CN113849558B - Method and device for deploying data sharing service - Google Patents

Abstract

One or more embodiments of the present specification provide a method and apparatus for deploying a data sharing service, wherein the method comprises: receiving a service deployment request from a data provider, wherein the service deployment request comprises shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration strategy; deploying a callable data sharing service based on the configuration information, wherein the data sharing service is used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration strategy.

Description

A method and device for deploying data sharing services

Technical Field

One or more embodiments of the present specification relate to the field of data sharing technology, and more particularly, to a method and apparatus for deploying a data sharing service.

Background Art

With the development of informatization, more and more enterprises or individuals have established an independent information system. However, different information systems are isolated from each other, which has formed a large number of information islands in the network information space.

In the related art, if an information system wishes to achieve data sharing, it is necessary to establish a secure communication connection between the information system as the sharing party and the shared party, and send the data that the sharing party needs to share to the shared party through the pre-established secure communication connection.

Summary of the invention

One or more embodiments of this specification provide a method, device, electronic device, and storage medium for obtaining blockchain data.

According to a first aspect of one or more embodiments of this specification, a method for deploying a data sharing service is proposed, which is applied to a server and includes:

Receive a service deployment request from a data provider, the service deployment request including shared data set information and configuration information, the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration strategy;

A callable data sharing service is deployed based on the configuration information. The data sharing service is used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy.

According to a second aspect of one or more embodiments of this specification, a device for deploying a data sharing service is proposed, which is applied to a server and includes:

a request receiving unit, configured to receive a service deployment request from a data provider, wherein the service deployment request includes shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration strategy;

A service deployment unit is used to deploy a callable data sharing service based on the configuration information. The data sharing service is used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy.

According to a third aspect of one or more embodiments of this specification, an electronic device is provided, including:

A processor; a memory for storing processor executable instructions; wherein the processor implements the steps of the above-mentioned method for deploying data sharing services by running the executable instructions.

According to a fourth aspect of one or more embodiments of the present specification, a computer-readable storage medium is proposed, on which executable instructions are stored; wherein, when the instructions are executed by a processor, the steps of the above-mentioned method for deploying a data sharing service are implemented.

It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present specification.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

FIG1 is a schematic diagram of a blockchain-related network environment provided in this specification.

FIG. 2 is a network architecture diagram provided in this specification according to an exemplary embodiment.

FIG. 3 is a flow chart of a method for deploying a data sharing service provided in this specification according to an exemplary embodiment.

FIG. 4 is a flowchart of another method for deploying a data sharing service provided by this specification according to an exemplary embodiment.

FIG. 5 is a schematic structural diagram of a device provided by an exemplary embodiment.

FIG6 is a block diagram of an apparatus for deploying a data sharing service according to an exemplary embodiment of the present specification.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with one or more embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

It should be noted that: in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may be combined into a single step for description in other embodiments.

Please refer to Figure 1, which is a schematic diagram of a network environment related to blockchain shown in this specification.

In the network environment shown in FIG. 1 , a client-side computing device 101 , a server 102 , and at least one blockchain system may be included; for example, blockchain system 103 , blockchain system 104 , and blockchain system 105 .

In one embodiment, the client-side computing device 101 may include various types of client-side computing devices; for example, the client-side terminal device may include PC terminal devices, mobile terminal devices, Internet of Things devices, and other forms of smart devices with certain computing capabilities, etc.

In one implementation, at least some of the computing devices in the client-side terminal device 101 may be connected to the server 102 via various communication networks; for example, device 1 and device 2 shown in FIG. 1 are connected to the server 102 .

It is not difficult to understand that some of the client-side terminal devices 101 may not be connected to the server-side 102, but may be directly connected to the blockchain system through various communication networks as blockchain nodes; for example, the device 4 shown in FIG. 1 may be connected to the blockchain system as a blockchain node.

Among them, the above-mentioned communication network may include wired and/or wireless communication networks; for example, it may be a local area network (LAN), a wide area network (WAN), the Internet or a combination thereof implemented based on a wired access network or a wireless access network (such as a mobile cellular network) provided by an operator.

In one embodiment, the client-side computing device 101 may further include one or more user-side servers; for example, device 5 shown in FIG1 . At least some computing devices in the client-side terminal device 101 may be connected to the user-side server, and the user-side server may be further connected to the above-mentioned service end 102; for example, device 1 and device 2 shown in FIG1 are connected to device 5, and device 5 is further connected to the server end 102.

In one implementation, the user-side server may be implemented by a service entity that has built a user account system; the service entity may include an operating entity of a service carrier that provides various online and/or offline services to users;

The above service carrier may include a service carrier in the form of software or a service carrier in the form of hardware.

In one embodiment, the above-mentioned service carrier may include various client software that provides online Internet services; for example, a website, a webpage, an APP, etc.

In one embodiment, the above-mentioned service carrier may also include various smart devices deployed offline that can provide offline services; for example, smart express cabinets deployed in residential areas, office areas, and public places.

Correspondingly, the above-mentioned operating entity may include the operator corresponding to the above-mentioned service carrier; for example, the above-mentioned operating entity may include individuals, organizations, companies and enterprises that operate and manage the above-mentioned service carrier, etc.

In one embodiment, the server end 102 can also be connected to one or more blockchain systems through various communication networks; for example, the server end 102 shown in Figure 1 can be connected to blockchain system 103, blockchain system 104 and blockchain system 105, etc.

In one embodiment, each blockchain system can maintain one or more blockchains (e.g., public blockchains, private blockchains, alliance blockchains, etc.), and include multiple blockchain nodes for carrying the above one or more blockchains; for example, blockchain node 1, blockchain node 2, blockchain node 3, blockchain node 4, blockchain node i, etc. shown in FIG. 1 can jointly carry one or more blockchains. Cross-chain data access can also be performed between the blockchains included in each blockchain system and between each blockchain system.

In one embodiment, the blockchain node may include a full node and a light node. The full node may download all blockchain transactions contained in each block in the blockchain, and may perform consensus verification on the blockchain transactions contained in each blockchain according to the blockchain consensus algorithm installed.

