WO2023078055A1

WO2023078055A1 - Method and system for securely sharing data between first area and second area

Info

Publication number: WO2023078055A1
Application number: PCT/CN2022/125185
Authority: WO
Inventors: 朱永春; 冯成林
Original assignee: 支付宝(杭州)信息技术有限公司; 蚂蚁区块链科技(上海)有限公司
Priority date: 2021-11-08
Filing date: 2022-10-13
Publication date: 2023-05-11
Also published as: CN114091058A

Abstract

Embodiments of the present description provides a method and system for securely sharing data between a first area and a second area, the second area being provided with a secure use platform. The first area: encrypts plaintext data of multiple users to be shared with the secure use platform so as to generate an encrypted data file; generates a key file according to a target permission of a target user in the multiple users to access the encrypted data file, where the encrypted data file needs to be accessed by using a key file via the secure use platform; generates a storage file according to a security management and control policy configured for the encrypted data file, where the security management and control policy comprises respective access permissions of the multiple users; transmits the encrypted data file and the key file to the target user via a gatekeeper; and transmits the storage file to the secure use platform via the gatekeeper, such that the secure use platform controls the use of data in the encrypted data file by the target user according to the security management and control policy in the storage file. The present invention considers both data sharing and data security.

Description

Method and system for secure sharing of data between a first region and a second region

This application claims the priority of the Chinese patent application with the application number 202111315979.8 and the application title "Method and system for data security sharing between the first region and the second region" submitted to the State Intellectual Property Office of China on November 08, 2021 , the entire contents of which are incorporated in this application by reference.

technical field

One or more embodiments of this specification relate to the computer field, and in particular, to a method and system for securely sharing data between a first area and a second area.

Background technique

While the country is vigorously promoting data openness and sharing, there has always been a core difficulty in data sharing: data security.

In the current data sharing scenario, once the data is transferred from the data owner to the data user, the actual control of the data belongs to the data user, and the data user can retain the data and use it in unauthorized scenarios, Even if it is resold, the data owner has no control over all usage of the data.

Therefore, it is hoped that there will be an improved solution that can improve the data owner's ability to control the shared data, so as to take into account both data sharing and data security.

Contents of the invention

One or more embodiments of this specification describe a method and system for securely sharing data between a first area and a second area, which can take into account both data sharing and data security.

In the first aspect, a method for safely sharing data between a first area and a second area is provided, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the first area The second area is provided with a safe use platform; the method is performed in the first area, including:

Encrypt the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files;

Generate a corresponding key file according to the target user's target access authority to the encrypted data file among the multiple users; wherein, the encrypted data file needs to be processed through the secure use platform using the key file access;

According to the security management and control strategy configured to the encrypted data file, generate the evidence file; Wherein, the security management and control strategy includes the respective access rights of the plurality of users;

transmitting the encrypted data file and the key file to the target user through the gatekeeper;

transmitting the certificate storage file to the safe use platform through the gatekeeper, so that the safe use platform controls the target user to encrypt the encrypted Use of Data in Data Files.

In a possible implementation manner, the security level of the first area is higher than that of the second area.

In a possible implementation manner, the encrypted data file is encrypted with an initial key; the key file includes a derived key obtained using the initial key.

In a possible implementation manner, the target access right is an access right for a target field of the encrypted data file, and the key file is used to decrypt the data usage result of the target field.

In a possible implementation manner, encrypting the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files includes:

For the plaintext data shared with multiple users of the safe use platform, generate a plaintext data file according to the predefined file generation format and file generation rules;

Encrypt the plaintext data file to generate the encrypted data file.

In a possible implementation manner, the access rights include at least one of the following:

The data usage pattern used to indicate the type of operation allowed, the frequency of data usage, and the data usage control used to indicate whether the result of data usage is displayed in plain text or desensitized.

In a possible implementation manner, the generating the certificate file according to the security management and control policy configured for the encrypted data file includes:

The security management and control policy is encrypted to generate the certificate file.

In a possible implementation manner, the second area further includes a blockchain network; the certificate deposit file is stored in the blockchain network by the safe use platform.

In a possible implementation manner, the method also includes:

According to the updated security management and control strategy, an updated evidence storage file is generated;

The updated certificate storage file is transmitted to the safe use platform through the gatekeeper, so that it can perform security management and control according to the security management and control strategy in the updated certificate storage file.

