WO2023029655A1 - 数据共享方法、网络侧设备、系统、电子设备和存储介质 - Google Patents

数据共享方法、网络侧设备、系统、电子设备和存储介质 Download PDF

Info

Publication number
WO2023029655A1
WO2023029655A1 PCT/CN2022/098771 CN2022098771W WO2023029655A1 WO 2023029655 A1 WO2023029655 A1 WO 2023029655A1 CN 2022098771 W CN2022098771 W CN 2022098771W WO 2023029655 A1 WO2023029655 A1 WO 2023029655A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
sandbox
side device
network side
access
Prior art date
Application number
PCT/CN2022/098771
Other languages
English (en)
French (fr)
Inventor
曾鸣
王德政
郭海生
屠要峰
高洪
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to KR1020247008097A priority Critical patent/KR20240047413A/ko
Publication of WO2023029655A1 publication Critical patent/WO2023029655A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/27—Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine

Definitions

  • the present application relates to the field of data security, in particular to a data sharing method, network side equipment, system, electronic equipment and storage medium.
  • Blockchain is a database technology shared by multiple parties.
  • the core of its technology is block data chain storage and smart contracts, and it can only be read and written, and cannot be modified or deleted.
  • Using blockchain technology for data sharing can not only ensure the credibility and traceability of transactions, but also improve transaction efficiency.
  • the embodiment of the present application provides a data sharing method, which is applied to the first network-side device, including: creating a sandbox for the data provider, and synchronizing the information of the sandbox to the second network-side device; wherein, the sandbox and The original database is bound, and the information of the sandbox includes the metadata of the original database; the request for accessing the sandbox initiated by the requesting party receiving the data forwarded by the second network side device; wherein, the request for accessing the sandbox carries the metadata of the requested data; The raw data that is queried based on the metadata of the requested data is collected in the raw database bound to the sandbox; based on the collected raw data, the response data to access the sandbox request is generated, and the data requesting party is notified through the second network side device to obtain the data from the sandbox. Get the response data in.
  • the embodiment of the present application provides a data sharing method, which is applied to the second network side device, including: receiving the information of the sandbox synchronized by the first network side device, and providing the information of the sandbox for the data applicant to query; The sandbox access request submitted by the applicant is forwarded to the first network-side device; after receiving the response data generation notification from the first network-side device, the data requester is notified to obtain the response data from the sandbox.
  • the embodiment of the present application also provides a network-side device, including: a creating module for creating a sandbox for the data provider, and synchronizing the information of the created sandbox to the second network-side device; wherein, the sandbox and The original database is bound, and the sandbox information includes the metadata of the original database; the receiving module is used to receive the access sandbox request initiated by the data applicant forwarded by the second network side device; wherein, the access sandbox request carries the metadata of the requested data Data; the acquisition module is used to collect the original data queried based on the metadata of the requested data in the original database bound to the sandbox; the generation module is used to generate the response data for accessing the sandbox request according to the collected original data , and notify the data requesting party to obtain the response data from the sandbox through the second network side device.
  • a creating module for creating a sandbox for the data provider, and synchronizing the information of the created sandbox to the second network
  • the embodiment of the present application also provides a network-side device, including: a receiving module, configured to receive sandbox information synchronized by the first network-side device, and provide sandbox information for the data applicant to query; a forwarding module, used to For forwarding the access sandbox request submitted by the data requesting party to the first network side device; the notification module is configured to notify the data requesting party to obtain the response data from the sandbox after receiving the response data generation notification from the first network side device .
  • a network-side device including: a receiving module, configured to receive sandbox information synchronized by the first network-side device, and provide sandbox information for the data applicant to query; a forwarding module, used to For forwarding the access sandbox request submitted by the data requesting party to the first network side device; the notification module is configured to notify the data requesting party to obtain the response data from the sandbox after receiving the response data generation notification from the first network side device .
  • Embodiments of the present application also provide a data sharing system, including: a first network-side device and a second network-side device capable of implementing the above data sharing method.
  • the embodiment of the present application also provides an electronic device, including: at least one processor; and a memory connected to the at least one processor in communication; wherein, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by at least one processor. Executed by a processor, so that at least one processor can execute the above data sharing method.
  • Embodiments of the present application also provide a computer-readable storage medium storing a computer program, and the computer program implements the above-mentioned data sharing method when executed by a processor.
  • FIG. 1 is a flow chart of a data sharing method applied to a first network side device according to an embodiment of the present application
  • FIG. 2 is an interactive diagram of a sandbox creation process involved in an embodiment of the present application
  • FIG. 3 is an interactive diagram 1 of the data sharing process involved in an embodiment of the present application.
  • FIG. 4 is an interactive diagram 2 of the data sharing process involved in an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of a security sandbox system involved in an embodiment of the present application.
  • FIG. 6 is a flowchart of a data sharing method applied to a second network side device according to an embodiment of the present application
  • FIG. 7 is a schematic structural diagram of a first network-side device according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a second network-side device according to an embodiment of the present application.
  • Fig. 9 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
  • An embodiment of the present application relates to a data sharing method, which is applied to a first network-side device, and the specific process is shown in FIG. 1 .
  • the first network-side device creates a sandbox for the data provider, and synchronizes the information of the created sandbox to the second network-side device; wherein, the sandbox is bound to the original database, and the sandbox information includes Metadata of the original database; receive the sandbox access request initiated by the data applicant forwarded by the second network side device; wherein, the access sandbox request carries the metadata of the requested data; collect the request based on the original database bound to the sandbox The original data queried by the metadata of the data; according to the queried original data, response data is generated for the data applicant to obtain through the second network side device.
  • the purpose of this embodiment is to provide a data sharing method, which is used to protect the privacy information of the data and ensure the security of the data sharing process.
  • Step 101 creating a sandbox for the data provider.
  • the data provider provides data for sharing.
  • the first network side device creates a sandbox for the data provider as a safe and reliable environment for the data provider to store and process data.
  • the process of the first network side device creating a sandbox for the data provider is shown in FIG. 2 .
  • the first network-side device sets the service type of the sandbox according to the requirements of the data provider.
  • the data provider binds the original database to the sandbox, and configures the address, account, and password to access the original database.
  • the data provider can further configure desensitization rules for the sandbox, which can be partially desensitized or fully desensitized.
  • the first network side device determines the service type provided by the sandbox according to the sandbox creation request of the data provider; wherein, the service type includes: shared exchange, trusted computing; and the sandbox is created according to the selected service type.
  • sandboxes that provide shared exchange services can provide desensitized, encrypted, and other processed data for data applicants to obtain, while trusted computing sandboxes can provide data
  • the calculation results of the provider's data can be obtained by the data requester.
  • the first network-side device applies for an independent storage space for the created sandbox, and mounts it to a path with the name of the sandbox as an intermediate directory for storing shared data.
  • Step 102 synchronizing sandbox information to the second network side device.
  • the sandbox information is synchronized to the second network-side device, so that the second network-side device can provide the data requester with information about the sandbox.
  • the first network-side device after the first network-side device synchronizes the created sandbox to the second network-side device, it uploads the process of publishing and synchronizing the sandbox to the blockchain storage certificate, and the information uploaded to the blockchain includes: The ID of the sandbox, the ID of the data provider, the metadata of the original database, etc. Upload the sandbox release process to the blockchain to ensure the traceability of the sandbox release process.
  • the blockchain involved in this embodiment can be a common blockchain such as Hyperledger Fabric.
  • the process of storing certificates on the chain depends on smart contracts.
  • Step 103 receiving a sandbox access request initiated by the data applicant forwarded by the second network side device. If the data requester sends a sandbox access request to the second network side device, the second network side device forwards the access sandbox request to the first network side device. In this step, the first network-side device receives the sandbox access request initiated by the data applicant forwarded by the second network-side device; wherein the sandbox access request carries metadata of the requested data.
  • the data applicant queries the sandbox information provided by the data provider at the second network side device, which includes metadata of the data provided by the data provider, and then sends a sandbox access request.
