端。
然后，数据使用者客户端可以利用可信执行程序对加密数据进行解密，以及对解密后的数据进行数据分析。
需要说明的是，当利用数据共享平台算力完成数据分析时，可以是数据共享中的可信执行程序根据数据列表信息中的数据ID信息获取待分析加密数据，本申请对此不作具体限定。
在本申请的另一个实施例中，上述数据共享方法还包括：获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括关于待分析加密数据的数据摘要信息；根据关于待分析加密数据的数据摘要信息，利用可信执行程序进行数据摘要校验。
例如，数据使用者通过数据使用者客户端从数据共享平台中下载数据列表信息(例如上文表2)，数据使用者客户端中的可信执行程序可以根据表2中的数据摘要信息对获取到的数据进行数据摘要校验，以确保数据的准确性。
例如，可信执行程序从数据共享平台下载加密数据后，可以根据数据列表信息中的加密数据的数据摘要(例如MD5值)对加密数据进行校验。
当可信执行程序对加密数据进行解密后，可以根据数据列表信息中的解密数据的数据摘要(例如MD5值)对解密后的数据进行校验。
当可信执行程序获得解密密钥后，可以根据数据列表信息中的解密密钥的数据摘要(例如MD5值)对解密密钥进行校验。通过校验解密密钥，可以避免因解密密钥错误而导致数据不可用的问题。在本申请的另一个实施例中，还可以将密钥申请记录写入区块链以进行保存，本申请对此不作限定。
根据本申请实施例提供的技术方案，通过可信执行程序根据数据摘要对相关数据进行校验，能够保证数据的准确性。
在本申请的另一个实施例中，上述数据共享方法还包括：获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据贡献者的信息；根据数据贡献者的信息，利用可信执行程序向数据贡献者客户端申请待分析加密数据的解密密钥；接收数据贡献者客户端返回的解密密钥；其中，利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，包括：根据数据贡献者客户端返回的解密密钥对待分析加密数据进行解密，并对解密后的数据进行数据分析。
具体地，如图4所示，待分析加密数据的解密过程可以包括如下内容。
S310：在下载加密数据之后，可信执行程序根据数据列表信息中的数据贡献者信息，利用公钥向数据贡献者客户端申请待分析加密数据的解密密钥。
在本申请的一个实施例中，可以在区块链账本中记录数据使用者的解密密钥申请记录。
S320：数据贡献者客户端接收可信执行程序发送的用户公钥，并向数据共享平台发送公钥验证信息。
S330：当验证成功时，数据贡献者客户端利用用户公钥加密解密密钥，并将加密后的解密密钥发送给可信执行程序。
S340：可信执行程序校验解密密钥的数据摘要。
具体地，可信执行程序可以根据数据列表信息中的解密密钥的数据摘要对解密密钥进行校验。
当校验不成功时，可能存在两种情况：(1)数据贡献者客户端发送的解密密钥错误，可通过发送提醒信息至数据贡献者客户端，使得数据贡献者客户端重新发送解密密钥；(2)数据贡献者定期更换加密数据的密钥后，未同步更新数据共享平台中的加密数据的数据摘要，此时，需要数据贡献者更新数据共享平台中的加密数据的数据摘要和加密数据，然后可信执行程序重新下载数据共享平台中的加密数据和加密数据对应的数据列表信息。
S350：校验成功时，数据使用者向可信执行程序输入用户私钥。
S360：可信执行程序使用用户私钥解密数据贡献者客户端发送的加密后的解密密钥，从而获得解密密钥。
S370：可信执行程序利用解密密钥对待分析加密数据进行解密，获得解密数据。
S380：可信执行程序运行业务代码对解密数据进行数据分析，获得数据分析结果。
需要说明的是，可信执行程序下载加密数据和解密加密数据的过程可以是分开的，即，可以预先下载好加密数据，使用的时候再对加密数据进行解密；也可以下载好加密数据之后，立即对加密数据进行解密等。应当理解，本申请对此不作具体限定。
在本申请的另一个实施例中，上述数据共享方法还包括：利用可信执行程序调用智能合约，以实现积分转移和账本更新。
本申请实施例使用积分来实现数据使用过程中收益的转移。具体地，智能合约可以用于处理用户成功访问加密数据后转移积分的过程。例如，可信执行程序可以调用智能合约，将数据使用者账户的积分转移至至少一个数据贡献者的账户；将数据使用者账户的积分转移至审核元数据和主数据的联盟链成员账户；和/或，将业务代码开发者账户的积分转移至审核业务代码的联盟链成员账户等。应当理解，本申请对积分分配规则不作具体限定。另外，上述描述仅为示例性描述，本申请对积分转移的对象不作具体限定。