In the second aspect, a method for securely sharing data between a first area and a second area is provided, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the first area The second area is provided with a safe use platform; the method is performed in the second area, including:

The target user in the multiple users of the safe use platform obtains the encrypted data file and the key file through the gatekeeper; wherein, the encrypted data file is obtained by encrypting the plaintext data in the first area; the key file Corresponding to the target access authority of the target user to the encrypted data file; the encrypted data file needs to be accessed through the safe use platform using the key file;

The safe use platform obtains the certificate storage file from the first area through the gatekeeper; the certificate storage file is generated according to the security management and control strategy configured for the encrypted data file, wherein the security management and control strategy includes the Describe the respective access rights of multiple users;

The target user sends a data usage request, requesting to use the key file to access the encrypted data file;

In response to the data use request, the secure use platform controls the target user's use of the data in the encrypted data file according to the security management and control policy in the certificate storage file.

In a possible implementation manner, the method also includes:

The safe use platform performs identity authentication on the target user, and controls the target user's use of the data in the encrypted data file when the authentication is passed.

In a possible implementation manner, the safe use platform is deployed with a decryption toolkit;

The target user sends a data usage request, including:

The target user requests to invoke the decryption toolkit;

The controlling the use of the data in the encrypted data file by the target user includes:

By running the decryption toolkit, the use of data in the encrypted data file is controlled according to the security management policy and by using the key file.

In a possible implementation manner, the controlling the use of data in the encrypted data file by the target user includes:

Obtain the target access authority corresponding to the target user described in the security management and control policy;

According to the target access authority, perform data use on the encrypted data file to obtain a ciphertext result;

According to the target access authority, the key file is used to perform result processing on the ciphertext result to obtain a data processing result fed back to the target user.

Further, the data usage includes query or dense state calculation.

Further, the target access authority includes a data usage mode, which indicates the type of operation that the target user is allowed to perform;

According to the target access authority, performing data use on the encrypted data file to obtain a ciphertext result includes:

Perform the encrypted state calculation of the operation type on the encrypted data file to obtain the ciphertext result.

Further, the target access authority includes the data usage frequency allowed by the target user;

When the current usage frequency is not higher than the allowed data usage frequency, data usage is performed on the encrypted data file.

Further, the target access authority includes data usage control, which shows that data usage results are allowed to be displayed in plain text;

According to the target access authority, using the key file to perform result processing on the ciphertext result to obtain a data processing result fed back to the target user, including:

Using the key file to decrypt the ciphertext result to obtain a plaintext result as the data processing result.

Further, the target access authority includes data usage control, which shows the results of data usage in a desensitized manner;

Decrypting the ciphertext result by using the key file to obtain a plaintext result;

Desensitization is performed on the plaintext result to obtain a desensitization result as the data processing result.

In a possible implementation manner, the target access right is an access right for a target field of the encrypted data file, and the use of data is a data use for the target field.

In a possible implementation manner, the second area also includes a block chain network; the method also includes:

The safe use platform stores the certificate file in the block chain network;

The safe use platform reads the certificate deposit file from the block chain network in response to the data use request.

Further, the method also includes:

The safe use platform obtains an updated certificate file from the first area through the gatekeeper, and stores the updated file in the block chain network;

The reading of the certificate storage file from the blockchain network includes: reading the latest recorded certificate storage file in the blockchain network as the certificate storage file.

In the third aspect, a system for securely sharing data between the first area and the second area is provided, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the first area The second area is equipped with a safe use platform; the system is set in the first area, including:

An encryption unit is used to encrypt the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files;

A key generation unit, configured to generate a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file generated by the encryption unit; wherein, the encrypted data file needs to be passed through the secure use of the platform, using said key file for access;

The certificate storage generation unit is configured to generate the certificate storage file according to the security management and control strategy configured for the encrypted data file generated by the encryption unit; wherein the security management and control strategy includes the respective access rights of the plurality of users;

a transmission unit, configured to transmit the encrypted data file and the key file to the target user through the gatekeeper; transmit the certificate storage file to the safe use platform through the gatekeeper, The safe use platform controls the use of the data in the encrypted data file by the target user according to the security management and control policy in the certificate storage file.

In the fourth aspect, a system for securely sharing data between the first area and the second area is provided, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the first area The second area is equipped with a safe use platform; the system is set in the second area, including:

The target user in the multiple users of the safe use platform is used to obtain the encrypted data file and the key file through the gatekeeper; wherein, the encrypted data file is obtained by encrypting the plaintext data in the first area; the The key file corresponds to the target user's target access authority to the encrypted data file; the encrypted data file needs to be accessed through the safe use platform using the key file;

The safe use platform is used to obtain the certificate storage file from the first area through the gatekeeper; the certificate storage file is generated according to the security management and control strategy configured for the encrypted data file, wherein the security management and control a policy comprising respective access rights of the plurality of users;

The target user is also used to issue a data usage request, requesting to use the key file to access the encrypted data file;

The secure use platform is further configured to control the target user's use of the data in the encrypted data file in response to the data use request according to the security management and control policy in the certificate storage file.