  • the access sandbox request is forwarded by the second network side device to the first network side device, and the first network side device receives the access sandbox request forwarded by the second network side device, and the access sandbox request carries the metadata of the data requested by the data applicant .
  • the first network side device after receiving the sandbox access request initiated by the data applicant forwarded by the second network side device, the first network side device generates an approval form according to the sandbox access request initiated by the data applicant, and notifies the data provider Approve requests for access to the sandbox. Notifying the data provider for approval can ensure that the shared data can only be queried by the data applicants allowed by the data provider, avoiding the disclosure of private data to all users.
  • Step 104 collect the queried original data in the original database bound to the sandbox.
  • the first network-side device after receiving the access sandbox request initiated by the data applicant forwarded by the second network-side device, in this step, the first network-side device according to the metadata of the requested data carried in the access sandbox request, and Query the original data in the original database bound to the sandbox, and collect the original data queried based on the metadata of the requested data.
  • Step 105 generate response data, and notify the data requesting party to obtain it from the sandbox through the second network side device.
  • the first network-side device generates response data to access the sandbox request based on the original data collected in the previous step, and simultaneously stores the generated response data in the sandbox, and sends the response data to the second network-side device
  • the response data generates a notification, and then the second network side device notifies the data requester to obtain the response data from the sandbox.
  • the data applicant requests access to a shared exchange sandbox, that is, the service type provided by the sandbox is shared exchange, then the first network-side device, according to the desensitization rules configured by the data provider for the sandbox, Desensitize the received original data, and then encrypt the desensitized data with the public key of the data applicant, that is, the generation of response data is completed.
  • the process of the data applicant requesting access to the shared exchange sandbox and finally obtaining the response data is shown in Figure 3.
  • the data applicant requests access to a trusted computing sandbox, that is, the type of service provided by the sandbox is trusted computing, and accordingly the access sandbox request initiated by the data applicant is to obtain the The result of calculations on some or all of the data.
  • the first network-side device encrypts the collected raw data, pushes the encrypted data to a trusted computing environment for trusted computing, and then encrypts the computing results with the public key of the data applicant, namely Generation of response data (calculation results) is completed.
  • the process of the data applicant requesting access to the trusted computing sandbox and finally obtaining the response data (calculation results) is shown in Figure 4.
  • the encryption processing of the generated response data uses the public key of the data applicant, and the requested data can only be decrypted and finally obtained by the data applicant with the private key, which can ensure that the data can only be obtained by the data applicant permitted by the data provider Obtaining, further avoiding data leakage.
  • the first network side device after the first network side device generates the response data, it uploads the information in the data sharing process to the blockchain deposit certificate.
  • the information uploaded to the blockchain includes: data applicant identity, sandbox identity, data provider identity, response data information, data provider signature, etc. Upload to the blockchain to store evidence and ensure the traceability of the data sharing process.
  • the information of the response data here can be the hash value of the shared data, or the result of data calculation.
  • the trusted computing environment involved in this embodiment provides trusted computing services, and is aimed at the scenario where a data applicant requests access to a trusted computing sandbox.
  • a secure channel is established between the trusted computing environment and the first network-side device.
  • the first network-side device encrypts the private data with the public key of the trusted computing environment and puts it into the trusted computing environment through the secure channel for calculation.
  • the calculation result is used
  • the data requester's public key is encrypted and returned.
  • the first network-side device in this embodiment faces the data provider and is deployed in an institution's computer room or in a remote network.
  • the first network-side device can serve as a sandbox agent module of the security sandbox system, which specifically includes access layer, communication layer, sandbox management module, data collection module, data desensitization module, data element management module and privacy computing module.
  • the access layer is used to provide data providers with human-computer interaction functions for sandbox management and maintenance, which can be specifically command line or user interface (User Interface, referred to as "UI interface").
  • the communication layer is used to communicate with the second network side device through the Google Remote Procedure Call Protocol (Google Remote Procedure Call Protocol, "GRPC protocol") interface, including publishing upstream messages such as sandboxes.
  • the sandbox management module is responsible for the creation, management and maintenance of the sandbox, and relies on the underlying privacy calculation module, data desensitization module, data collection module, and data element management module to provide functional support.
  • the data collection module is responsible for the collection of raw data.
  • the data desensitization module is used to desensitize the collected data fields according to the configured desensitization rules.
  • the data element management module is responsible for obtaining the metadata information of the shared data from the original database during the binding process of the original database, and storing and maintaining the shared attributes and desensitization rules of the shared fields.
  • the privacy computing module establishes a secure channel with the trusted computing environment, and is responsible for putting the private data into the trusted computing environment for trusted computing according to the computing requirements applied by the user, and encrypting the computing results and returning them to the applicant.
  • the second network-side device in this embodiment is oriented to the data applicant, and can be deployed in the computer room of the data provider or in a remote network.
  • the first network-side device and the second network-side device may also be deployed in the same server in the central computer room or cloud environment.
  • the second network side device can function as a sandbox service module of the security sandbox system, specifically including an access layer, a communication layer, a sandbox browsing module, a shared exchange module, a trusted computing module, and a data element information module.
  • the access layer is used to provide the human-computer interaction function of sandbox access for the data requesting party, specifically, it may be a command line mode or a UI interface mode.
  • the communication layer is used to communicate with the sandbox agent module through the GRPC protocol interface, including downlink messages such as querying the sandbox, sharing applications, computing applications, and obtaining results.
  • the sandbox browsing module is used to provide sandbox access, application and information query functions for data applicants, relying on the underlying shared exchange module, trusted computing module and data element information module to provide functional support.
  • the shared exchange module is used for the shared exchange sandbox, and provides the access application and shared file download function of the shared exchange sandbox for the sandbox browsing module.
  • the trusted computing module is used in the trusted computing sandbox and involves user privacy data.
  • the trusted computing module provides the sandbox browsing module with the computing task application and Result fetch function.
  • the data metadata information module is used to obtain the metadata of the sandbox from the first network side device, and provide the metadata of the sandbox to the sandbox browsing module.
  • the blockchain, the first network-side device (sandbox agent module), the second network-side device (sandbox service module), trusted computing environment, smart contract and service interface involved in this embodiment form a security sandbox system .
  • the security sandbox system adopts a distributed architecture, which can be deployed on physical nodes or in the form of tenants in the cloud environment.
  • the connection structure of each part in the security sandbox system is shown in Figure 5.
  • the sandbox proxy module only communicates with the sandbox service module, and the sandbox proxy modules do not communicate with each other and are isolated from each other. After the sandbox proxy module starts, it registers with the sandbox service module.
  • the blockchain environment and the trusted computing environment are deployed first. Furthermore, place the certificate in the cert certificate directory, place the smart contract to be installed under the corresponding language directory under the contracts directory; modify the config/config.yaml configuration file, set the docking blockchain platform type, and replace the local storage DB address; Modify the config/config.yaml configuration file to complete the relevant configuration of the local blockchain platform.
  • the fabric configuration platform includes the organization name, peer and orderer address and certificate configuration; execute the service init command to start the sandbox service program; install and deploy the sandbox smart contract.
  • the first network side device (sandbox agent module) is deployed.
  • Deploy the agent program to the organization's server environment, place the certificate in the cert certificate directory, and place the smart contract to be installed under the corresponding language directory under the contracts directory; modify the config/config.yaml configuration file and set the docking blockchain Platform type, replace the local storage DB address; modify the config/config.yaml configuration file to complete the configuration of the local docking blockchain platform, the fabric platform includes organization name, peer and orderer address and certificate configuration; execute agent--service ip: port/ ⁇ sandbox service id> command to start the sandbox agent; install and deploy the sandbox smart contract.