Instead of downloading the entire blockchain, a light node can only download the block header data of each block in the blockchain and use the data contained in the block header as a verification root to verify the authenticity of blockchain transactions. Light nodes can be attached to full nodes to access more functions of the blockchain.

For example, each blockchain node in the blockchain system 103 shown in Figure 1 can be used as a full node; and the device 4 directly connected to the blockchain system shown in Figure 1 can be used as a light node, attached to each full node in the blockchain system 103.

In one embodiment, a blockchain node may be a physical device or a virtual device implemented in a server or server cluster;

For example, a blockchain node device can be a physical host in a server cluster, or a virtual machine created by virtualizing the hardware resources of a server or server cluster based on virtualization technology. Each blockchain node can be connected to form a network through various types of communication methods (such as TCP/IP) to carry one or more blockchains.

In one embodiment, the server 102 may include a BaaS platform (also referred to as a BaaS cloud) for providing blockchain as a service (BaaS, Blockchain as a Service). The BaaS platform can provide pre-written software for activities occurring on the blockchain (such as subscriptions and notifications, user verification, database management and remote updates), and provide easy-to-use, one-click deployment, fast verification, and flexible and customizable blockchain services for client-side computing devices connected to the BaaS platform, thereby accelerating the development, testing, and launch of blockchain business applications, and helping the implementation of blockchain business application scenarios in various industries.

For example, in one example, the BaaS platform can provide software such as MQ (Message Queue) services; the client-side computing device connected to the BaaS platform can subscribe to a smart contract deployed on a blockchain in the blockchain system connected to the BaaS platform, and the contract events generated on the blockchain after the execution is triggered; and the BaaS platform can monitor the events generated on the blockchain after the smart contract is triggered, and then based on the software related to the MQ service, add the contract events to the message queue in the form of notification messages, so that the client-side computing device that subscribes to the message queue can obtain notifications related to the above contract events.

In one embodiment, the BaaS platform can also provide enterprise-level platform services based on blockchain technology to help enterprise-level customers build a secure and stable blockchain environment and easily manage the deployment, operation, maintenance and development of blockchain.

For example, in one example, the BaaS platform can implement rich security policies and multi-tenant isolation environments based on cloud technology, provide advanced security protection based on chip encryption technology, and provide end-to-end high-availability services that can be quickly expanded without interruption based on highly reliable data storage;

In another example, enhanced management capabilities can also be provided to help customers build an enterprise-level blockchain network environment; and native support can be provided for standard blockchain applications and data, supporting mainstream open source blockchain technologies such as Hyperledger Fabric and Enterprise Ethereum-Quorum to build an open and inclusive technology ecosystem.

In the embodiments of the present specification, the server side 102 is deployed with several data sharing services for the client side computing device 101 to call, and these data sharing services are also deployed on the server side 102 by the client side computing device 101 sending a service deployment request. For example, device 5 as the client side computing device 101 can deploy a new data sharing service on the server side 102, and device 3 as the client side computing device 101 can call the data sharing service deployed by device 5 to obtain the configured shared data obtained by configuring the shared data shared by device 5 from the server side 102, thereby realizing the sharing of data with customized configuration. From another perspective, this is equivalent to the server side 102 shown in FIG. 1 being regarded as the server side involved in the present specification, the device 5 in the client side computing device 101 directly connected to the server side 102 being regarded as the data provider involved in the present specification, and the device 3 directly connected to the server side 102 being regarded as the service caller involved in the present specification.

FIG2 is a network architecture diagram according to an exemplary embodiment of the present specification, wherein the network architecture includes a server side with several data sharing services deployed, several service callers and several data providers, wherein the data sharing services 1-3 may be deployed by three data providers 1-3 respectively, or may be deployed by only one data provider 1, 2 or 3, or may be deployed by the server side itself; the service callers 1-3 may send a service call request to the server side to indicate the data sharing service to be called, and the server side then executes the corresponding data sharing service, and encrypts the shared data required by the service caller and provides it to the service caller that calls the data sharing service. The server side may receive service deployment requests from multiple data providers in parallel to deploy multiple data sharing services at the same time, and the server side may also receive service call requests from multiple service callers in parallel to execute multiple identical or different data sharing services at the same time.

FIG3 is a flow chart of a method for deploying a data sharing service according to an exemplary embodiment of the present specification. The method is applied to the server shown in FIG2 , and the method includes the following steps:

S302: Receive a service deployment request from a data provider, wherein the service deployment request includes shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration strategy;

S304: Deploy a callable data sharing service based on the configuration information, the data sharing service being used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy.

Through the method of deploying data sharing services involved in the embodiments of this specification, the data provider can flexibly configure according to the actual needs of the business scenario, and the service caller can also flexibly call according to its own needs, so as to reduce the complexity of the data sharing service as much as possible while meeting the calling requirements of the service caller, and save the computing resources or storage resources required for the deployment and maintenance of the data sharing service.

Optionally, the shared data set information may be the shared data set itself, so when the server receives the service deployment request from the service caller, it will also obtain the complete shared data set from the service deployment request to store it in the cloud storage space of the server, and bind the shared data set to the data sharing service that is subsequently successfully deployed according to the service call request, so that when the data sharing service is called, it can obtain the shared data set bound to the data sharing service from the cloud storage space. In this embodiment, since the shared data set has been pre-stored on the server, the shared data set can be obtained more quickly, thereby speeding up the execution process when the data sharing service is called; in another embodiment, the shared data set information may be metadata corresponding to the shared data set, and the server may obtain the shared data set through the metadata. For example, the metadata may be the IP address and port information of a database table maintained by the data provider, and the shared data set is stored in the database table. The server may download the complete shared data set from the database table at any time through the IP address and port information of the database table. In this embodiment, the server may obtain the corresponding shared data set from the data provider through the metadata in real time when the data sharing service is called, so the server does not need to store the shared data set in the cloud, thereby saving storage resources.

Optionally, the configuration information also includes a data flow strategy, which is used to configure a data flow mode of the data sharing service for the configured shared data, and the data flow mode includes an API (Application Programming Interface) gateway mode or a database table mode; when the data flow mode of the data sharing service is an API gateway mode, the configured shared data is provided to the client of the service caller through the API gateway of the server; when the data flow mode of the data sharing service is a database table mode, the configured shared data is provided to the database of the service caller through a database synchronization plug-in.