智能合约可以采取一对一、一对多的形式，例如，一个数据使用者账户向一个或多个数据贡献者账户转移积分；另外，智能合约也可以采取多对一的形式，例如，多个数据使用者账户向一个数据贡献者账户转移积分。应当理解，本申请对此不作具体限定。
在本申请的一个实施例中，可以在区块链账本中记录积分转移记录。
根据本申请实施例提供的技术方案，可信执行程序调用智能合约进行积分转移和账本更新，能够结合区块链技术实现数据共享过程的透明性及共享激励。
图5为本申请一实施例提供的数据共享系统的示意图。该数据共享系统包括数据共享平台510、数据贡献者客户端520、业务代码开发者客户端530和数据使用者客户端540。下面将结合图5对数据共享过程进行详细描述。
如图5所示，数据贡献者提供元数据和主数据。其中，数据贡献者可以选择联盟链成员对元数据和主数据进行线下审核，以保证共享数据的质量。
联盟链成员对元数据和主数据进行审核后，数据贡献者利用数据贡献者客户端520将主数据进行打包，并生成数据摘要(例如MD5值)。另外，数据贡献者还可以与参与审核的联盟链成员约定积分分配规则，即数据使用者每次使用转移的积分分配给多少联盟链成员。此外，联盟链成员信息，约定的积分分配规则和数据摘要可以写进区块链账本里。
数据贡献者客户端520中的元数据标准校验模块521可以调用数据标准模块511中的预设数据标准对元数据进行校验，数据标准校验成功后，即可上传至数据共享平台510。
数据贡献者客户端520中的主数据加密模块522可以将打包后的主数据进行加密，生成加密数据。
数据贡献者客户端520中的数据加密/解密密钥管理模块523可以管理加密数据的解密密钥。
需要说明的是，为了数据的安全性，数据贡献者可通过数据贡献者客户端520定期修改加密数据的密钥，并同步更新加密数据和数据摘要至数据共享平台510。
数据贡献方通过内置有用户身份认证的数据贡献者客户端520将加密数据和元数据上传至平台510，并上传加密数据的系统属性信息，例如：使用数据所需积分；打包数据的数据摘要(也可以称为解密数据的数据摘要)，以避免数据贡献者篡改数据；加密数据的数据摘要；解密密钥的数据摘要等，本申请对此不作具体限定。数据贡献方可以指定只有经过特定联盟链成员审核的可信执行程序才能访问数据。
另一方面，业务代码开发者根据数据共享平台510规定的数据标准和示例数据，开发可编译的业务代码，并通过业务代码开发者客户端530将开发的业务代码提交给数据共享平台。
再一方面，针对特定的领域，数据共享平台510的数据标准模块511中预设有该领域的数据标准(例如元数据标准、加密数据标准等)，数据贡献者提供的数据均需符合该标准。其中，数据共享平台510是基于区块链技术创建的，可以提供成员身份认证、账本、智能合约等联盟链服务。
数据共享平台510的数据存储模块512中存储有数据贡献者客户端520上传的元数据、加密数据和系统属性信息(例如上文表1)。数据共享平台510可以提供加密数据的集中存储和下载功能，能够规避区块链网络的数据传输瓶颈，加快数据传输效率。
另外，数据共享平台510上建立有数据检索网站，可以方便数据贡献者提交的数据被数据使用者发现。数据使用者可以在数据检索网站中通过检索元数据选择所需的加密数据。
数据共享平台510中的身份认证&授权模块513可以提供身份认证&授权服务，联盟链参与者(例如，数据贡献者、数据使用者、业务代码开发者等)可以将身份认证信息提交到数据共享平台510，由数据共享平台510同步至各个节点/客户端。
数据共享平台510提供业务代码的检索和审核服务。即，数据共享平台可以邀请联盟链成员对业务代码的安全性进行审核和测试(对于有保密需求的代码，业务代码开发者可以指定联盟链成员进行审核)，确保其输出不会泄露输入的数据。业务代码经审核后，审核信息可以写入区块链账本里(例如，业务代码ID；参与审核的联盟链成员；以及业务代码开发者与代码审核者约定的数据使用者调用业务代码后，积分在业务代码开发者和代码审核者之间的分配机 制)。
数据共享平台510中的可信执行程序生成模块514可以生成二进制可信执行程序。具体地，数据使用者选择所需的业务代码后，可信执行程序提交数据使用者的身份认证信息(公钥)，可信执行程序生成模块514将数据使用者的身份认证信息、加密-解密程序、数据使用者选择的业务代码一起编译成可信执行程序并发送给数据使用者客户端540。其中，数据使用者在通过可信执行程序访问数据时，以可信执行程序中内置的身份认证信息作为数据使用者标记。