  • the first network-side device creates a sandbox for the data provider as a safe and trusted environment for storing and processing data.
  • the first network-side device only collects the metadata of the data provider without obtaining the original data, which can avoid the leakage of private information caused by the disclosure of the original data.
  • the request data generated according to the request of the data applicant is obtained by the data applicant through the second network side device, which can further ensure that the data will not be leaked and ensure the security of the data sharing process compared with the sharing method of public data for all users reliable.
  • Another embodiment of the present application relates to a data sharing method, which is applied to a second network side device.
  • the second network-side device provides sandbox information for the data applicant to query, forwards the sandbox access request submitted by the data applicant to the first network-side device, and finally notifies the data applicant to obtain data.
  • the specific process is shown in Figure 6, at least including but not limited to the following steps:
  • Step 601 Receive information about the sandbox synchronized by the first network side device, and provide the information about the sandbox for the data applicant to query.
  • the data provider provides data for sharing
  • the first network-side device creates a sandbox for the data provider, publishes the sandbox, and then synchronizes the information of the sandbox to the second network-side device.
  • the second network-side device receives the information of the sandbox synchronized by the first network-side device, and provides the information of the sandbox for the data applicant to query.
  • the access sandbox request sent by the data applicant can be oriented to the shared exchange sandbox or to the trusted computing sandbox.
  • the data applicant may request to obtain part or all of the data or the calculation results of the data.
  • Step 602 Receive the sandbox access request submitted by the data applicant, and forward it to the first network side device.
  • the data applicant queries the information of the sandbox through the second network side device and sends an access sandbox request.
  • the second network side device receives the sandbox access request submitted by the data applicant, and then further forwards it to the first network side device.
  • Step 603 receiving a notification of generation of response data by the first network side device and notifying the data requesting party to obtain the response data.
  • the second network-side device forwards the access sandbox request submitted by the data applicant to the first network-side device, and the first network-side device processes the data according to the access sandbox request submitted by the data applicant.
  • the second network-side device receives the notification that the first network-side device generates the response data, and notifies the data requester to obtain the response data.
  • the second network-side device can provide sandbox information for the data applicant to query, so that the data applicant initiates a sandbox access request to obtain response data according to requirements.
  • the second network side device can also receive the sandbox access request submitted by the data applicant and forward it to the first network side device, so as to realize the submission of the sandbox access request by the data applicant. Notify the data applicant who submitted the access sandbox request to obtain the response data, so that the data applicant can obtain the requested data, which can prevent the data from being disclosed to all users and ensure that private data is not leaked.
  • An implementation manner of the present application relates to a network side device, as shown in FIG. 7 , including:
  • Creating module 701 configured to create a sandbox for the data provider, and synchronize information of the created sandbox to the second network side device; wherein, the sandbox is bound to the original database, and the information of the sandbox includes metadata of the original database ;
  • the receiving module 702 is configured to receive an access sandbox request initiated by the data applicant forwarded by the second network side device; wherein, the access sandbox request carries metadata of the requested data;
  • the collection module 703 is used to collect the original data queried based on the metadata of the requested data in the original database bound to the sandbox;
  • the generating module 704 is configured to generate response data for accessing the sandbox request according to the collected raw data, and notify the data requesting party to obtain the response data from the sandbox through the second network side device.
  • the creation module 701 can also be used to determine the service type provided by the sandbox according to the sandbox creation request of the data provider; wherein, the service type includes: shared exchange, trusted computing.
  • the generation module 704 can also be used to desensitize the original data collected by the collection module 703 when the service type provided by the sandbox is shared exchange, and desensitize the data after desensitization Perform encryption processing, and use the encrypted data as the response data to access the sandbox request.
  • the generation module 704 can also be used to encrypt the raw data collected by the collection module 703 when the service type provided by the sandbox is trusted computing, and push the encrypted raw data to Perform calculations in a trusted computing environment, and encrypt the calculation results, and use the encrypted calculation results as the response data to access the sandbox request.
  • the first network-side device may further include: an approval module (not shown in the figure), configured to, after receiving the access sandbox request initiated by the data requesting party forwarded by the second network-side device, The initiated access sandbox request generates an approval ticket, and notifies the data provider to approve the access sandbox request.
  • an approval module (not shown in the figure), configured to, after receiving the access sandbox request initiated by the data requesting party forwarded by the second network-side device, The initiated access sandbox request generates an approval ticket, and notifies the data provider to approve the access sandbox request.
  • the first network-side device may further include: an uplink module (not shown in the figure), configured to upload the creation information of the sandbox to the second network-side device after synchronizing the created sandbox information to the second network-side device.
  • uploaded to the blockchain wherein, the creation information includes one or any combination of the following: the identity of the sandbox, the identity of the data provider, and the metadata of the original database; after generating the response data to access the sandbox request, the response data will be
  • the generation information of the data is uploaded to the blockchain; the generation information includes one or any combination of the following: the identity of the sandbox, the identity of the data applicant, the identity of the data provider, the information of the response data, the data provider signature.
  • the network-side device provided in this embodiment can create a sandbox for the data provider as a safe and trusted environment for data storage and processing.
  • the first network-side device only collects the metadata of the data provider, and does not need to obtain the original data, which can avoid the leakage of private information caused by the disclosure of the original data.
  • the request data generated according to the request of the data applicant is obtained by the data applicant through the second network side device, which can further ensure that the data will not be leaked and ensure the security of the data sharing process compared with the sharing method of public data for all users reliable.
  • An implementation manner of the present application relates to a network side device, as shown in FIG. 8 , including:
  • the receiving module 801 is configured to receive the information of the sandbox synchronized by the first network side device, and provide the information of the sandbox for the data applicant to query;
  • a forwarding module 802 configured to forward the access sandbox request submitted by the data applicant to the first network side device
  • the notification module 803 is configured to notify the data applicant to obtain the response data from the sandbox after receiving the response data generation notification from the first network side device.
  • the network-side device provided in this embodiment can provide sandbox information for the data applicant to query, so that the data applicant initiates a sandbox access request to obtain response data according to requirements.
  • the access sandbox request submitted by the data applicant can also be received and forwarded to the first network side device, so as to realize the submission of the data applicant's access sandbox request.
  • Notify the data applicant who submitted the access sandbox request to obtain the response data so that the data applicant can obtain the requested data, which can prevent the data from being disclosed to all users and ensure that private data is not leaked.
  • modules involved in the above embodiments of the present application are logical modules.
  • a logical unit can be a physical unit, or a part of a physical unit, and can also Combination of physical units.
  • units that are not closely related to solving the technical problems proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.
  • the embodiment of the present application also provides a data sharing system, including: a first network-side device and a second network-side device capable of implementing the above data sharing method.
  • the embodiment of the present application also provides an electronic device, as shown in FIG. 9 , including at least one processor 901; and a memory 902 communicatively connected to at least one processor 901; wherein, the memory 902 stores information that can be processed by at least one
  • the instructions executed by the processor 901 are executed by at least one processor 901, so that the at least one processor 901 can execute the above data sharing method.
  • the memory 902 and the processor 901 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 901 and various circuits of the memory 902 together.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor 901 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor 901 .
  • Processor 901 is responsible for managing the bus and general processing, and may also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. And the memory 902 may be used to store data used by the processor 901 when performing operations.
  • Embodiments of the present application also provide a computer-readable storage medium storing a computer program.
  • the above-mentioned data sharing method is realized when the computer program is executed by the processor.
  • a device which can be A single chip microcomputer, a chip, etc.
  • a processor processor
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Abstract