In the embodiments of this specification, the data provider can flexibly configure the data flow mode of the data sharing service to adapt to different actual service call scenarios. Among them, when the data flow mode of the data sharing service is the API gateway mode, the server maintains an API gateway for the service caller to call, and the service caller can access the API gateway through the client, thereby sending the service call request to the server. Similarly, the server will also provide the prepared shared data after configuration to the client of the service caller through the API gateway. In the case where the data flow mode of the data sharing service is a database table mode, after receiving the service call request from the service caller, the server will directly provide the prepared shared data after configuration to the database of the service caller through the database synchronization plug-in. The database synchronization plug-in involved in the embodiments of this specification may include a DataX plug-in deployed on the server. In one embodiment, the data sharing service instance involved in this application is implemented based on SpringBoot. Therefore, when the data flow mode of the data sharing service is configured on the server, it can be configured by injecting system environment variables, or it can be configured by an external application-profile.properties file.

Optionally, the configuration information also includes a rights management policy, which is used to configure the rights management model of the data sharing service for the service caller, so that the data sharing service is used to respond to the service call request issued by the service caller when it is determined that the service caller has the right to call the data sharing service. The rights management model includes an OpenAPI (open application programming interface) model or an IAM (Identity and Access Management) model. Management, Identity Identification and Access Management) model; the determining that the service caller has the right to call the data sharing service includes: when the permission management model of the data sharing service is an OpenAPI model, verifying the signature contained in the service call request according to the public key in the public key list corresponding to the data sharing service, and when the verification is successful, determining that the service caller has the right to call the data sharing service. For example, for a certain service caller, it first needs to sign the service call request according to its own private key, and send the service call request carrying the signature to the server. The server will find the corresponding public key list according to the data sharing service to be called by the service call request, and then verify the signatures carried in the service call request one by one according to the several public keys in the public key list. As long as there is a public key that succeeds in the verification, it can be determined that the service caller has the right to call the data sharing service; When the permission management model of the data sharing service is an IAM model, the service permission list corresponding to the service caller in the logged-in state is queried, and when the data sharing service is included in the service permission list, it is determined that the service caller has the calling permission for the data sharing service. For example, for a certain service caller, it first needs to log in to access the server. After the login is successful, the server will check the service permission list corresponding to the service caller. The service permission list records the service ID of each data sharing service that can be called by the service caller. Therefore, the services that the service caller can call can be displayed to the client corresponding to the service caller. The service caller then initiates a service call request for a certain data sharing service through the client, so that the server can further determine whether the service caller has the calling permission for the data sharing service based on whether the service ID of the data sharing service to be called by the service call request is included in the service permission list.

In the embodiments of this specification, the data provider can flexibly configure the authority management model of the data sharing service, thereby requiring different authentication methods from the service caller to better adapt to different actual service call scenarios and meet the needs of all parties.

Optionally, the permission management policy is also used to configure the data sharing service for a list of legal callers of service callers. For example, if the permission management policy carries a list of legal callers for service callers, then when the permission management model of the data sharing service is an OpenAPI model, several public keys are recorded in the legal caller list, so that when the server deploys the data sharing service, the several public keys recorded in the legal caller list are written into the public key list corresponding to the data sharing service; when the permission management model of the data sharing service is an IAM model, the legal caller list records the ID information of several service callers, so that when the server deploys the data sharing service, it finds the service permission list corresponding to each service caller according to the ID information of several service callers recorded in the legal caller list, and writes the service ID of the data sharing service into the service permission list corresponding to each service caller.

In the embodiment of the present specification, the data provider can flexibly configure the list of legal callers of the data sharing service, thereby limiting the service callers who can call the data sharing service to ensure that the data provider can freely determine the service objects of the data sharing service.

Optionally, it also includes: calling a blockchain evidence service to store the service deployment request and/or service call request on the chain. In the embodiment of this specification, by deploying a blockchain evidence service on the server, the server can store the entire life cycle of the data sharing service to ensure the transparency and traceability of data and operations in the system.

In another embodiment, the preset configuration strategy includes a data security policy, which includes at least one encryption method for encrypting the shared data in the shared data set, and the at least one encryption method includes a homomorphic encryption method. Taking Figure 2 as an example, device 5 as a client-side computing device 101 can deploy a new data sharing service on the server side 102, and device 3 as a client-side computing device 101 can call the data sharing service deployed by device 5 to obtain encrypted data obtained by encrypting the shared data shared by device 5 from the server side 102, thereby realizing privacy computing based on encrypted data. The specific execution process of this embodiment will be discussed in detail below.

FIG4 is a flowchart of another method for deploying a data sharing service according to an exemplary embodiment of the present specification. The method is applied to the server shown in FIG2 , and the method includes the following steps:

S402: Receive a service deployment request from a data provider, wherein the service deployment request includes shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information includes a data security policy, and the data security policy includes at least one encryption method for encrypting shared data in the shared data set, wherein the at least one encryption method includes a homomorphic encryption method.

In the embodiments of the present specification, the service caller as a client locally maintains a SDK (Software Development Kit) or UDF (User defined function) in advance for the use of encrypted data. The use of encrypted data involved in the embodiments of the present specification includes three types of ciphertext retrieval, ciphertext calculation and ciphertext decryption. Among them, ciphertext retrieval and ciphertext calculation can be completed locally by the service caller after obtaining the encrypted data provided by the server, while ciphertext decryption may require the service caller to interact with the server for a second time to be realized. For example, for a service caller that does not involve a TEE (Trusted Execution Environment) architecture, if it is necessary to decrypt certain encrypted data, a decryption request for the encrypted data must be initiated to the server. After the server is successfully authenticated, the encrypted data will be decrypted by the server or the service caller and finally provided to the service caller.

The trusted execution environment (TEE) involved in the embodiments of this specification can provide a secure execution environment for software. TEE is a trusted execution environment based on the security extension of CPU hardware and completely isolated from the outside. TEE was first proposed by Global Platform to solve the security isolation of resources on mobile devices and provide a trusted and secure execution environment for applications in parallel with the operating system. At present, the industry is paying close attention to the TEE solution. Almost all mainstream chip and software alliances have their own TEE solutions, such as TPM (Trusted Platform Module) in software and Intel SGX, ARM Trustzone (Trust Zone) and AMD PSP (Platform Security Processor) in hardware.