In a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed in a computer, it causes the computer to execute the method of the first aspect or the second aspect.

According to a sixth aspect, a computing device is provided, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect or the second aspect is implemented.

Through the method and system provided by the embodiment of this specification, physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is equipped with a safe use platform; in the first area, firstly, the shared Encrypt the plaintext data of multiple users of the secure use platform to generate encrypted data files; then generate corresponding key files according to the target access rights of the target users among the multiple users to the encrypted data files; wherein , the encrypted data file needs to be accessed through the safe use platform using the key file; then according to the security management and control strategy configured for the encrypted data file, a certificate file is generated; wherein the security management and control strategy includes The respective access rights of the multiple users; finally, the encrypted data file and the key file are transmitted to the target user through the network gatekeeper; the certificate storage file is transmitted to the target user through the network gatekeeper The safe use platform, so that the safe use platform controls the use of the data in the encrypted data file by the target user according to the security management and control policy in the certificate storage file. It can be seen from the above that in the embodiment of this specification, the first area does not directly transmit the plaintext data to the second area, but encrypts the plaintext data, generates encrypted data files, and generates key files corresponding to the target user's target access rights , and generate a certificate file according to the security management and control strategy, and then transmit the encrypted data file, the key file and the certificate file to the second area through the gatekeeper, so that the safe use platform Controlling the target user's use of the data in the encrypted data file realizes that the data is available and invisible, and can improve the data owner's ability to control the shared data, thereby taking into account both data sharing and data security.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For Those of ordinary skill in the art can also obtain other drawings based on these drawings without making creative efforts.

Figure 1 is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

Fig. 2 shows a schematic diagram of interaction between a method for securely sharing data between a first area and a second area according to an embodiment;

Fig. 3 shows a schematic flowchart of a method for securely sharing data between regions applied to a power grid according to an embodiment;

Fig. 4 shows a schematic block diagram of a system for securely sharing data between a first area and a second area according to an embodiment;

Fig. 5 shows a schematic block diagram of a system for securely sharing data between a first area and a second area according to another embodiment.

Detailed ways

The solutions provided in this specification will be described below in conjunction with the accompanying drawings.

Fig. 1 is a schematic diagram of an implementation scene of an embodiment disclosed in this specification. This implementation scenario involves data security sharing between the first area and the second area, that is to say, both data sharing and data security need to be considered. Referring to Fig. 1, physical isolation is adopted between the first area and the second area, and a gatekeeper is provided; the second area is provided with a safe use platform. Among them, the gatekeeper is an information security device that uses a solid-state switch with multiple control functions to read and write media and connects two independent host systems. Since the two independent host systems are isolated by the gatekeeper, there is no physical connection, logical connection and information transmission protocol for communication between the systems, and there is no information exchange based on the protocol, but only non-protocol ferry in the form of data files . Therefore, the gatekeeper logically isolates and blocks all network connections that may potentially attack the internal network, making it impossible for external attackers to directly invade, attack or destroy the internal network, thereby ensuring the security of internal hosts.

In the embodiment of this specification, the first area does not directly transmit the plaintext data to be shared with multiple users of the safe use platform to the second area, but encrypts the above plaintext data to generate encrypted data files; and according to the The target user in the multiple users generates a corresponding key file for the target access authority of the encrypted data file; and generates a deposit file according to the security management and control strategy configured for the encrypted data file; and then stores the encrypted data The file and the key file are transmitted to the target user through the gatekeeper; the certificate storage file is transmitted to the safe use platform through the gatekeeper, so that the safe use platform can The security management and control policy in the certificate file controls the use of the data in the encrypted data file by the target user. Through the above method, data is shared between the data owner and the data user, and the data owner controls the data use of the data user, which can improve the data owner’s ability to control the shared data, thus taking into account Data sharing and data security.

It should be noted that although only the target user is shown in Figure 1, the data in the first area can be shared with multiple users of the safe use platform, since each user may have different access rights to the aforementioned encrypted data files, Therefore, a key file corresponding to a corresponding access right needs to be generated for each user, that is, the key file obtained by each user may be different.