本申请涉及数据安全领域，公开了一种数据共享方法、网络侧设备、系统、电子设备和储存介质。本申请中，该数据共享方法，包括：为数据提供方创建沙箱，并将沙箱的信息同步到第二网络侧设备；其中，沙箱与原始数据库绑定，沙箱的信息包括原始数据库的元数据；接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据；在与沙箱绑定的原始数据库中采集基于请求数据的元数据查询到的原始数据；根据采集到的原始数据，生成访问沙箱请求的响应数据，并通过第二网络侧设备通知数据申请方从沙箱中获取响应数据。

Description

数据共享方法、网络侧设备、系统、电子设备和存储介质
交叉引用
本申请基于申请号为“202111040184.0”、申请日为2021年09月06日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请涉及数据安全领域，尤其是涉及一种数据共享方法、网络侧设备、系统、电子设备和存储介质。
背景技术
当今社会处于信息高速增长的时代，数据作为一个新的商品，其共享已然成为当今技术和商业的一个新热点。数据与传统商品相比存在较大的差异，数据具有容易传播和复制的特点。而数据可能涉及大量个人和企业的隐私，这对于数据共享过程的安全可靠性和可追溯性都提出了更高的要求。传统的数据共享过程，存在中心审批环节。数据经过中心流转，既存在责权不清晰的问题，又存在数据隐私泄露的问题，这导致很多组织机构不愿意把自己数据对外共享。
区块链是一种多方共享的数据库技术，其技术的核心是块状数据链式存储与智能合约，并且只能读取和写入，不能修改和删除。采用区块链技术进行数据共享，既可以保证交易的可信、可追溯，又可以提高交易效率。
然而，本申请的发明人发现：对于区块链技术而言，上传至区块链的数据是对所有用户公开的，直接把包含隐私信息的数据上传至区块链会存在数据泄露的问题。目前大多数区块链平台仍未能对隐私数据进行有效保护,仍然存在隐私泄露的风险，无法保证数据共享过程的安全可靠。
发明内容
本申请的实施方式提供了一种数据共享方法，应用于第一网络侧设备，包括：为数据提供方创建沙箱，并将沙箱的信息同步到第二网络侧设备；其中，沙箱与原始数据库绑定，沙箱的信息包括原始数据库的元数据；接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据；在与沙箱绑定的原始数据库中采集基于请求数据的元数据查询到的原始数据；根据采集到的原始数据，生成访问沙箱请求的响应数据，并通过第二网络侧设备通知数据申请方从沙箱中获取响应数据。
本申请的实施方式提供了一种数据共享方法，应用于第二网络侧设备，包括：接收第一网络侧设备同步的沙箱的信息，并提供沙箱的信息供数据申请方查询；将数据申请方提交的访问沙箱请求转发给第一网络侧设备；在接收到第一网络侧设备的响应数据生成通知后，通知数据申请方从沙箱中获取响应数据。
本申请的实施方式还提供了一种网络侧设备，包括：创建模块，用于为数据提供方创建沙箱，并将创建的沙箱的信息同步到第二网络侧设备；其中，沙箱与原始数据库绑定，沙箱的信息包括原始数据库的元数据；接收模块，用于接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据；采集模块，用于在与沙箱绑定的原始数据库中采集基于请求数据的元数据查询到的原始数据；生成模块，用于根据采集到的原始数据，生成访问沙箱请求的响应数据，并通过第二网络侧设备通知数据申请方从沙箱中获取响应数据。
本申请的实施方式还提供了一种网络侧设备，包括：接收模块，用于接收第一网络侧设备同步的沙箱的信息，并提供沙箱的信息供数据申请方查询；转发模块，用于将数据申请方提交的访问沙箱请求转发给第一网络侧设备；通知模块，用于在接收到第一网络侧设备的响应数据生成通知后，通知数据申请方从沙箱中获取响应数据。
本申请的实施方式还提供了一种数据共享系统，包括：能够实现上述数据共享方法的第一网络侧设备和第二网络侧设备。
本申请的实施方式还提供了一种电子设备，包括：至少一个处理器；以及，与至少一个处理器通信连接的存储器；其中，存储器存储有可被至少一个处理 器执行的指令，指令被至少一个处理器执行，以使至少一个处理器能够执行上述的数据共享方法。
本申请的实施方式还提供了一种存储有计算机程序的计算机可读存储介质，计算机程序被处理器执行时实现上述的数据共享方法。
附图说明
一个或多个实施方式通过与之对应的附图中的图片进行示例性说明，这些示例性说明并不构成对实施方式的限定，附图中具有相同参考数字标号的元件表示为类似的元件，除非有特别申明，附图中的图不构成比例限制。
图1是根据本申请一实施方式中应用于第一网络侧设备的数据共享方法流程图；
图2是根据本申请一实施方式中涉及的沙箱创建过程的交互图；
图3是根据本申请一实施方式中涉及的数据共享过程的交互图一；
图4是根据本申请一实施方式中涉及的数据共享过程的交互图二；
图5是根据本申请一实施方式中涉及的安全沙箱系统的结构示意图；
图6是根据本申请一实施方式中应用于第二网络侧设备的数据共享方法流程图；
图7是根据本申请一实施方式中的第一网络侧设备的结构示意图；
图8是根据本申请一实施方式中的第二网络侧设备的结构示意图；
图9是根据本申请一实施方式中的电子设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施方式进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施方式中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施方式的种种变化和修改，也可以实现本申请所要求保护的技术方案。
本申请的一实施方式涉及一种数据共享方法，应用于第一网络侧设备，具 体流程如图1所示。在本实施方式中，第一网络侧设备为数据提供方创建沙箱，并将创建的沙箱的信息同步到第二网络侧设备；其中，沙箱与原始数据库绑定，沙箱的信息包括原始数据库的元数据；接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据；在与沙箱绑定的原始数据库中采集基于请求数据的元数据查询到的原始数据；根据查询到的原始数据，生成响应数据，供数据申请方通过第二网络侧设备获取。
本实施方式的目的在于提供一种数据共享方法，用以保护数据的隐私信息，保证数据共享过程的安全。
下面对本实施例中的数据共享方法的实现细节进行具体的说明，以下内容仅为方便理解本方案的实现细节，并非实施本方案的必须。具体流程如图1所示，至少包括但不限于以下步骤：
步骤101，为数据提供方创建沙箱。在本实施方式中，数据提供方提供数据进行共享，在本步骤中，由第一网络侧设备为数据提供方创建沙箱，作为安全可靠的环境供数据提供方储存、处理数据。
第一网络侧设备为数据提供方创建沙箱的过程如图2所示。具体地说，在本实施方式中，第一网络侧设备根据数据提供方的需求设置沙箱的服务类型。在创建沙箱时，数据提供方为沙箱进行原始数据库绑定，配置地址、账号、密码用以进行原始数据库的访问。数据提供方还可以进一步为沙箱配置脱敏规则，具体可以选择半脱敏或全脱敏。
在一个例子中，第一网络侧设备根据数据提供方的创建沙箱请求确定沙箱提供的服务类型；其中，服务类型包括：共享交换，可信计算；根据选择的服务类型创建沙箱。另外，还可以设置沙箱的空间大小和保留时长。沙箱除了作为安全可靠的环境用以储存数据之外，提供共享交换服务的沙箱可以提供进行了脱敏、加密等处理的数据供数据申请方获取，而可信计算类沙箱可以提供数据提供方数据的计算结果供数据申请方获取。
在一个例子中，沙箱配置完成后，用户点击确定完成沙箱发布。第一网络侧设备为创建的沙箱申请独立存储空间，挂载到以沙箱的名称为中间目录的路径上，用于存放共享的数据。
步骤102，将沙箱的信息同步到第二网络侧设备。在本步骤中，沙箱的信 息被同步到第二网络侧设备，供第二网络侧设备提供给数据申请方查询沙箱的信息。