在本申请的另一个实施例中，数据共享平台510还可以为已生成的可信执行程序生成可信执行程序名单，本申请对此不作具体限定。
数据使用者在数据共享平台510提供的数据检索网站中选择所需的加密数据后，使用内置有用户身份认证的数据使用者客户端540下载该加密数据对应的数据列表，数据列表信息可以包含数据ID，数据贡献者，使用数据所需消耗的积分，加密数据MD5值，解密数据MD5值，解密密钥MD5值等，本申请对此不作具体限定。
数据使用者通过数据使用者客户端540选择数据共享平台510上的业务代码，并通过数据使用者客户端540上传个人身份认证信息，以使得数据共享平台510将数据使用者的身份认证信息、加密-解密程序、数据使用者选择的业务代码一起编译成可信执行程序，并发送给数据使用者客户端540。
数据使用者客户端540利用获取到的可信执行程序下载加密数据、对加密数据进行解密，以及对解密后的数据进行数据分析，输出数据分析结果。具体地，可信执行程序在数据使用者客户端540中的执行步骤为：
可信执行程序解析数据列表信息，根据数据列表信息中的数据ID下载加密数据，并根据数据列表信息中的加密数据MD5值校验数据完整性。
当校验失败时，可以重新从数据共享平台下载加密数据和数据列表信息。
当校验成功时，可信执行程序可以根据数据列表信息中的数据贡献者的信息，用公钥向数据贡献者客户端520中的数据加密/解密密钥管理模块523申请待分析加密数据的解密密钥；数据贡献者客户端520接收可信执行程序发送的公钥，并向数据共享平台510中的身份认证&授权模块513发送公钥验证信息；当验证成功时，数据贡献者客户端520是用公钥对解密密钥进行加密，并发送至可信执行程序(超级账本中底层的gRPC网络提供传输解密密钥的功能)；可信执行程序根据数据列表信息中的解密密钥MD5值校验解密密钥。
其中，校验信息可以写入区块链账本，内容可以为“接收的解密密钥MD5值，平台登记的MD5值”，应当理解，本申请对此不作具体限定。通过校验解密密钥，可以避免因数据贡献者提供错误的密钥导致数据不可用的问题；通过将校验信息写入区块链，可以保存密钥申请记录，该过程可以不涉及积分转移。
解密密钥校验成功后，可信执行程序用解密密钥对加密数据进行解密，获得解密数据；并根据解密数据MD5值校验解密数据，如果解密成功，则将积分转移信息写入区块链账本。账本结构可以为：
{
申请者公钥：
申请者申请数据列表的MD5值：
贡献者1获得积分数量：
贡献者2获得积分数量：
……
贡献者n获得积分数量：
时间戳：
}
另外，数据使用者客户端540可以将通过校验的数据列表信息发送回数据共享平台510，并附上身份认证和时间戳。数据共享平台510可以存储数据访问记录，并将数据访问记录的数据摘要写入区块链账本。
可信执行程序中的业务代码以解密后的数据作为输入进行数据分析，将数据分析结果作为输出提供给数据使用者。其中，业务代码调用信息可以写入区块链账本。可信执行程序可以通过调用智能合约转移数据使用者账户的积分至业务代码开发者账户。是否写入区块链账本由业务代码开发者在业务代码审核时决定，本申请对此不作具体限定。
需要说明的是，数据贡献者客户端520、业务代码开发者客户端530和数据使用者客户端540可以为App客户端，也可以是web客户端等，本申请对此不作具体限定。数据贡献者、数据使用者也可以是业务代码开发者；数据贡献者客户端520和数据使用者客户端540也可以是业务代码开发者客户端530，本申请对此不作具体限定。
根据本申请实施例提供的技术方案，通过数据共享平台提供数据的集中安全存储和下载功能，避免了区块链网络不适合大数据存储和传输的问题；通过数据共享平台提供标准化元数据检索功能，便于数据使用者查找所需要的数据；通过利用数据贡献者客户端进行本地化加密并保存密钥的方式，能够保证数据的安全性；通过可信执行程序进行数据摘要校验可以确保待使用数据的准确性。通过生成二进制可信执行程序，可以实现数据共享过程中不泄露数据或被反向破解；通过区块链技术可以实现数据共享过程的透明性及智能共享与激励。本申请实施例将可信执行程序与联盟链有机整合在一起，简化了数据共享过程中的人为操作，提高了共享安全性与便捷性，提高了用户使用体验。
图6所示为本申请另一实施例提供的数据共享方法的流程示意图。如图6所示，该方法包括如下内容。