Fig. 2 shows a schematic diagram of interaction between a method for data security sharing between a first area and a second area according to an embodiment. The method may be based on the implementation scenario shown in Fig. 1, and the first area and the second area adopt Physical isolation is provided, and a gatekeeper is set; the second area is provided with a safe use platform; the method is jointly executed by the first area and the second area, and it should be noted that the first area mentioned in the embodiment of this specification The second area and the second area may be artificially divided functional areas, which may be physically composed of one or more independent host systems. As shown in Figure 2, the method for data security sharing between the first area and the second area in this embodiment includes the following steps: Step 21, the first area is to be shared with the plaintext data of multiple users of the safe use platform Encrypt to generate an encrypted data file; step 22, the first area generates a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file; wherein, the encrypted data file needs to pass The safe use platform uses the key file to access; step 23, the first area generates a certificate file according to the security management and control strategy configured for the encrypted data file; wherein the security management and control strategy includes the multiple Each user's respective access rights; Step 24, the first area transmits the encrypted data file and the key file to the target user through the gatekeeper; Step 25, the first area transfers the document for depositing the certificate. , transmitted to the safe use platform through the gatekeeper; step 26, the target user sends a data use request, requesting to use the key file to access the encrypted data file; step 27, the safe use platform responds to the data use requesting to control the target user's use of the data in the encrypted data file according to the security management and control policy in the certificate storage file. The specific implementation manner of each of the above steps is described below.

First, in step 21, the first area encrypts the plaintext data to be shared with multiple users of the secure use platform to generate encrypted data files. It can be understood that the above-mentioned encrypted data files can be provided to multiple users of the safe use platform.

In an example, the security level of the first area is higher than that of the second area.

In this example, since the first region has a higher security level, while sharing the data with the second region, it is also necessary to ensure that the use of the data by the second region is controllable to ensure data security.

In one example, the encryption of the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files includes:

Encrypt the plaintext data file to generate the encrypted data file.

Then in step 22, the first area generates a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file; wherein, the encrypted data file needs to pass through the safe use platform , using the key file for access. It is understandable that the target user's use of encrypted data files not only depends on the key file, but also depends on the safe use platform.

In an example, the encrypted data file is encrypted with an initial key; the key file includes a derived key obtained using the initial key.

In this example, after the target user obtains the encrypted data file and the key file, he cannot use the key file to restore the encrypted data file to plaintext data, thereby ensuring that the users in the second area can not see the shared data in the first area.

In an example, the target access right is the access right to the target field of the encrypted data file, and the key file is used to decrypt the data usage result of the target field.

In this example, the encrypted data file includes multiple fields, and the target user may only have access rights to some of the fields.

Then in step 23, the first area generates a certificate file according to the security management and control policy configured for the encrypted data file; wherein the security management and control policy includes the respective access rights of the multiple users. It can be understood that the security management and control policy specifies how each user uses encrypted data files.

In one example, the access rights include at least one of the following:

For example, the data usage pattern indicates that only addition calculations are allowed, the data usage frequency indicates that the number of uses per year does not exceed 10,000 times, and the data usage control indicates that the results of data usage are desensitized and displayed.

In an example, the generation of the proof file according to the security management and control strategy configured for the encrypted data file includes:

In this example, the secure usage platform can decrypt the certificate file, and encrypt the security control policy to prevent other parties from tampering with the security control policy.

Then in step 24, the first region transmits the encrypted data file and the key file to the target user through the gatekeeper. It can be understood that when the encrypted data file needs to be shared with multiple users in the second area, the encrypted data file and the key file corresponding to each user need to be transmitted to each user through the gatekeeper. User, that is to say, different users may have different key files.

In the embodiment of this specification, for the same encrypted data file, multiple key files may be generated according to the respective access rights of different users, and each key file corresponds to the access rights of the corresponding users.

For example, in step 22, according to the access authority of user A to the encrypted data file, key file A is generated; according to the access authority of user B to the encrypted data file, key file B is generated; according to the access authority of user C to the encrypted data file , generate key file C. In step 24, the first area transmits the encrypted data file and key file A to user A through the network gatekeeper; the first area transmits the encrypted data file and key file B to user B through the network gatekeeper; The first area transmits the encrypted data file and the key file C to the user C through the gatekeeper.

Then in step 25, the first area transmits the certificate storage file to the safe use platform through the gatekeeper. It can be understood that the safe use platform is the medium for users to use encrypted data files, and the use of encrypted data files by users is controlled by relying on the safe use platform.

In one example, the method also includes:

The first area generates updated evidence storage files according to the updated security management and control strategy;

Then at step 26, the target user sends a data usage request, requesting to use the key file to access the encrypted data file. It can be understood that the specific user may be a device or a device cluster.

In this embodiment of the specification, an instruction may be issued manually to trigger the target user to issue a data usage request.

Finally, in step 27, the secure use platform controls the target user's use of the data in the encrypted data file in response to the data use request and according to the security management and control policy in the certificate storage file. It can be understood that the above control may include, but is not limited to, restrictions on data usage patterns, data usage frequency, and the like.

In an example, the second area further includes a blockchain network; the certificate deposit file is stored in the blockchain network by the safe use platform.