在一个例子中，第一网络侧设备在将创建的沙箱同步到第二网络侧设备后，把沙箱发布并同步的过程上传至区块链存证，上传至区块链的信息包括：沙箱的标识、数据提供方标识、原始数据库的元数据等。上传沙箱发布过程至区块链以保证沙箱发布过程的可追溯性。
本实施方式中涉及的区块链可以是常见的区块链如超级账本(Hyperledger Fabric)等。本实施方式中上链存证的过程依赖智能合约。
步骤103，接收第二网络侧设备转发的数据申请方发起的访问沙箱请求。若数据申请方向第二网络侧设备发出访问沙箱请求，则由第二网络侧设备将该访问沙箱请求转发给第一网络侧设备。在本步骤中，第一网络侧设备接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据。
具体地说，数据申请方在第二网络侧设备处查询数据提供方提供的沙箱信息，其中包含数据提供方提供数据的元数据，进而发出访问沙箱请求。访问沙箱请求由第二网络侧设备转发给第一网络侧设备，第一网络侧设备接收第二网络侧设备转发的访问沙箱请求，访问沙箱请求携带数据申请方请求的数据的元数据。
在一个例子中，第一网络侧设备在接收到第二网络侧设备转发的数据申请方发起的访问沙箱请求后，根据数据申请方发起的访问沙箱请求生成审批单，并通知数据提供方对访问沙箱请求进行审批。通知数据提供方进行审批能够保证共享的数据只有数据提供方允许的数据申请方才能查询到，避免了隐私数据对全体用户泄露。
步骤104，在与沙箱绑定的原始数据库中采集查询到的原始数据。
具体地说，在接收到第二网络侧设备转发的数据申请方发起的访问沙箱请求后，在本步骤中，第一网络侧设备根据访问沙箱请求中携带请求数据的元数据，在与沙箱绑定的原始数据库中查询原始数据，并采集基于请求数据的元数据查询到的原始数据。
步骤105，生成响应数据，通过第二网络侧设备通知数据申请方从沙箱中 获取。
具体地说，第一网络侧设备根据在上一步骤中采集到的原始数据，生成访问沙箱请求的响应数据，同时将生成的响应数据存入沙箱中，并且向第二网络侧设备发送响应数据生成通知，再由第二网络侧设备通知数据申请方从沙箱中获取响应数据。
在一个例子中，数据申请方请求访问的是共享交换类沙箱，即沙箱提供的服务类型为共享交换，那么第一网络侧设备依据数据提供方为沙箱配置的脱敏规则，对采集到的原始数据进行脱敏处理，进而对经脱敏处理后的数据用数据申请方的公钥进行加密处理，即完成了响应数据的生成。数据申请方请求访问共享交换类沙箱并最终获取响应数据的过程如图3所示。
在另一个例子中，数据申请方请求访问的是可信计算类沙箱，即沙箱提供的服务类型为可信计算，相应地数据申请方发起的访问沙箱请求为获取数据提供方提供的部分或全部数据的计算结果。那么第一网络侧设备对采集到的原始数据进行加密处理，并将加密处理后的数据推送到可信计算环境进行可信计算，进而把计算结果采用数据申请方的公钥进行加密处理，即完成了响应数据(计算结果)的生成。数据申请方请求访问可信计算类沙箱并最终获取响应数据(计算结果)的过程如图4所示。其中对生成的响应数据的加密处理均使用数据申请方的公钥，请求数据只能由数据申请方用私钥进行解密并最终获取，这能够保证数据只能够由数据提供方允许的数据申请方获取，进一步避免了数据的泄露。
在一个例子中，第一网络侧设备在生成响应数据后，然后将数据共享过程中的信息上传至区块链存证。其中，上传至区块链的信息包括：数据申请方身份标识、沙箱标识、数据提供方身份标识、响应数据的信息、数据提供方签名等。上传至区块链用以存证，保证数据共享过程的可追溯性。此处响应数据的信息可以是共享数据的哈希值，或者数据计算结果。
本实施方式中涉及到的可信计算环境提供可信计算服务，针对数据申请方请求访问可信计算类沙箱的场景。可信计算环境与第一网络侧设备之间建立有安全通道，第一网络侧设备把隐私数据使用可信计算环境的公钥加密后通过安全通道放入可信计算环境进行计算，计算结果使用数据申请方公钥加密后返回。
本实施方式中的第一网络侧设备面向数据提供方，部署在机构机房中或远程网络中。第一网络侧设备在功能上可以作为安全沙箱系统的沙箱代理模块，具体可以包含接入层、通讯层、沙箱管理模块、数据采集模块、数据脱敏模块、数据元管理模块和隐私计算模块。其中，接入层用于为数据提供方提供沙箱管理维护的人机交互功能，具体可以是命令行方式或者用户界面(User Interface，简称“UI界面”)方式。通讯层用于与第二网络侧设备通过谷歌远程过程调用协议(Google Remote Procedure Call Protocol，简称“GRPC协议”)接口进行通讯，包括发布沙箱等上行消息。沙箱管理模块负责沙箱的创建、管理和维护功能，依赖下层的隐私计算模块、数据脱敏模块、数据采集模块、数据元管理模块提供功能支撑。数据采集模块负责对原始数据的采集。数据脱敏模块用于对采集的数据字段按照配置的脱敏规则进行数据脱敏处理。数据元管理模块在原始数据库绑定过程中负责从原始数据库获取共享数据的元数据信息，并存储和维护共享字段的共享属性和脱敏规则。隐私计算模块与可信计算环境建立安全通道，负责把隐私数据按照使用方申请的计算要求放入可信计算环境进行可信计算，并把计算结果加密后返回给申请用户。
本实施方式中的第二网络侧设备面向数据申请方，可以部署在数据提供机构的机房中或远程网络中。另外，第一网络侧设备与第二网络侧设备也可以部署在中心机房或云环境的同一服务器中。第二网络侧设备在功能上可以作为安全沙箱系统的沙箱服务模块，具体可以包含接入层、通讯层、沙箱浏览模块、共享交换模块、可信计算模块和数据元信息模块。其中，接入层用于为数据申请方提供沙箱访问的人机交互功能，具体可以是命令行方式或者UI界面方式。通讯层用于与沙箱代理模块通过GRPC协议接口进行通讯，包括查询沙箱、共享申请、计算申请、获取结果等下行消息。沙箱浏览模块用于为数据申请方提供沙箱的访问、申请和信息查询功能，依赖下层的共享交换模块、可信计算模块和数据元信息模块提供功能支撑。共享交换模块用于共享交换类沙箱，为沙箱浏览模块提供共享交换类沙箱的访问申请和共享文件下载功能。可信计算模块用于可信计算类沙箱，涉及用户隐私数据，由于原始数据不能离开数据提供方的空间，可信计算模块为沙箱浏览模块提供可信计算类沙箱的计算任务申请和结果获取功能。数据元信息模块用于从第一网络侧设备获取沙箱的元数据， 并为沙箱浏览模块提供沙箱的元数据。
本实施方式中涉及的区块链、第一网络侧设备(沙箱代理模块)、第二网络侧设备(沙箱服务模块)、可信计算环境、智能合约和服务接口组成了安全沙箱系统。安全沙箱系统采用分布式架构，可以在物理节点部署也可以在云环境上通过租户形式部署。安全沙箱系统中的各部分连接结构如图5所示。沙箱代理模块只与沙箱服务模块通讯，沙箱代理模块之间不互通、彼此隔离。沙箱代理模块启动以后向沙箱服务模块进行注册。
在一个例子中，在对第二网络侧设备(沙箱服务模块)进行部署前，先部署好区块链环境和可信计算环境。进而，把证书放置在cert证书目录，把需要安装的智能合约放置在contracts目录下对应的语种目录下面；修改config/config.yaml配置文件，设置对接区块链平台类型，替换本地存储DB地址；修改config/config.yaml配置文件，完成本地对接的区块链平台相关配置，fabric配置平台包括组织名称、peer和orderer地址和证书配置；执行service init命令，启动沙箱服务程序；安装部署沙箱智能合约。
在另一个例子中，对第一网络侧设备(沙箱代理模块)进行部署。把代理程序部署到机构的服务器环境上，把证书放置在cert证书目录，把需要安装的智能合约放置在contracts目录下对应的语种目录下面；修改config/config.yaml配置文件，设置对接区块链平台类型，替换本地存储DB地址；修改config/config.yaml配置文件，完成本地对接的区块链平台相关配置，fabric平台包括组织名称、peer和orderer地址和证书配置；执行agent--service ip:port/<沙箱服务id>命令，启动沙箱代理程序；安装部署沙箱智能合约。