S610：数据共享平台接收数据使用者的身份认证信息。
S620：基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，以便于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
根据本申请实施例提供的技术方案，通过生成可信执行程序，以利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，无需在数据分析的过程中与数据贡献者通信频繁，即可直接获得待分析加密数据的数据分析结果，能够提高数据分析效率。另外，可信执行程序内置有数据使用者的身份认证信息，可以确保只有经过授权的用户才能够通过可信执行程序与数据进行交互；而且，可信执行程序的执行过程对数据使用者不可见，可以保证在交互过程中不会将数据泄露给用户，从而能够保证共享数据的安全性。
在本申请的另一个实施例中，上述数据共享方法还包括：数据共享平台确定数据使用者选择的业务代码，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码；其中，上述基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，包括：数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译，生成可信执行程序。
在本申请的另一个实施例中，上述数据共享方法还包括：数据共享平台接收数据贡献者客户端发送的满足数据共享平台中预设数据标准的元数据和加密数据，其中，元数据包括加密数据的描述信息，以便于数据使用者基于元数据进行检索，并根据检索结果选择待分析加密数据。
上述所有可选技术方案，可以采用任意结合形成本申请的可选实施例，在此不再一一赘述。
示例性装置
下述为本申请装置实施例，可以用于执行本申请方法实施例。对于本申请装置实施例中未披露的细节，请参照本申请方法实施例。
图7所示为本申请一实施例提供的数据共享装置的框图。如图7所示，该数据共享装置700包括：
获取模块710，用于获取数据使用者选择的数据共享平台中的待分析加密数据。
分析模块720，用于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
根据本申请实施例提供的技术方案，通过利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，无需在数据分析的过程中与数据贡献者通信频繁，即可直接获得待分析加密数据的数据分析结果，能够提高数据分析效率。另外，可信执行程序内置有数据使用者的身份认证信息，可以确保只有经过授权的用户才能够通过可信执行程序与数据进行交互；而且，可信执行程序的执行过程对数据使用者不可见，可以保证在交互过程中不会将数据泄露给用户，从而能够保证共享数据的安全性。
在本申请的另一个实施例中，上述可信执行程序是通过数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译后生成的，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码。
在本申请的另一个实施例中，上述待分析加密数据是基于数据共享平台中存储的满足预设 数据标准的元数据检索得到的，其中，元数据包括加密数据的描述信息。
在本申请的另一个实施例中，获取模块710用于获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据ID信息；根据待分析加密数据的数据ID信息，利用可信执行程序获取待分析加密数据。
在本申请的另一个实施例中，获取模块710用于获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括关于待分析加密数据的数据摘要信息；上述数据共享装置还包括校验模块730，用于根据关于待分析加密数据的数据摘要信息，利用可信执行程序进行数据摘要校验。
在本申请的另一个实施例中，获取模块710用于获取数据共享平台中与待分析加密数据对应的数据列表信息，其中，数据列表信息包括待分析加密数据的数据贡献者的信息；上述数据共享装置还包括申请模块740，用于根据数据贡献者的信息，利用可信执行程序向数据贡献者客户端申请待分析加密数据的解密密钥；接收模块，用于接收数据贡献者客户端返回的解密密钥；其中，分析模块用于根据数据贡献者客户端返回的解密密钥对待分析加密数据进行解密，并对解密后的数据进行数据分析。