Blockchain technology is not a single information technology. It relies on existing peer-to-peer network communication technology, consensus algorithm, asymmetric encryption technology, data storage technology, etc., and adds original combinations and innovations to achieve new functions. The essence and core of the blockchain network is a distributed ledger. The transaction data in the network is packaged into blocks, stamped with digital watermarks, and linked to this ledger in chronological order. All nodes in the network hold a copy of the ledger , realize the synchronization between each other through the consensus protocol, and jointly maintain the update of the ledger. In addition, the blockchain uses mathematics or cryptography to realize that once the information stored in the ledger is recorded in the ledger, the record will never be modified, and the data can only be updated by adding blocks. Blockchain solves the pain points of many industries. It has the characteristics of distributed architecture, no trust, no tampering, no forgery, and easy traceability. It is considered to be expected to completely change the current business operation mode and create a new type of business model.

In one example, the method also includes:

In this example, the identity authentication of the target user may be performed, but not limited to, by means of adding an account number and a password.

In one example, the secure usage platform is deployed with a decryption toolkit;

The target user sends a data usage request, including:

The target user requests to invoke the decryption toolkit;

In an example, the controlling the use of data in the encrypted data file by the target user includes:

Further, the data usage includes query or dense state calculation.

It is understandable that the ciphertext result is a string of uninterpretable characters, unreadable and unusable; data usage control may need to convert the ciphertext result into a decrypted state, but it does not want to be directly displayed in plaintext, so another layer of detachment is added. sensitive control. For example, if the ciphertext result is "rasmuslerdorf", the plaintext result "1391000881" will be obtained after decryption, and the desensitized display will be "139****881".

In an example, the target access right is an access right for a target field of the encrypted data file, and the use of data is a data use for the target field.

In an example, the second area also includes a block chain network; the method also includes:

The safe use platform stores the certificate file in the block chain network;

Further, the method also includes:

Through the method provided by the embodiment of this specification, physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is equipped with a safe use platform; Safely use the plaintext data of multiple users of the platform to encrypt to generate an encrypted data file; then generate a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file; wherein, the The encrypted data file needs to be accessed through the safe use platform using the key file; then according to the security management and control strategy configured for the encrypted data file, a certificate file is generated; wherein the security management and control strategy includes the Multiple users' respective access rights; finally, the encrypted data file and the key file are transmitted to the target user through the gatekeeper; the certificate storage file is transmitted to the target user through the gatekeeper Safe use of the platform, so that the safe use of the platform controls the use of the data in the encrypted data file by the target user according to the security management and control policy in the certificate storage file. It can be seen from the above that in the embodiment of this specification, the first area does not directly transmit the plaintext data to the second area, but encrypts the plaintext data, generates encrypted data files, and generates key files corresponding to the target user's target access rights , and generate a certificate file according to the security management and control strategy, and then transmit the encrypted data file, the key file and the certificate file to the second area through the gatekeeper, so that the safe use platform Controlling the target user's use of the data in the encrypted data file realizes that the data is available and invisible, and can improve the data owner's ability to control the shared data, thereby taking into account both data sharing and data security.

Fig. 3 shows a schematic flowchart of a method for securely sharing data between regions applied to a power grid according to an embodiment. Referring to Fig. 3, physical isolation is adopted between the high security area and the low security area, and a gatekeeper is provided, wherein the high security area is equivalent to the aforementioned first area, and the low security area is equivalent to the aforementioned second area. The high-security area is equipped with a scheduling operation platform and a high-security area data source security adaptation platform. As a real-time data source, the scheduling operation platform can generate a variety of data, such as operation management data, operation data, event information data, and compliance with external data. 1. Market operation data, the above data can be used as plaintext data to be shared with users in the low security zone. The real-time data source access file generation system in the high-security area generates plaintext data files in the high-security area according to the predefined file generation format and file generation rules; the file generation system accesses the data source security adaptation platform in the high-security area, Encrypt to generate encrypted data files, that is, generate encrypted files, and generate key files according to the user's access rights to encrypted data files. Different rights of different users correspond to different key files, that is, data access key generation; According to the data management requirements of the district, configure security management and control policies for the encrypted data files shared this time, including data user permissions, such as data usage mode, data usage frequency, data usage control and other policy rules. After the security policy is configured, Generate a certificate file, that is, a credible certificate for authority records. One-way transmission of encrypted files, data access keys, and trusted certificates of authority records to the low-security area through the gatekeeper, and distributed to the corresponding system. The low-security area is equipped with a data security chain, a low-security area encrypted data security use platform (referred to as a safe use platform) and multiple users. The above-mentioned data security chain belongs to the blockchain network. The above-mentioned multiple users include the power grid management platform and customer service platform. and operation management platform. Safely use the platform to store the content in the authority record trusted certificate on the chain to ensure the security and auditability of the data. Users of each business system use the platform securely to judge authority based on the latest stored evidence on the chain, use keys to access encrypted data files according to authority, and perform encrypted state calculations and decrypt results.