在本实施方式中，第一网络侧设备为数据提供方创建沙箱，作为安全可信的环境用以进行数据的存储和处理。在创建沙箱时，第一网络侧设备仅采集数据提供方的元数据，而不需要获取原始数据，能够避免原始数据公开导致隐私信息的泄露。另外，根据数据申请方的请求生成的请求数据，由数据申请方经由第二网络侧设备获取，相比对所有用户公开数据的共享方式，能够进一步保证数据不被泄露，保障数据共享过程的安全可靠。
本申请的另一实施方式涉及一种数据共享方法，应用于第二网络侧设备。本实施方式中第二网络侧设备提供沙箱的信息供数据申请方查询，将数据申请 方提交的访问沙箱请求转发给第一网络侧设备，最后通知数据申请方获取数据。具体流程如图6所示，至少包括但不限于以下步骤：
步骤601，接收第一网络侧设备同步的沙箱的信息，提供沙箱的信息供数据申请方查询。在本实施方式中，数据提供方提供数据进行共享，第一网络侧设备为数据提供方创建沙箱、发布沙箱后将沙箱的信息同步给第二网络侧设备。在本步骤中，第二网络侧设备接收第一网络侧设备同步的沙箱的信息，并提供沙箱的信息供数据申请方查询。
使得数据申请方能够根据自己的需求提出访问沙箱请求。数据申请方发出的访问沙箱请求可以面向共享交换类沙箱，也可以面向可信计算类沙箱。相应地，数据申请方可以请求获取部分或全部数据或数据的计算结果。
步骤602，接收数据申请方提交的访问沙箱请求，并转发给第一网络侧设备。数据申请方通过第二网络侧设备查询沙箱的信息后发出访问沙箱请求，本步骤为第二网络侧设备接收数据申请方提交的访问沙箱请求，再进一步转发给第一网络侧设备。
步骤603，接收第一网络侧设备响应数据生成的通知并通知数据申请方获取响应数据。在上一步骤中，第二网络侧设备将数据申请方提交的访问沙箱请求转发给第一网络侧设备，第一网络侧设备根据数据申请方提交的访问沙箱请求对数据进行处理。在本步骤中，第二网络侧设备接收第一网络侧设备响应数据生成的通知，并通知数据申请方获取响应数据。
本实施方式中，第二网络侧设备能够提供沙箱的信息供数据申请方查询，以使数据申请方根据需求发起访问沙箱请求以获取响应数据。同时，第二网络侧设备还能够接收数据申请方提交的访问沙箱请求并转发给第一网络侧设备，实现数据申请方访问沙箱请求的提交。通知提交访问沙箱请求的数据申请方获取响应数据，使数据申请方获取到请求的数据，能够避免数据对所有用户公开，保证隐私数据不被泄露。
本申请的一实施方式涉及一种网络侧设备，如图7所示，包括：
创建模块701，用于为数据提供方创建沙箱，并将创建的沙箱的信息同步到第二网络侧设备；其中，沙箱与原始数据库绑定，沙箱的信息包括原始数据库的元数据；
接收模块702，用于接收第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，访问沙箱请求携带请求数据的元数据；
采集模块703，用于在与沙箱绑定的原始数据库中采集基于请求数据的元数据查询到的原始数据；
生成模块704，用于根据采集到的原始数据，生成访问沙箱请求的响应数据，并通过第二网络侧设备通知数据申请方从沙箱中获取响应数据。
在一个例子中，创建模块701，还可以用于根据数据提供方的创建沙箱请求确定沙箱提供的服务类型；其中，服务类型包括：共享交换，可信计算。
在一个例子中，生成模块704，还可以用于在沙箱提供的服务类型是共享交换的情况下，对采集模块703采集到的原始数据进行脱敏处理，并对经脱敏处理后的数据进行加密处理，将经加密处理后的数据作为访问沙箱请求的响应数据。
在一个例子中，生成模块704，还可以用于在沙箱提供的服务类型是可信计算的情况下，对采集模块703采集到的原始数据进行加密处理，将经加密处理后的原始数据推送到可信计算环境进行计算，并对计算结果进行加密处理，将经加密处理后的计算结果作为访问沙箱请求的响应数据。
在一个例子中，第一网络侧设备还可以包括：审批模块(图中未示出)，用于在接收第二网络侧设备转发的数据申请方发起的访问沙箱请求后，根据数据申请方发起的访问沙箱请求生成审批单，并通知数据提供方对访问沙箱请求进行审批。
在一个例子中，第一网络侧设备还可以包括：上链模块(图中未示出)，用于在将创建的沙箱的信息同步到第二网络侧设备后，将沙箱的创建信息上传至区块链；其中，创建信息包括以下之一或其任意组合：沙箱的标识，数据提供方的身份标识，原始数据库的元数据；在生成访问沙箱请求的响应数据后，将响应数据的生成信息上传至区块链；其中，生成信息包括以下之一或其任意组合：沙箱的标识，数据申请方的身份标识，数据提供方的身份标识，响应数据的信息，数据提供方的签名。
本实施方式提供的网络侧设备能够为数据提供方创建沙箱，作为安全可信的环境用以进行数据的存储和处理。在创建沙箱时，第一网络侧设备仅采集数 据提供方的元数据，而不需要获取原始数据，能够避免原始数据公开导致隐私信息的泄露。另外，根据数据申请方的请求生成的请求数据，由数据申请方经由第二网络侧设备获取，相比对所有用户公开数据的共享方式，能够进一步保证数据不被泄露，保障数据共享过程的安全可靠。
本申请的一实施方式涉及一种网络侧设备，如图8所示，包括：
接收模块801，用于接收第一网络侧设备同步的沙箱的信息，并提供沙箱的信息供数据申请方查询；
转发模块802，用于将数据申请方提交的访问沙箱请求转发给第一网络侧设备；
通知模块803，用于在接收到第一网络侧设备的响应数据生成通知后，通知数据申请方从沙箱中获取响应数据。
本实施方式提供的网络侧设备能够提供沙箱的信息供数据申请方查询，以使数据申请方根据需求发起访问沙箱请求以获取响应数据。还能够接收数据申请方提交的访问沙箱请求并转发给第一网络侧设备，实现数据申请方访问沙箱请求的提交。通知提交访问沙箱请求的数据申请方获取响应数据，使数据申请方获取到请求的数据，能够避免数据对所有用户公开，保证隐私数据不被泄露。
值得一提的是，本申请上述实施方式中所涉及到的各模块均为逻辑模块，在实际应用中，一个逻辑单元可以是一个物理单元，也可以是一个物理单元的一部分，还可以以多个物理单元的组合实现。此外，为了突出本申请的创新部分，本实施方式中并没有将与解决本申请所提出的技术问题关系不太密切的单元引入，但这并不表明本实施方式中不存在其它的单元。
本申请的实施例还提供了一种数据共享系统，包括：能够实现上述数据共享方法的第一网络侧设备和第二网络侧设备。
本申请的实施例还提供一种电子设备，如图9所示，包括至少一个处理器901；以及，与至少一个处理器901通信连接的存储器902；其中，存储器902存储有可被至少一个处理器901执行的指令，指令被至少一个处理器901执行，以使至少一个处理器901能够执行上述数据共享方法。
其中，存储器902和处理器901采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器901和存储器902的各种电路 连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器901处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器901。
处理器901负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器902可以被用于存储处理器901在执行操作时所使用的数据。
上述产品可执行本申请实施例所提供的方法，具备执行方法相应的功能模块和有益效果，未在本实施例中详尽描述的技术细节，可参见本申请实施例所提供的方法。
本申请的实施例还提供一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述数据共享方法。
本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
上述实施例是提供给本领域普通技术人员来实现和使用本申请的，本领域普通技术人员可以在不脱离本申请的发明思想的情况下，对上述实施例做出种种修改或变化，因而本申请的保护范围并不被上述实施例所限，而应该符合权利要求书所提到的创新性特征的最大范围。