在本申请的另一个实施例中，上述数据共享装置还包括调用模块750，用于利用可信执行程序调用智能合约，以实现积分转移和账本更新。
图8所示为本申请另一实施例提供的数据共享装置的框图。如图8所示，该数据共享装置800包括：
接收模块810，用于数据共享平台接收数据使用者的身份认证信息。
生成模块820，用于基于数据使用者的身份认证信息，数据共享平台生成可信执行程序，以便于利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得待分析加密数据的数据分析结果，其中，可信执行程序内置有数据使用者的身份认证信息，且可信执行程序的执行过程对数据使用者不可见。
根据本申请实施例提供的技术方案，通过生成可信执行程序，以利用可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，无需在数据分析的过程中与数据贡献者通信频繁，即可直接获得待分析加密数据的数据分析结果，能够提高数据分析效率。另外，可信执行程序内置有数据使用者的身份认证信息，可以确保只有经过授权的用户才能够通过可信执行程序与数据进行交互；而且，可信执行程序的执行过程对数据使用者不可见，可以保证在交互过程中不会将数据泄露给用户，从而能够保证共享数据的安全性。
在本申请的另一个实施例中，上述数据共享装置还包括确定模块830，用于数据共享平台确定数据使用者选择的业务代码，其中，数据共享平台中存储有可供数据使用者选择的多种业务代码，多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码；其中，生成模块820用于数据共享平台对数据使用者的身份认证信息、数据使用者选择的业务代码和加密-解密功能进行编译，生成可信执行程序。
在本申请的另一个实施例中，接收模块810用于数据共享平台接收数据贡献者客户端发送 的满足数据共享平台中预设数据标准的元数据和加密数据，其中，元数据包括加密数据的描述信息，以便于数据使用者基于元数据进行检索，并根据检索结果选择待分析加密数据。
上述装置中各个模块的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
示例性电子设备
图9所示为本申请一实施例提供的电子设备900的框图。
参照图9，电子设备900包括处理组件910，其进一步包括一个或多个处理器，以及由存储器920所代表的存储器资源，用于存储可由处理组件910的执行的指令，例如应用程序。存储器920中存储的应用程序可以包括一个或一个以上的每一个对应于一组指令的模块。此外，处理组件910被配置为执行指令，以执行上述数据共享方法。
电子设备900还可以包括一个电源组件被配置为执行电子设备900的电源管理，一个有线或无线网络接口被配置为将电子设备900连接到网络，和一个输入输出(I/O)接口。电子设备900可以操作基于存储在存储器920的操作系统，例如Windows Server TM，Mac OS X TM，Unix TM，Linux TM，FreeBSD TM或类似。
一种非临时性计算机可读存储介质，当存储介质中的指令由上述电子设备900的处理器执行时，使得上述电子设备900能够执行上述数据共享方法。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做 出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序校验码的介质。
另外，还需要说明的是，本案中各技术特征的组合方式并不限本案权利要求中所记载的组合方式或是具体实施例所记载的组合方式，本案所记载的所有技术特征可以以任何方式进行自由组合或结合，除非相互之间产生矛盾。
需要注意的是，以上列举的仅为本申请的具体实施例，显然本申请不限于以上实施例，随之有着许多的类似变化。本领域的技术人员如果从本申请公开的内容直接导出或联想到的所有变形，均应属于本申请的保护范围。
应当理解，本申请实施例中提到的第一、第二等限定词，仅仅为了更清楚地描述本申请实施例的技术方案使用，并不能用以限制本申请的保护范围。
以上仅为本申请的较佳实施例而已，并非用于限定本申请的保护范围。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (14)