Take Intel SGX (hereinafter referred to as SGX) technology as an example. Trusted computing nodes can create enclaves (enclaves or enclaves) based on SGX technology as TEEs for executing blockchain transactions. Among them, blockchain nodes use the newly added processor instructions in the CPU to allocate a part of the area EPC (Enclave Page Cache, enclave page cache or enclave page cache) in the memory to reside in the above enclave. The memory area corresponding to the above EPC is encrypted by the memory encryption engine MEE (Memory Encryption Engine) inside the CPU. The content in this memory area (code and data in the enclave) can only be decrypted in the CPU core, and the key used for encryption and decryption is only generated and stored in the CPU when the EPC is started. It can be seen that the security boundary of the enclave only includes itself and the CPU. No privileged or non-privileged software can access the enclave. Even the operating system administrator and VMM (virtual machine monitor; also known as Hypervisor) cannot affect the code and data in the enclave. Therefore, it has extremely high security. Under the premise of the above security guarantee, the CPU can process blockchain transactions in plain text in the enclave with extremely high computing efficiency, thus taking into account both data security and computing efficiency.

In the embodiments of this specification, the data provider as a client can actively apply to the server to deploy a data sharing service. To this end, the data provider needs to carry shared data set information and configuration information in the service deployment request sent to the server, wherein the shared data set information is used to describe the shared data set maintained by the data provider, and the configuration information is used to configure the data sharing service that the data provider needs to deploy. The shared data set involved in the embodiments of this specification is a collection of shared data that the data provider wants to share, and the shared data in the shared data set is in plain text.

In an embodiment of the present specification, the configuration information includes a data security policy, and the data security policy includes at least one encryption method for encrypting the shared data in the shared data set, and the at least one encryption method includes a homomorphic encryption method. The homomorphic encryption methods involved in the embodiments of the present specification may include BFV (fully homomorphic encryption algorithm), CKKS (approximate computational homomorphic encryption algorithm) and SM4 (block cipher algorithm), etc., and the encrypted data encrypted by different homomorphic encryption methods support different types of ciphertext calculations. For example, the encrypted data encrypted by BFV supports ciphertext calculations such as substrings, concatenation of two ciphertext strings, and case conversion. The encrypted data encrypted by CKKS supports ciphertext calculations such as addition, subtraction, multiplication, division, power function, exponential function, and logarithmic function. The encrypted data encrypted by SM4 supports ciphertext calculations such as year, month, day, hour, minute, and second of the date. Since in the embodiment of the present specification, the data provider can specify one or more homomorphic encryption methods in the data security policy of the configuration information, and the encrypted data encrypted by different homomorphic encryption methods supports different types of ciphertext calculations, the data provider can control the encryption method of the shared data in the shared data set to limit the ciphertext calculation type of the encrypted data finally provided to the service caller, which is equivalent to the data provider being able to configure the ciphertext calculation type corresponding to the deployed data sharing service. Therefore, the service caller can view the description information of the data sharing service deployed on the server to learn the ciphertext calculation type that the data sharing service can support, so that when requesting the data sharing service from the server, it can choose from the ciphertext calculation type that the data sharing service can support, and then obtain the required encrypted data to perform the corresponding type of ciphertext calculation. In the embodiment of the present specification, the data provider can be flexibly configured according to the actual needs of the business scenario, so as to reduce the complexity of the data sharing service as much as possible while meeting the calling requirements of the service caller, and save the computing resources or storage resources required for the data sharing service to be consumed during deployment and maintenance.

In one embodiment of the specification, the data security policy also includes at least one retrieval method for generating a retrieval index for encrypted data. The retrieval methods involved in the embodiment of the specification may include a congruent query and a fuzzy query, wherein the congruent query can retrieve encrypted data that completely matches the retrieval keyword, and the fuzzy query can retrieve encrypted data that partially matches or has a correlation with the retrieval keyword. Since in the embodiment of the specification, the data provider can specify one or more retrieval methods in the data security policy of the configuration information, so that the encrypted data generates different types of retrieval indexes through different retrieval methods for different retrieval methods. Therefore, the data provider can control the generation method of the retrieval index of the encrypted data to limit the retrieval index type of the encrypted data ultimately provided to the service caller, which is equivalent to the data provider being able to configure the encrypted data retrieval method corresponding to the deployed data sharing service, so that the encrypted data obtained by the service caller can support one or more methods of encrypted data retrieval. Therefore, the service caller can view the description information of the data sharing service deployed on the server to learn the encrypted data retrieval methods that the data sharing service can support, so that when requesting the data sharing service from the server, it can select from the encrypted data retrieval methods that the data sharing service can support, and then use the obtained retrieval index to perform encrypted data retrieval in the corresponding manner. In the embodiment of this specification, the data provider can flexibly configure the encrypted data retrieval methods supported by the data sharing service, so that the service caller can use the ciphertext retrieval technology to perform encrypted data retrieval on the obtained encrypted data.

In an embodiment of the specification, the data security policy also includes a service call frequency, which is used to configure the upper limit of the periodic call times and/or the upper limit of the permanent call times of the data sharing service, wherein the upper limit of the periodic call times refers to the upper limit of the number of times that can be called by the service caller within a periodic time period (such as hourly, daily, weekly, monthly, etc.), and the upper limit of the permanent call times refers to the upper limit of the number of times that can be called by the service caller after the data sharing service is deployed. The server will maintain a call times table for the successfully deployed data sharing service, which records the current periodic call times and/or permanent call times, and each time the server receives a service call request for the data sharing service, the server will update the information in the call times table corresponding to the data sharing service. If the periodic call times in the call times table reach the upper limit of the periodic call times or the permanent call times reach the upper limit of the permanent call times, then the server will suspend responding to the service call requests for the data sharing service. Of course, the administrator of the data sharing service (such as the data provider of the data sharing service) can manage the data in the call times table to achieve operations such as clearing and changing the relevant call times. In the embodiments of the present specification, the data provider can flexibly configure the service call frequency of the data sharing service, thereby limiting the call frequency of the service caller to the data sharing service to adapt to different actual service call scenarios.