The data owner in the high-security zone can transmit the updated permission records through the network gatekeeper at any time for credible deposit to ensure control over the data. The safe use platform can also generate trusted certificates of access records according to the user's use of encrypted data files, and store them on the chain to further ensure data security and auditability.

In the embodiment of this specification, through the data security chain set in the low security area, the safe sharing of data across the gatekeeper is realized, and the generation of trusted encrypted files and the setting and management of data access rights of data in the high security area are realized. Encrypted data files and keys Through the secure transmission of the gatekeeper to the low-security area, the low-security area accesses and calculates encrypted data based on data authorization, so that the data is available and invisible, taking into account the requirements of both data sharing and data security.

According to another embodiment, there is also provided a system for securely sharing data between the first area and the second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set The second area is provided with a safe use platform; the system is installed in the first area, and is used to execute the actions performed in the first area in the method provided by the embodiment of this specification. Fig. 4 shows a schematic block diagram of a system for securely sharing data between a first area and a second area according to an embodiment. As shown in Figure 4, the system 400 includes:

An encryption unit 41, configured to encrypt the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files;

The key generation unit 42 is used to generate a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file generated by the encryption unit 41; wherein, the encrypted data file needs to pass The safe use platform uses the key file to access;

A certificate generating unit 43, configured to generate a certificate file according to the security management and control strategy configured for the encrypted data file generated by the encryption unit 41; wherein the security management and control strategy includes the respective access rights of the plurality of users;

The transmission unit 44 is configured to transmit the encrypted data file and the key file to the target user through the gatekeeper; transmit the certificate storage file to the safe use platform through the gatekeeper so that the safe use platform controls the use of the data in the encrypted data file by the target user according to the security management and control policy in the certificate storage file.

Optionally, as an embodiment, the security level of the first area is higher than that of the second area.

Optionally, as an embodiment, the encrypted data file is encrypted with an initial key; the key file includes a derived key obtained using the initial key.

Optionally, as an embodiment, the target access authority is the access authority for the target field of the encrypted data file, and the key file is used to decrypt the data usage result of the target field.

Optionally, as an embodiment, the encryption unit 41 includes:

The generation subunit is used to treat the plaintext data shared by multiple users of the safe use platform, and generate the plaintext data file according to the predefined file generation format and file generation rules;

An encryption subunit is configured to encrypt the plaintext data file generated by the generating subunit to generate the encrypted data file.

Optionally, as an embodiment, the access rights include at least one of the following:

Optionally, as an embodiment, the certificate generating unit 43 is specifically configured to encrypt the security management and control policy to generate the certificate file.

Optionally, as an embodiment, the second area further includes a blockchain network; the certificate deposit file is stored in the blockchain network by the safe use platform.

Optionally, as an embodiment, the certificate generating unit 43 is further configured to generate an updated certificate file according to the updated security management and control policy;

The transmission unit 44 is also used to transmit the updated certificate storage file generated by the storage certificate generation unit 43 to the safe use platform through the gatekeeper, so that it can be controlled according to the security management and control in the updated certificate storage file. policies for security control.

According to another embodiment, there is also provided a system for securely sharing data between the first area and the second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set The second area is provided with a safe use platform; the system is installed in the second area, and is used to execute the actions performed by the second area in the method provided by the embodiment of this specification. Fig. 5 shows a schematic block diagram of a system for securely sharing data between a first area and a second area according to another embodiment. As shown in Figure 5, the system 500 includes:

The target user 51 in the plurality of users of the safe use platform is used to obtain encrypted data files and key files through the gatekeeper; wherein, the encrypted data files are obtained by encrypting the plaintext data in the first area; The key file corresponds to the target access authority of the target user 51 to the encrypted data file; the encrypted data file needs to be accessed through the safe use platform 52 using the key file;

The safe use platform 52 is used to obtain the certificate deposit file from the first area through the gatekeeper; the certificate deposit file is generated according to the security management and control strategy configured for the encrypted data file, wherein the security The management and control policy includes the respective access rights of the plurality of users;

The target user 51 is also used to issue a data usage request, requesting to use the key file to access the encrypted data file;

The secure use platform 52 is further configured to control the use of the data in the encrypted data file by the target user 51 in response to the data use request according to the security management and control policy in the certificate storage file.

Optionally, as an embodiment, the secure use platform 52 is also used to authenticate the target user 51, and control the target user 51 to verify the data in the encrypted data file if the authentication is passed. usage of.