Claims (12)

  1. 一种数据共享方法，应用于第一网络侧设备，包括：
    为数据提供方创建沙箱，并将所述沙箱的信息同步到第二网络侧设备；其中，所述沙箱与原始数据库绑定，所述信息包括原始数据库的元数据；
    接收所述第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，所述访问沙箱请求携带请求数据的元数据；
    在与所述沙箱绑定的原始数据库中采集基于所述请求数据的元数据查询到的原始数据；
    根据采集到的原始数据，生成所述访问沙箱请求的响应数据，并通过所述第二网络侧设备通知所述数据申请方从所述沙箱中获取所述响应数据。
  2. 根据权利要求1所述的数据共享方法，其中，所述为数据提供方创建沙箱，包括：
    根据所述数据提供方的创建沙箱请求确定所述沙箱提供的服务类型；其中，所述服务类型包括：共享交换，可信计算；
    根据所述服务类型创建所述沙箱。
  3. 根据权利要求2所述的数据共享方法，其中，所述生成所述访问沙箱请求的响应数据，包括：
    在所述沙箱提供的服务类型是共享交换的情况下，对所述原始数据进行脱敏处理，并对经所述脱敏处理后的数据进行加密处理，将经所述加密处理后的数据作为所述访问沙箱请求的响应数据。
  4. 根据权利要求2所述的数据共享方法，其中，所述生成所述访问沙箱请求的响应数据，包括：
    在所述沙箱提供的服务类型是可信计算的情况下，对所述原始数据进行加密处理，将经所述加密处理后的原始数据推送到可信计算环境进行计算，并对计算结果进行加密处理，将经所述加密处理后的计算结果作为所述访问沙箱请求的响应数据。
  5. 根据权利要求1至4中任一项所述的数据共享方法，其中，在所述接收所述第二网络侧设备转发的数据申请方发起的访问沙箱请求后，所述在与所述沙箱绑定的原始数据库中采集基于所述请求数据的元数据查询到的原始数据之前，还包括：
    根据所述数据申请方发起的所述访问沙箱请求，通知所述数据提供方对所述访问沙箱请求进行审批；
    若审批通过，则再执行所述在与所述沙箱绑定的原始数据库中采集基于所述请求数据的元数据查询到的原始数据。
  6. 根据权利要求1至5中任一项所述的数据共享方法，其中，在所述将创建的所述沙箱的信息同步到第二网络侧设备后，还包括：
    将所述沙箱的创建信息上传至区块链；其中，所述创建信息包括以下之一或其任意组合：所述沙箱的标识，所述数据提供方的身份标识，原始数据库的元数据；
    在所述生成所述访问沙箱请求的响应数据后，还包括：
    将所述响应数据的生成信息上传至区块链；其中，所述生成信息包括以下之一或其任意组合：所述沙箱的标识，所述数据申请方的身份标识，所述数据提供方的身份标识，所述响应数据的信息，所述数据提供方的签名。
  7. 一种数据共享方法，其中，应用于第二网络侧设备，包括：
    接收第一网络侧设备同步的沙箱的信息，并提供所述沙箱的信息供数据申请方查询；
    将所述数据申请方提交的访问沙箱请求转发给所述第一网络侧设备；
    在接收到所述第一网络侧设备的响应数据生成通知后，通知所述数据申请方从沙箱中获取响应数据。
  8. 一种网络侧设备，包括：
    创建模块，用于为数据提供方创建沙箱，并将所述沙箱的信息同步到第二 网络侧设备；其中，所述沙箱与原始数据库绑定，所述信息包括原始数据库的元数据；
    接收模块，用于接收所述第二网络侧设备转发的数据申请方发起的访问沙箱请求；其中，所述访问沙箱请求携带请求数据的元数据；
    采集模块，用于在与所述沙箱绑定的原始数据库中采集基于所述请求数据的元数据查询到的原始数据；
    生成模块，用于根据所述采集到的原始数据，生成所述访问沙箱请求的响应数据，并通过所述第二网络侧设备通知所述数据申请方从所述沙箱中获取所述响应数据。
  9. 一种网络侧设备，包括：
    接收模块，用于接收第一网络侧设备同步的沙箱的信息，并提供所述沙箱的信息供数据申请方查询；
    转发模块，用于将所述数据申请方提交的访问沙箱请求转发给所述第一网络侧设备；
    通知模块，用于在接收到所述第一网络侧设备的响应数据生成通知后，通知所述数据申请方从沙箱中获取响应数据。
  10. 一种数据共享系统，包括：如权利要求8所述的网络侧设备和权利要求9所述的网络侧设备。
  11. 一种电子设备，包括：
    至少一个处理器；以及，
    与所述至少一个处理器通信连接的存储器；其中，
    所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至6中任一项所述的数据共享方法；或者，以使所述至少一个处理器能够执行如权利要求7所述的数据共享方法。
  12. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至6中任一项所述的数据共享方法；或者，实现权利要求7所述的数据共享方法。
PCT/CN2022/098771 2021-09-06 2022-06-14 数据共享方法、网络侧设备、系统、电子设备和存储介质 WO2023029655A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
KR1020247008097A KR20240047413A (ko) 2021-09-06 2022-06-14 데이터 공유 방법, 네트워크 측 장치, 시스템, 전자 장치 및 저장 매체