S404: Deploy a callable data sharing service based on the configuration information, the data sharing service being used to provide the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method when it is determined that the target encryption method indicated in the service call request initiated by the service caller is included in the at least one encryption method.

In an embodiment of the present specification, the server first registers and loads a data sharing service instance, and configures different modules in the data sharing service instance according to the configuration information and shared data set information so that the data sharing service can support different functions. For example, when the data sharing service instance is just loaded, there is an empty field that needs to be filled with the data source information required by the service. In this case, the shared data set information can be directly filled into the empty field so that the data sharing service can correctly obtain the shared data set when it is called. For example, when the data encryption module in the data sharing service instance lacks configuration when it is just loaded, at least one encryption method in the data security policy of the configuration information can be written into the configuration of the data encryption module, thereby enabling the corresponding encryption function, so that when the data sharing service is called, it can encrypt and obtain encrypted data according to at least one encryption method configured by the data provider.

In the embodiment of the present specification, a service ID will be maintained after the data sharing service is deployed, and the service caller can call and execute the corresponding data sharing service by initiating a service call request for the service ID. As shown in Figure 2, the service caller 1 can carry the service ID field "2" and the encryption method field "CKKS" in the data security policy in the service call request, so that after the server obtains the service call request, it first determines that the data sharing service that the service caller 2 needs to call is "data sharing service 2" and the required encryption method is "CKKS" according to the service ID field "2". Then the server will further execute data sharing service 2 to obtain the shared data set corresponding to data sharing service 2, and encrypt the shared data in the shared data set according to the encryption method of CKKS to obtain encrypted data, and finally provide the encrypted data to the service caller 2.

In some scenarios, the service caller may only need to perform a certain type of ciphertext calculation, and therefore will only call encrypted data encrypted according to a certain encryption method. This is undoubtedly a waste of resources for data sharing services that support various different encryption methods, and will also cause the service caller to obtain encrypted data that is not needed. Through the method for deploying data sharing services involved in the embodiments of this specification, the data provider can flexibly configure according to the actual needs of the business scenario, and the service caller can also flexibly call according to its own needs, so as to reduce the complexity of the data sharing service as much as possible while meeting the service caller's calling requirements, and save the computing resources or storage resources required for the deployment and maintenance of the data sharing service.

Optionally, the providing of the encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method to the service caller includes: providing the encrypted data obtained by encrypting the target shared data indicated in the service call request in the shared data set according to the target encryption method to the service caller. In an embodiment of the present specification, the service caller can specify the target shared data in the service call request, for example, the service call request can carry description information such as keywords, data types, and file IDs, and then the server can search the shared data set corresponding to the data sharing service according to the description information carried in the service call request, and determine the shared data obtained by the query as the target shared data, and then encrypt the target shared data and provide it to the service caller. Therefore, when providing encrypted data to the service caller, the server does not need to provide the encrypted data obtained by encrypting all the shared data in the shared data set, but can provide the encrypted data obtained by encrypting part of the shared data required by the service caller in the shared data set according to the actual needs of the service caller, so as to more accurately meet the data needs of the service caller while reducing unnecessary data encryption and network interaction processes as much as possible.

Optionally, the providing the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method includes: providing the service caller with the encrypted data pre-stored in an encrypted data set on the server side, the encrypted data set being obtained by pre-encrypting all the shared data in the shared data set by the server side according to the at least one encryption method; or, providing the service caller with the encrypted data obtained by instantly encrypting the shared data in the shared data set according to the target encryption method.

In the embodiment of the present specification, when the server receives the service call request initiated by the service caller, it provides a variety of different encrypted data provision methods: in the first encrypted data provision method, the data sharing service will also maintain an encrypted data set on the server during the deployment phase. This encrypted data set is obtained by encrypting all the shared data in the shared data set according to all the encryption methods recorded in the data security policy. For example, when there are M encryption methods recorded in the data security policy and there are N shared data in the shared data set, the server will encrypt the N shared data M times, and finally obtain M×N encrypted data as the encrypted data set. Therefore, when the server receives the service call request initiated by the service caller for the target encryption method, it can directly retrieve the encrypted data encrypted according to the target encryption method from the pre-stored encrypted data set. Since the process of encrypting the shared data is completed before receiving the service call request, this encrypted data provision method can save the execution time of the data sharing service, thereby reducing the waiting time for the service caller to wait for the encrypted data to be returned, and improving the user experience.

In the second encrypted data provision method, the server does not pre-store an encrypted data set, but first learns the target encryption method required by the service caller according to the received service call request, and then instantly encrypts the shared data in the shared data set according to the target encryption method to obtain encrypted data, and then provides the encrypted data to the service caller. Since the server encrypts instantly in this encrypted data provision method, there is no need to pre-store a large amount of encrypted data on the server, thereby reducing the consumption of storage resources on the server.

In the third encrypted data provision method, the server maintains a heat list corresponding to each deployed data sharing service, wherein the heat list corresponding to any data sharing service records the calling situation of the data sharing service, including the service calling frequency and the encryption frequency of encrypting the shared data according to different encryption methods during the execution process, etc. The service calling frequency reflects the popularity of the recent calling of the data sharing service, and the frequency of encrypting the shared data by different encryption methods reflects the demand heat of the service caller for each encryption method. The server can decide whether to store the encrypted data set on the server according to the calling situation of the data sharing service, so as to switch between different encrypted data provision methods. For example, when the service calling frequency of the data sharing service is higher than the first preset threshold, the server will first establish a complete encrypted data set according to the configuration information and shared data set of the data sharing service, and after the encrypted data set is established and stored on the server, the service call request of the specified data sharing service will adopt the above-mentioned first encrypted data provision method; and when the service calling frequency of a certain data sharing service is lower than the second preset threshold, the server will adopt the above-mentioned second encrypted data provision method, and if the server stores the encrypted data set corresponding to the data sharing service, it will delete it. For another example, in a popularity list corresponding to a data sharing service, the encryption frequency of different encryption methods for encrypting shared data is monitored in real time. When the encryption frequency corresponding to a certain encryption method is higher than a first preset threshold, an encrypted data set consisting of encrypted data obtained by encrypting the shared data in the shared data set according to the encryption method will be stored on the server side, and the first encryption data provision method mentioned above will be adopted for the service call request specifying the encryption method; and when the encryption frequency corresponding to a certain encryption method is lower than a second preset threshold, the second encryption data provision method mentioned above will be adopted for the service call request specifying the encryption method, and it will be checked whether the encrypted data set stored on the server side contains the encrypted data obtained by the encryption method. If it exists, this part of the encrypted data will be deleted from the encrypted data set. In this example, the server side will dynamically maintain the content of the encrypted data set, so that the encrypted data that is frequently called by the service caller is retained, and the encrypted data that is not frequently called is deleted in time. Under this encrypted data provision method, the server side will intelligently adjust the encryption data provision method and the content of the encrypted data set stored on the server side according to the calling situation of the shared service, so as to achieve a balance between saving storage resources and improving calling efficiency.