Optionally, as an embodiment, the safe use platform 52 is deployed with a decryption toolkit;

The target user 51 sends a data usage request, including:

The target user 51 requests to call the decryption toolkit;

The control of the use of the data in the encrypted data file by the target user 51 includes:

Optionally, as an embodiment, the controlling the use of data in the encrypted data file by the target user 51 includes:

Obtain the target access authority corresponding to the target user 51 in the security management and control policy;

According to the target access authority, the key file is used to process the ciphertext result to obtain the data processing result fed back to the target user 51 .

Further, the data usage includes query or dense state calculation.

Further, the target access authority includes the data usage frequency allowed by the target user 51;

According to the target access authority, using the key file to perform result processing on the ciphertext result, and obtain the data processing result fed back to the target user 51, including:

Optionally, as an embodiment, the target access right is an access right for a target field of the encrypted data file, and the use of data is a data use for the target field.

Optionally, as an embodiment, the second area also includes a block chain network; the safe use platform 52 is also used to store the certificate deposit file in the block chain network;

The safe use platform 52 reads the certificate deposit file from the block chain network in response to the data use request.

Further, the safe use platform 52 is also used to obtain an updated certificate file from the first area through the gatekeeper, and store the updated file in the block chain network;

According to another embodiment, there is also provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method described in conjunction with FIG. 2 or FIG. 3 .

According to yet another embodiment, there is also provided a computing device, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the implementation in conjunction with FIG. 2 or FIG. 3 is realized. method described.

Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present invention may be implemented by hardware, software, firmware or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, any modification, equivalent replacement, improvement, etc. made on the basis of the technical solution of the present invention shall be included in the protection scope of the present invention.

Claims

A method for safely sharing data between a first area and a second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is set with a security use platform; said method is performed in a first zone, comprising:

Encrypt the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files;

Generate a corresponding key file according to the target user's target access authority to the encrypted data file among the multiple users; wherein, the encrypted data file needs to be processed through the secure use platform using the key file access;

Generate a certificate file according to the security management and control policy configured for the encrypted data file; wherein, the security management and control policy includes the respective access rights of the multiple users;

transmitting the encrypted data file and the key file to the target user through the gatekeeper;

transmitting the certificate storage file to the safe use platform through the gatekeeper, so that the safe use platform controls the target user to encrypt the encrypted Use of Data in Data Files.
The method of claim 1, wherein the first area has a higher security level than the second area.
The method according to claim 1, wherein the encrypted data file is encrypted with an initial key; and the key file contains a derived key obtained using the initial key.
The method according to claim 1, wherein the target access authority is the access authority for the target field of the encrypted data file, and the key file is used to decrypt the data usage result of the target field.
The method according to claim 1, wherein said encrypting the plaintext data to be shared with multiple users of said safe use platform to generate encrypted data files comprises:

For the plaintext data shared with multiple users of the safe use platform, generate a plaintext data file according to the predefined file generation format and file generation rules;

Encrypt the plaintext data file to generate the encrypted data file.
The method of claim 1, wherein the access rights include at least one of the following:

The data usage pattern used to indicate the type of operation allowed, the frequency of data usage, and the data usage control used to indicate whether the result of data usage is displayed in plain text or desensitized.
The method according to claim 1, wherein said generating a certificate file according to the security management and control strategy configured for said encrypted data file comprises:

The security management and control policy is encrypted to generate the certificate file.
The method according to claim 1, wherein, the second area also includes a block chain network; the document for depositing evidence is stored in the block chain network by the safe use platform.
The method of claim 1, wherein the method further comprises:

According to the updated security management and control strategy, an updated evidence storage file is generated;

The updated certificate storage file is transmitted to the safe use platform through the gatekeeper, so that it can perform security management and control according to the security management and control strategy in the updated certificate storage file.
A method for safely sharing data between a first area and a second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is set with a security use platform; said method is performed in a second region, comprising:

The target user in the multiple users of the safe use platform obtains the encrypted data file and the key file through the gatekeeper; wherein, the encrypted data file is obtained by encrypting the plaintext data in the first area; the key file Corresponding to the target access authority of the target user to the encrypted data file; the encrypted data file needs to be accessed through the safe use platform using the key file;

The safe use platform obtains the certificate storage file from the first area through the gatekeeper; the certificate storage file is generated according to the security management and control strategy configured for the encrypted data file, wherein the security management and control strategy includes the Describe the respective access rights of multiple users;

The target user sends a data usage request, requesting to use the key file to access the encrypted data file;

In response to the data use request, the secure use platform controls the target user's use of the data in the encrypted data file according to the security management and control policy in the certificate storage file.
The method of claim 10, wherein the method further comprises:

The safe use platform performs identity authentication on the target user, and controls the target user's use of the data in the encrypted data file when the authentication is passed.
The method of claim 10, wherein the secure usage platform is deployed with a decryption toolkit;

The target user sends a data usage request, including:

The target user requests to invoke the decryption toolkit;

The controlling the use of the data in the encrypted data file by the target user includes:

By running the decryption toolkit, the use of data in the encrypted data file is controlled according to the security management policy and by using the key file.
The method according to claim 10, wherein said controlling said target user's usage of data in said encrypted data file comprises:

Obtain the target access authority corresponding to the target user described in the security management and control policy;

According to the target access authority, perform data use on the encrypted data file to obtain a ciphertext result;

According to the target access authority, the key file is used to perform result processing on the ciphertext result to obtain a data processing result fed back to the target user.
The method of claim 13, wherein the data usage includes queries or dense state computations.
The method of claim 13, wherein the target access rights include data usage patterns indicating the types of operations the target user is permitted to perform;

According to the target access authority, performing data use on the encrypted data file to obtain a ciphertext result includes:

Perform the encrypted state calculation of the operation type on the encrypted data file to obtain the ciphertext result.
The method according to claim 13, wherein the target access rights include data usage frequency allowed by the target user;

According to the target access authority, performing data use on the encrypted data file to obtain a ciphertext result includes:

When the current usage frequency is not higher than the allowed data usage frequency, data usage is performed on the encrypted data file.
The method of claim 13, wherein the target access rights include data usage controls showing permission to display data usage results in clear text;

According to the target access authority, using the key file to perform result processing on the ciphertext result to obtain a data processing result fed back to the target user, including:

Using the key file to decrypt the ciphertext result to obtain a plaintext result as the data processing result.
The method of claim 13, wherein the target access rights include data usage controls showing data usage results in a desensitized manner;

According to the target access authority, using the key file to perform result processing on the ciphertext result to obtain a data processing result fed back to the target user, including:

Decrypting the ciphertext result by using the key file to obtain a plaintext result;

Desensitization is performed on the plaintext result to obtain a desensitization result as the data processing result.
The method of claim 10, wherein the target access rights are access rights to a target field of the encrypted data file, and the use of data is data usage for the target field.
The method of claim 10, wherein the second area also includes a block chain network; the method also includes:

The safe use platform stores the certificate file in the block chain network;

The safe use platform reads the certificate deposit file from the block chain network in response to the data use request.
The method of claim 20, wherein said method further comprises:

The safe use platform obtains an updated certificate file from the first area through the gatekeeper, and stores the updated file in the block chain network;

The reading of the certificate storage file from the blockchain network includes: reading the latest recorded certificate storage file in the blockchain network as the certificate storage file.
A system for safely sharing data between a first area and a second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is set with a security use Platform; the system is set in the first area, including:

An encryption unit is used to encrypt the plaintext data to be shared with multiple users of the safe use platform to generate encrypted data files;

A key generation unit, configured to generate a corresponding key file according to the target access authority of the target user among the multiple users to the encrypted data file generated by the encryption unit; wherein, the encrypted data file needs to be passed through the secure use of the platform, using said key file for access;

The certificate storage generation unit is configured to generate the certificate storage file according to the security management and control strategy configured for the encrypted data file generated by the encryption unit; wherein the security management and control strategy includes the respective access rights of the plurality of users;

a transmission unit, configured to transmit the encrypted data file and the key file to the target user through the gatekeeper; transmit the certificate storage file to the safe use platform through the gatekeeper, The safe use platform controls the use of the data in the encrypted data file by the target user according to the security management and control policy in the certificate storage file.
A system for safely sharing data between a first area and a second area, wherein physical isolation is adopted between the first area and the second area, and a gatekeeper is set; the second area is set with a security use platform; the system is set in the second area, including:

The target user among the multiple users of the safe use platform is used to obtain the encrypted data file and the key file through the gatekeeper; wherein, the encrypted data file is obtained by encrypting the plaintext data in the first area; the The key file corresponds to the target user's target access authority to the encrypted data file; the encrypted data file needs to be accessed through the safe use platform using the key file;

The safe use platform is used to obtain the certificate storage file from the first area through the gatekeeper; the certificate storage file is generated according to the security management and control strategy configured for the encrypted data file, wherein the security management and control a policy comprising respective access rights of the plurality of users;

The target user is also used to issue a data usage request, requesting to use the key file to access the encrypted data file;

The secure use platform is further configured to control the target user's use of the data in the encrypted data file in response to the data use request according to the security management and control policy in the certificate storage file.
A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, it causes the computer to perform the method described in any one of claims 1-21.
A computing device, comprising a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, the method according to any one of claims 1-21 is realized.