  1. 一种数据共享方法，其特征在于，包括：
    获取数据使用者选择的数据共享平台中的待分析加密数据；
    利用可信执行程序对所述待分析加密数据进行解密并对解密后的数据进行数据分析，获得所述待分析加密数据的数据分析结果，其中，所述可信执行程序内置有所述数据使用者的身份认证信息，且所述可信执行程序的执行过程对所述数据使用者不可见。
  2. 根据权利要求1所述的方法，其特征在于，所述可信执行程序是通过所述数据共享平台对所述数据使用者的身份认证信息、所述数据使用者选择的业务代码和加密-解密功能进行编译后生成的，其中，所述数据共享平台中存储有可供所述数据使用者选择的多种业务代码，所述多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码。
  3. 根据权利要求1或2所述的方法，其特征在于，所述待分析加密数据是基于所述数据共享平台中存储的满足预设数据标准的元数据检索得到的，其中，所述元数据包括加密数据的描述信息。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，还包括：
    获取所述数据共享平台中与所述待分析加密数据对应的数据列表信息，其中，所述数据列表信息包括所述待分析加密数据的数据ID信息；
    其中，所述获取数据使用者选择的数据共享平台中的待分析加密数据，包括：
    根据所述待分析加密数据的数据ID信息，利用所述可信执行程序获取所述待分析加密数据。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，还包括：
    获取所述数据共享平台中与所述待分析加密数据对应的数据列表信息，其中，所述数据列表信息包括关于所述待分析加密数据的数据摘要信息；
    根据关于所述待分析加密数据的数据摘要信息，利用所述可信执行程序进行数据摘要校验。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，还包括：
    获取所述数据共享平台中与所述待分析加密数据对应的数据列表信息，其中，所述数据列表信息包括所述待分析加密数据的数据贡献者的信息；
    根据所述数据贡献者的信息，利用所述可信执行程序向数据贡献者客户端申请所述待分析加密数据的解密密钥；
    接收所述数据贡献者客户端返回的所述解密密钥；
    其中，所述利用可信执行程序对所述待分析加密数据进行解密并对解密后的数据进行数据分析，包括：
    根据所述数据贡献者客户端返回的所述解密密钥对所述待分析加密数据进行解密，并对解密后的数据进行数据分析。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，还包括：
    利用所述可信执行程序调用智能合约，以实现积分转移和账本更新。
  8. 一种数据共享方法，其特征在于，包括：
    数据共享平台接收数据使用者的身份认证信息；
    基于所述数据使用者的身份认证信息，所述数据共享平台生成可信执行程序，以便于利用所述可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得所述待分析加密数据的数据分析结果，其中，所述可信执行程序内置有所述数据使用者的身份认证信息，且所述可信执行程序的执行过程对所述数据使用者不可见。