Optionally, the configuration information also includes an encrypted data storage strategy, which is used to configure the encrypted data provision method of the data sharing service for the service caller. As mentioned above, when the server receives a service call request initiated by the service caller, it can provide a variety of different encrypted data provision methods, including the first, second or third encrypted data provision method mentioned above. In the embodiment of this specification, the encrypted data provision method of the data sharing service can be configured by the data provider, thereby increasing the flexibility of service deployment to better adapt to different actual service call scenarios.

Optionally, the providing the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method includes: when it is determined that the service caller is a trusted application deployed in a trusted execution environment, providing the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method and a decryption key ciphertext, the decryption key ciphertext being encrypted by a decryption key using a public key corresponding to the trusted application, and the decryption key being used to decrypt the encrypted data.

In the embodiments of this specification, the server can check the TEE architecture of the service caller, and when it is determined that the service caller is a trusted application deployed in a trusted execution environment, it can provide the service caller with an additional decryption key ciphertext encrypted by the public key corresponding to the service caller. The service caller can decrypt the decryption key ciphertext according to its own private key to obtain the decryption key, so that after obtaining the encrypted data, the service caller can decrypt the encrypted data required to participate in the ciphertext calculation in the trusted execution environment through the decryption key, and perform plaintext calculation on the shared data obtained by decryption, thereby converting the ciphertext calculation task into a plaintext calculation task. Since the computing resources required for the plaintext calculation task are far less than those for the ciphertext calculation task, it can save computing resources and improve the efficiency of privacy computing. In addition, since the service caller directly obtains the decryption key, the service caller can implement ciphertext decryption locally without secondary interaction with the server, thereby reducing the system pressure on the server. In the embodiments of this specification, the server can identify the TEE architecture of the service caller to intelligently adjust the implementation method of privacy computing. When it is determined that the service caller is a trusted application in a trusted execution environment, the decryption key is encrypted and provided to the service caller to ensure security while adapting to the implementation method of privacy computing in the TEE scenario. This provides different privacy computing solutions to different types of service callers through the same data sharing service, making full use of the TEE architecture of the service caller to save computing resources, improve privacy computing efficiency and reduce system pressure on the server.

Optionally, determining that the service caller is a trusted application deployed in a trusted execution environment includes: verifying the signature contained in the service call request, and if the verification result indicates that the service caller is a trusted application that has passed remote authentication, determining that the service caller is a trusted application deployed in the trusted execution environment.

In the embodiment of the present specification, the server maintains the public keys of all trusted applications that have passed the remote authentication, so that the signatures contained in the service call request can be verified one by one using these public keys. As long as there is a public key pair signature verification success, it can be proved that the service caller is the trusted application to which the public key belongs, that is, it indicates that the service caller is a trusted application that has passed the remote authentication and is deployed in a trusted execution environment. The embodiment of the present specification maintains the public keys of trusted applications that have passed the remote authentication on the server, so it is equivalent to maintaining a list of whether the service caller has a TEE architecture, and the TEE architecture of the service caller can be identified through the list. In addition, in addition to recording the public key of the service caller and the remote authentication pass status, the above list also records the authentication expiration time, which refers to the sum of the authentication time recorded in the remote authentication report obtained by the server and a preset fixed value, so that the authenticated service caller needs to re-authenticate remotely to the server regularly to update the authentication expiration time to ensure the validity of the identity, avoid exposing the decryption key to the service caller of the non-TEE architecture, and maximize the data security.

In another embodiment, the service call request also carries a remote authentication challenge, so that the server sends the remote authentication challenge to a third-party authentication system, such as IAS (Intel Attestation Service). The third-party authentication system verifies the public key of the trusted hardware held by the service caller carried in the remote authentication challenge and generates a remote authentication report. The server receives the remote authentication report returned by the third-party authentication system, and determines whether the service caller is a trusted application deployed in a trusted execution environment based on the remote authentication result recorded in the remote authentication report. In the case where the service caller is determined to be a trusted application, the server will further obtain the public key of the trusted application as the service caller from the remote authentication report, and maintain it in the public key list of trusted applications that have passed the remote authentication. In this embodiment, the remote authentication process can be performed immediately when the service caller calls the data sharing service, so as to verify whether the service caller is a trusted application deployed in a trusted execution environment based on the remote authentication result recorded in the remote authentication report. Therefore, it is not necessary to maintain a public key list of trusted applications that have passed the remote authentication in advance, and it is possible to determine whether the service caller is a trusted application deployed in a trusted execution environment.

Optionally, the data security policy also includes at least one retrieval method, so that when the data sharing service determines that the target retrieval method indicated in the service call request is included in the at least one retrieval method, the encrypted data provided to the service caller includes a retrieval index generated according to the target retrieval method, and the retrieval index is used to enable the encrypted data to support encrypted data retrieval. As mentioned above, the data provider can flexibly configure the encrypted data retrieval methods supported by the data sharing service, so that the service caller can specify the target retrieval method in the service call request, so that the encrypted data provided to the service caller includes the retrieval index generated according to the target retrieval method, so that the service caller can use the ciphertext retrieval technology it needs to perform encrypted data retrieval on the acquired encrypted data.

Optionally, the data security policy also includes a service call frequency, which is used to configure an upper limit on the number of periodic calls and/or permanent calls to the data sharing service. As mentioned above, the data provider can flexibly configure the service call frequency of the data sharing service, thereby limiting the service caller's call frequency of the data sharing service to adapt to different actual service call scenarios.