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111040184.0 2021-09-06
CN202111040184.0A CN115758326A (zh) 2021-09-06 2021-09-06 数据共享方法、网络侧设备、系统、电子设备和存储介质

Publications (1)

Publication Number Publication Date
WO2023029655A1 true WO2023029655A1 (zh) 2023-03-09

Family

ID=85332758

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/098771 WO2023029655A1 (zh) 2021-09-06 2022-06-14 数据共享方法、网络侧设备、系统、电子设备和存储介质

Country Status (3)

Country Link
KR (1) KR20240047413A (zh)
CN (1) CN115758326A (zh)
WO (1) WO2023029655A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114422215A (zh) * 2021-12-31 2022-04-29 国网安徽省电力有限公司合肥供电公司 一种基于区块链的跨平台和可信能源数据共享系统及方法

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116260823B (zh) * 2023-05-15 2023-09-15 南方电网数字电网研究院有限公司 受控数据共享方法、装置、计算机设备和存储介质
CN116684172B (zh) * 2023-06-25 2023-10-27 广州谦益科技有限公司 基于安全多方计算的数据交换方法、装置、系统及电子设备
CN116561741B (zh) * 2023-07-07 2024-03-26 粤港澳大湾区数字经济研究院(福田) 一种数据建模方法、系统及相关设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108830601A (zh) * 2018-06-25 2018-11-16 上海延华大数据科技有限公司 基于区块链的智慧城市信息安全使用方法及系统
CN109670340A (zh) * 2018-12-29 2019-04-23 湖南网数科技有限公司 一种医疗数据的安全可信交换共享方法和系统
CN111224950A (zh) * 2019-12-18 2020-06-02 中思博安科技（北京）有限公司 数据交换方法、系统和计算机存储介质
CN112347470A (zh) * 2020-11-27 2021-02-09 国家电网有限公司大数据中心 基于区块链和数据安全沙箱的电网数据保护方法及系统
CN112866256A (zh) * 2021-01-22 2021-05-28 中信银行股份有限公司 数据处理方法、装置及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108830601A (zh) * 2018-06-25 2018-11-16 上海延华大数据科技有限公司 基于区块链的智慧城市信息安全使用方法及系统
CN109670340A (zh) * 2018-12-29 2019-04-23 湖南网数科技有限公司 一种医疗数据的安全可信交换共享方法和系统
CN111224950A (zh) * 2019-12-18 2020-06-02 中思博安科技（北京）有限公司 数据交换方法、系统和计算机存储介质
CN112347470A (zh) * 2020-11-27 2021-02-09 国家电网有限公司大数据中心 基于区块链和数据安全沙箱的电网数据保护方法及系统
CN112866256A (zh) * 2021-01-22 2021-05-28 中信银行股份有限公司 数据处理方法、装置及存储介质

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114422215A (zh) * 2021-12-31 2022-04-29 国网安徽省电力有限公司合肥供电公司 一种基于区块链的跨平台和可信能源数据共享系统及方法

Also Published As

Publication number Publication date
CN115758326A (zh) 2023-03-07
KR20240047413A (ko) 2024-04-12

Similar Documents

Publication Publication Date Title
KR102274294B1 (ko) 고 가용성의 신뢰 실행 환경을 사용하여 블록체인 네트워크에 대한 액세스 데이터를 리트리빙하는 방법
WO2023029655A1 (zh) 数据共享方法、网络侧设备、系统、电子设备和存储介质
US10917234B2 (en) Blockchain for on-chain management of off-chain storage
TWI725793B (zh) 用於將分散識別符映射到真實世界實體的系統及方法
US11025435B2 (en) System and method for blockchain-based cross-entity authentication
US11038670B2 (en) System and method for blockchain-based cross-entity authentication
US10735202B2 (en) Anonymous consent and data sharing on a blockchain
CN111213128A (zh) 实现基于区块链的web服务
US11218313B1 (en) Decentralized verification of devices using distributed ledger technology
CN113132103A (zh) 一种数据跨域安全共享系统及方法
US20190272291A1 (en) Apparatus, method, and storage medium for managing data
CN113901505B (zh) 数据共享方法、装置、电子设备及存储介质
US20230079672A1 (en) Cross-chain data transmission method and apparatus, computer device, storage medium, and computer program product
TWI829219B (zh) 可將取用訊標由區塊鏈子系統移轉給資料請求者裝置的去中心化資料授權控管系統
US11689375B2 (en) Data in transit protection with exclusive control of keys and certificates across heterogeneous distributed computing environments
JP2014150518A (ja) ユーザ端末、鍵生成管理装置、及びプログラム
US11201857B2 (en) Domain transcendent file cryptology network
US20230403279A1 (en) Internet protocol (ip) whitelisting for signed uniform resource locators (urls)
CN113946864B (zh) 一种机密信息获取方法、装置、设备及存储介质
Javier et al. An API for Secure Sharing of Electronic Health Records in a Public Blockchain
TW554275B (en) Management device and method for managing a remote database
CN116137627A (zh) 一种基于区块链网络的数据处理方法、装置及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22862797

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20247008097

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2022862797

Country of ref document: EP

Effective date: 20240314