  9. 根据权利要求8所述的方法，其特征在于，还包括：
    所述数据共享平台确定所述数据使用者选择的业务代码，其中，所述数据共享平台中存储有可供所述数据使用者选择的多种业务代码，所述多种业务代码中的每种业务代码为经过联盟链成员审核的用于分析数据的代码；
    其中，所述基于所述数据使用者的身份认证信息，所述数据共享平台生成可信执行程序，包括：
    所述数据共享平台对所述数据使用者的身份认证信息、所述数据使用者选择的业务代码和加密-解密功能进行编译，生成所述可信执行程序。
  10. 根据权利要求8或9所述的方法，其特征在于，还包括：
    所述数据共享平台接收数据贡献者客户端发送的满足所述数据共享平台中预设数据标准的元数据和加密数据，其中，所述元数据包括所述加密数据的描述信息，以便于所述数据使用者基于所述元数据进行检索，并根据检索结果选择所述待分析加密数据。
  11. 一种数据共享装置，其特征在于，包括：
    获取模块，用于获取数据使用者选择的数据共享平台中的待分析加密数据；
    分析模块，用于利用可信执行程序对所述待分析加密数据进行解密并对解密后的数据进行数据分析，获得所述待分析加密数据的数据分析结果，其中，所述可信执行程序内置有所述数据使用者的身份认证信息，且所述可信执行程序的执行过程对所述数据使用者不可见。
  12. 一种数据共享装置，其特征在于，包括：
    接收模块，用于数据共享平台接收数据使用者的身份认证信息；
    生成模块，用于基于所述数据使用者的身份认证信息，所述数据共享平台生成可信执行程序，以便于利用所述可信执行程序对待分析加密数据进行解密并对解密后的数据进行数据分析，获得所述待分析加密数据的数据分析结果，其中，所述可信执行程序内置有所述数据使用者的身份认证信息，且所述可信执行程序的执行过程对所述数据使用者不可见。
  13. 一种计算机可读存储介质，其上存储有计算机可执行指令，其特征在于，所述可执行指令被处理器执行时实现如权利要求1至10中任一项所述的数据共享方法。
  14. 一种电子设备，其特征在于，所述电子设备包括：
    处理器；
    用于存储所述处理器可执行指令的存储器；
    所述处理器，用于执行上述权利要求1至10中任一项所述的数据共享方法。
PCT/CN2021/137473 2021-01-18 2021-12-13 数据共享方法及装置 WO2022151888A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/202,462 US20230308290A1 (en) 2021-01-18 2023-05-26 Data sharing method and electronic device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110063362.5A CN112783847B (zh) 2021-01-18 2021-01-18 数据共享方法及装置
CN202110063362.5 2021-01-18