Optionally, it also includes: calling a blockchain evidence service to store the service deployment request and/or service call request on the chain. The server involved in the embodiment of this specification is connected to at least one blockchain system, and the server is deployed with a blockchain evidence service corresponding to the at least one blockchain system, so the server can store various materials on the chain by calling the blockchain evidence service. As mentioned above, the server involved in this specification can be a BaaS platform, so the server can use the blockchain evidence service deployed on the BaaS platform to store the service deployment request and/or service call request on the chain. Of course, for the use process of encrypted data including ciphertext retrieval, ciphertext calculation and ciphertext decryption, although some of them, such as the use process of ciphertext calculation, only involve the behavior on the client side, it can also be stored on the chain. Specifically, the log of the use of encrypted data recorded by the client corresponding to the service caller is forwarded to the server, and then the server calls the blockchain evidence service to store the relevant logs on the chain, thereby realizing indirect evidence of the use process of encrypted data. In the embodiments of this specification, by deploying a blockchain evidence service on the server side, the server side can store evidence for the entire life cycle of the data sharing service to ensure the transparency and traceability of data and operations in the system.

Optionally, for a data sharing service that has been deployed on a server, the server maintains a shared data set and configuration information corresponding to the data sharing service. The corresponding administrator may modify the shared data set information or configuration information so that the data sharing service is redeployed on the server according to the modified shared data set information and configuration information, so as to update the deployed data sharing service at the shared data level or the functional level to adapt to the ever-changing service call scenarios. The administrator of the data sharing service may include the data provider who deploys the data sharing service or the administrator user of the server, and this specification does not impose any restrictions on this.

Corresponding to the embodiments of the aforementioned method, this specification also provides embodiments of an apparatus, an electronic device, and a storage medium.

FIG5 is a schematic diagram of a device provided by an exemplary embodiment. Please refer to FIG5. At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, a memory 508, and a non-volatile memory 510. Of course, it may also include hardware required for other services. One or more embodiments of this specification can be implemented based on software, such as the processor 502 reading the corresponding computer program from the non-volatile memory 510 into the memory 508 and then running it. Of course, in addition to the software implementation, one or more embodiments of this specification do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

As shown in FIG. 6 , FIG. 6 is a block diagram of a device for obtaining blockchain data according to an exemplary embodiment of this specification. The device can be applied to the device shown in FIG. 4 to implement the technical solution of this specification. The device is applied to the server, including:

The request receiving unit 601 is used to receive a service deployment request from a data provider, wherein the service deployment request includes shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration strategy;

The service deployment unit 602 is used to deploy a callable data sharing service based on the configuration information. The data sharing service is used to provide the service caller with the configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy.

Optionally, the preset configuration policy includes a data security policy, and the data security policy includes at least one encryption method for encrypting the shared data in the shared data set; the data sharing service is used to provide the service caller with the configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy, including:

The data sharing service is used to provide the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method when it is determined that the target encryption method indicated in the service call request initiated by the service caller is included in the at least one encryption method.

Optionally, the at least one encryption method includes a homomorphic encryption method.

Optionally, the service deployment unit 602 is specifically used to:

The service caller is provided with encrypted data obtained by encrypting the target shared data indicated in the service call request in the shared data set according to the target encryption method.

Optionally, the service deployment unit 602 is specifically used to:

Providing the service caller with the encrypted data pre-stored in the encrypted data set of the server, where the encrypted data set is obtained by the server pre-encrypting all the shared data in the shared data set according to the at least one encryption method; or

The encrypted data obtained by instantly encrypting the shared data in the shared data set according to the target encryption method is provided to the service caller.

Optionally, the service deployment unit 602 is specifically used to:

When it is determined that the service caller is a trusted application deployed in a trusted execution environment, the service caller is provided with encrypted data and a decryption key ciphertext obtained by encrypting the shared data in the shared data set according to the target encryption method. The decryption key ciphertext is obtained by encrypting the decryption key using the public key of the trusted application, and the decryption key is used to decrypt the encrypted data.

Optionally, the service deployment unit 602 is specifically used to:

The signature included in the service call request is verified, and if the verification result shows that the service caller is a trusted application that has passed remote authentication, it is determined that the service caller is a trusted application deployed in a trusted execution environment.

Optionally, the data security policy also includes at least one retrieval method, so that when the data sharing service determines that the target retrieval method indicated in the service call request is included in the at least one retrieval method, the encrypted data provided to the service caller includes a retrieval index generated according to the target retrieval method, and the retrieval index is used to enable the encrypted data to support encrypted data retrieval.

Optionally, the data security policy also includes a service call frequency, and the service call frequency is used to configure an upper limit on the number of periodic calls and/or an upper limit on the number of permanent calls to the data sharing service.

Optionally, the shared dataset information includes the shared dataset or metadata used to obtain the shared dataset.

Optionally, the configuration information further includes a data flow strategy, and the data flow strategy is used to configure a data flow mode of the data sharing service for the configured shared data.

Optionally, the data flow mode includes an API gateway mode or a database table mode;

In the case where the data flow mode of the data sharing service is the API gateway mode, the configured shared data is provided to the client of the service caller through the API gateway of the service end;

In the case where the data flow mode of the data sharing service is a database table mode, the configured shared data is provided to the database of the service caller through a database synchronization plug-in.

Optionally, the configuration information also includes a permission management policy, which is used to configure the permission management model of the data sharing service for the service caller, so that the data sharing service responds to the service call request issued by the service caller when it is determined that the service caller has the permission to call the data sharing service.

Optionally, the permission management model includes an OpenAPI model or an IAM model; and determining that the service caller has the permission to call the data sharing service includes:

In the case where the authority management model of the data sharing service is an OpenAPI model, the signature contained in the service call request is verified according to the public key in the public key list corresponding to the data sharing service, and if the signature verification is successful, it is determined that the service caller has the authority to call the data sharing service;

When the permission management model of the data sharing service is an IAM model, the service permission list corresponding to the service caller in the logged-in state is queried, and when the data sharing service is included in the service permission list, it is determined that the service caller has the calling permission for the data sharing service.