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/202,462 Continuation US20230308290A1 (en) 2021-01-18 2023-05-26 Data sharing method and electronic device

Publications (1)

Publication Number Publication Date
WO2022151888A1 true WO2022151888A1 (zh) 2022-07-21

Family

ID=75757177

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/137473 WO2022151888A1 (zh) 2021-01-18 2021-12-13 数据共享方法及装置

Country Status (3)

Country Link
US (1) US20230308290A1 (zh)
CN (1) CN112783847B (zh)
WO (1) WO2022151888A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112783847B (zh) * 2021-01-18 2022-08-12 中国农业科学院深圳农业基因组研究所 数据共享方法及装置
CN114422215B (zh) * 2021-12-31 2024-06-25 国网安徽省电力有限公司合肥供电公司 一种基于区块链的跨平台和可信能源数据共享系统及方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110519049A (zh) * 2019-08-07 2019-11-29 赤峰学院 一种基于可信执行环境的云端数据保护系统
CN110796267A (zh) * 2019-11-12 2020-02-14 支付宝(杭州)信息技术有限公司 数据共享的机器学习方法和机器学习装置
WO2020119294A1 (zh) * 2018-12-14 2020-06-18 阿里巴巴集团控股有限公司 数据共享方法、装置及系统、电子设备
CN111327643A (zh) * 2020-05-15 2020-06-23 支付宝(杭州)信息技术有限公司 一种多方数据共享方法和装置
US20200210585A1 (en) * 2018-12-31 2020-07-02 Microsoft Technology Licensing, Llc Trusted execution broker
CN112783847A (zh) * 2021-01-18 2021-05-11 中国农业科学院深圳农业基因组研究所 数据共享方法及装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109460373B (zh) * 2017-09-06 2022-08-26 阿里巴巴集团控股有限公司 一种数据共享方法、终端设备和存储介质
US11196569B2 (en) * 2018-09-12 2021-12-07 Bitclave Pte. Ltd. Systems and methods for accuracy and attestation of validity of data shared in a secure distributed environment
CN109858228A (zh) * 2019-01-31 2019-06-07 上海计算机软件技术开发中心 基于区块链的数据共享服务平台及方法
CN111416704B (zh) * 2020-03-17 2022-10-18 中国建设银行股份有限公司 基于区块链的数据处理方法、装置及系统
CN111625869B (zh) * 2020-04-23 2022-02-25 腾讯科技（深圳）有限公司 数据处理方法及数据处理装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2020119294A1 (zh) * 2018-12-14 2020-06-18 阿里巴巴集团控股有限公司 数据共享方法、装置及系统、电子设备
US20200210585A1 (en) * 2018-12-31 2020-07-02 Microsoft Technology Licensing, Llc Trusted execution broker
CN110519049A (zh) * 2019-08-07 2019-11-29 赤峰学院 一种基于可信执行环境的云端数据保护系统
CN110796267A (zh) * 2019-11-12 2020-02-14 支付宝(杭州)信息技术有限公司 数据共享的机器学习方法和机器学习装置
CN111327643A (zh) * 2020-05-15 2020-06-23 支付宝(杭州)信息技术有限公司 一种多方数据共享方法和装置
CN112783847A (zh) * 2021-01-18 2021-05-11 中国农业科学院深圳农业基因组研究所 数据共享方法及装置

Also Published As

Publication number Publication date
CN112783847B (zh) 2022-08-12
US20230308290A1 (en) 2023-09-28
CN112783847A (zh) 2021-05-11

Similar Documents

Publication Publication Date Title
US11159315B2 (en) Generating or managing linked decentralized identifiers
CN113711536B (zh) 从区块链网络中提取数据
CN109643285B (zh) 加密的用户数据传输及储存
US8539231B1 (en) Encryption key management
US11765225B2 (en) Systems and methods for microservice execution load balancing in virtual distributed ledger networks
US11917088B2 (en) Integrating device identity into a permissioning framework of a blockchain
Carter et al. Blockchain-based interoperable electronic health record sharing framework
WO2022151888A1 (zh) 数据共享方法及装置
EP3942734B1 (en) Systems and methods for virtual distributed ledger networks
US8848922B1 (en) Distributed encryption key management
US20200351077A1 (en) Systems and methods for control-data plane partitioning in virtual distributed ledger networks
US20190386968A1 (en) Method to securely broker trusted distributed task contracts
US11575499B2 (en) Self auditing blockchain
US11763298B2 (en) Systems and methods for hybrid synchronization in virtual distributed ledger networks
CN113609531B (zh) 基于区块链的信息交互方法、装置、设备、介质和产品
US11997218B2 (en) Decentralized, dynamic media key block for broadcast encryption
CN111125734B (zh) 一种数据处理方法及系统
US12032663B2 (en) Cross-session issuance of verifiable credential
CN114866337B (zh) 共享数据审计方法及其装置、设备、存储介质和程序产品
US20220398299A1 (en) Cross-session issuance of verifiable credential
WO2023159900A1 (zh) 远程开发的方法及装置
CN116560641A (zh) 接口自动生成方法、装置、设备及存储介质
Zhou et al. A blockchain‐based and microservices‐architected software composition analysis system

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21919078

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21919078

Country of ref document: EP

Kind code of ref document: A1