Optionally, the rights management policy is also used to configure a legal caller list of the data sharing service for service callers.

Optionally, also include:

The blockchain service calling unit 603 is used to call the blockchain evidence service and store the service deployment request and/or service call request on the chain.

Accordingly, the present specification also provides a device, which includes a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the steps of the method for deploying a data sharing service provided by all the above method embodiments.

Accordingly, the present specification also provides a computer-readable storage medium on which executable instructions are stored; wherein, when the instructions are executed by a processor, the steps of the method for deploying a data sharing service provided in all the above method embodiments are implemented.

For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this specification. A person of ordinary skill in the art can understand and implement it without paying creative labor.

The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

In a typical configuration, a computer includes one or more processors (CPU), input/output interfaces, network interfaces, and memory.

The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and/or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

It should be understood that although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of this specification, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

The above description is merely a preferred embodiment of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present specification shall be included in the scope of protection of one or more embodiments of the present specification.

Claims (18)

1. A method for deploying a data sharing service, applied to a server, comprising: Receive a service deployment request from a data provider, the service deployment request including shared data set information and configuration information, the shared data set information is used to describe the shared data set, the configuration information is used to configure the shared data in the shared data set through at least one preset configuration policy; the preset configuration policy includes a data security policy, and the data security policy includes at least one encryption method for encrypting the shared data in the shared data set; A callable data sharing service is deployed based on the configuration information. The data sharing service is used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy, including: the data sharing service is used to provide the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method when it is determined that the target encryption method indicated in the service call request initiated by the service caller is included in the at least one encryption method. 2. According to the method of claim 1, the at least one encryption method includes a homomorphic encryption method. 3. According to the method of claim 1, the providing to the service caller encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method comprises: The service caller is provided with encrypted data obtained by encrypting the target shared data indicated in the service call request in the shared data set according to the target encryption method. 4. The method according to claim 1, wherein providing the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method comprises: Providing the service caller with the encrypted data pre-stored in the encrypted data set of the server, where the encrypted data set is obtained by the server pre-encrypting all the shared data in the shared data set according to the at least one encryption method; or The encrypted data obtained by instantly encrypting the shared data in the shared data set according to the target encryption method is provided to the service caller. 5. The method according to claim 1, wherein providing the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method comprises: When it is determined that the service caller is a trusted application deployed in a trusted execution environment, the service caller is provided with encrypted data and a decryption key ciphertext obtained by encrypting the shared data in the shared data set according to the target encryption method. The decryption key ciphertext is obtained by encrypting the decryption key using the public key corresponding to the trusted application, and the decryption key is used to decrypt the encrypted data. 6. The method according to claim 5, wherein determining that the service caller is a trusted application deployed in a trusted execution environment comprises: The signature included in the service call request is verified, and if the verification result shows that the service caller is a trusted application that has passed remote authentication, it is determined that the service caller is a trusted application deployed in a trusted execution environment. 7. According to the method described in claim 1, the data security policy also includes at least one retrieval method, so that when the data sharing service determines that the target retrieval method indicated in the service call request is included in the at least one retrieval method, the encrypted data provided to the service caller includes a retrieval index generated according to the target retrieval method, and the retrieval index is used to enable the encrypted data to support encrypted data retrieval. 8. According to the method of claim 1, the data security policy also includes a service call frequency, and the service call frequency is used to configure an upper limit of periodic calls and/or an upper limit of permanent calls to the data sharing service. 9 . The method according to claim 1 , wherein the shared dataset information includes the shared dataset or metadata used to obtain the shared dataset. 10. The method according to claim 1, wherein the configuration information further comprises a data flow strategy, and the data flow strategy is used to configure a data flow mode of the data sharing service for the configured shared data. 11. According to the method of claim 10, the data flow mode includes an API gateway mode or a database table mode; In the case where the data flow mode of the data sharing service is the API gateway mode, the configured shared data is provided to the client of the service caller through the API gateway of the service end; In the case where the data flow mode of the data sharing service is a database table mode, the configured shared data is provided to the database of the service caller through a database synchronization plug-in. 12. According to the method described in claim 1, the configuration information also includes a permission management policy, and the permission management policy is used to configure the permission management model of the data sharing service for the service caller, so that the data sharing service is used to respond to the service call request issued by the service caller when it is determined that the service caller has the calling permission of the data sharing service. 13. The method according to claim 12, wherein the permission management model comprises an OpenAPI model or an IAM model; and the determining that the service caller has the permission to call the data sharing service comprises: In the case where the authority management model of the data sharing service is an OpenAPI model, the signature contained in the service call request is verified according to the public key in the public key list corresponding to the data sharing service, and if the signature verification is successful, it is determined that the service caller has the authority to call the data sharing service; When the permission management model of the data sharing service is an IAM model, the service permission list corresponding to the service caller in the logged-in state is queried, and when the data sharing service is included in the service permission list, it is determined that the service caller has the calling permission for the data sharing service. 14. According to the method of claim 12, the permission management policy is also used to configure the legal caller list of the data sharing service for the service caller. 15. The method according to claim 1, further comprising: Call the blockchain evidence service to store the service deployment request and/or service call request on the chain. 16. A device for deploying a data sharing service, applied to a server, comprising: a request receiving unit, configured to receive a service deployment request from a data provider, wherein the service deployment request includes shared data set information and configuration information, wherein the shared data set information is used to describe the shared data set, and the configuration information is used to configure the shared data in the shared data set through at least one preset configuration policy; the preset configuration policy includes a data security policy, and the data security policy includes at least one encryption method for encrypting the shared data in the shared data set; A service deployment unit, used to deploy a callable data sharing service based on the configuration information, the data sharing service being used to provide the service caller with configured shared data obtained by configuring the shared data in the shared data set according to the target configuration method when it is determined that the target configuration method indicated in the service call request initiated by the service caller is included in the at least one preset configuration policy, including: the data sharing service being used to provide the service caller with encrypted data obtained by encrypting the shared data in the shared data set according to the target encryption method when it is determined that the target encryption method indicated in the service call request initiated by the service caller is included in the at least one encryption method. 17. An electronic device, comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 15 by running the executable instructions. 18. A computer-readable storage medium having computer instructions stored thereon, wherein when the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.