CN119718183A

CN119718183A - Insurance data storage method and apparatus, electronic device and storage medium

Info

Publication number: CN119718183A
Application number: CN202411550292.6A
Authority: CN
Inventors: 肖旅阳; 李勇
Original assignee: Ping An Property and Casualty Insurance Company of China Ltd
Current assignee: Ping An Property and Casualty Insurance Company of China Ltd
Priority date: 2024-10-31
Filing date: 2024-10-31
Publication date: 2025-03-28

Abstract

The embodiment of the application provides a insurance data storage method and device, electronic equipment and a storage medium, and belongs to the technical field of financial science and technology. The method comprises the steps of obtaining original insurance data, performing data slicing on the original insurance data to obtain sliced insurance data and target sliced identifications of the sliced insurance data, encrypting the sliced insurance data according to a preset original key to obtain encrypted insurance data, performing hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data, determining a target partition of a preset storage database according to the hash value, and storing the encrypted insurance data and the target sliced identifications into the target partition, so that safety of insurance data storage can be improved.

Description

Insurance data storage method and apparatus, electronic device and storage medium

Technical Field

The present application relates to the technical field of financial science and technology, and in particular, to a method and apparatus for storing insurance data, an electronic device, and a storage medium.

Background

In the insurance industry, normal operation of insurance business requires support of insurance data such as policy, claims records, customer information, etc. The traditional method directly stores the insurance data into the database, and when the database encounters an external attack, the insurance data has the risk of data leakage, so that the security of the insurance data storage is lower.

Disclosure of Invention

The embodiment of the application mainly aims to provide an insurance data storage method and device, electronic equipment and storage medium, and aims to improve the security of insurance data storage.

To achieve the above object, a first aspect of an embodiment of the present application provides an insurance data storage method, including:

Acquiring original insurance data;

performing data slicing on the original insurance data to obtain sliced insurance data and a target sliced identifier of the sliced insurance data;

Encrypting the fragment insurance data according to a preset original key to obtain encrypted insurance data;

carrying out hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

determining a target partition of a preset storage database according to the hash value;

And storing the encrypted insurance data and the target partition identification to the target partition.

In some embodiments, the preset storage database is deployed with an intelligent contract, and after the storing the encrypted insurance data and the target partition identifier to the target partition, the insurance data storing method further includes:

acquiring access object information and access data information;

performing object authority verification on the access object information through the intelligent contract to obtain authorized object information;

Screening a reference partition from the preset storage database according to the authorized object information and the access data information, determining a reference partition identifier according to the reference partition and the access data information, and extracting target encrypted data from the reference partition according to the reference partition identifier;

And determining target access data according to the target encryption data.

In some embodiments, the determining the target access data according to the target encrypted data includes:

acquiring a reference key of the target encrypted data;

storing the reference key and the reference fragment identifier to a preset key management database;

acquiring the reference key from the preset key management database through the intelligent contract to obtain a target key;

Decrypting the target encrypted data according to the target key to obtain target fragment data;

and integrating the data of the target fragments according to the reference fragment identification to obtain the target access data.

In some embodiments, after the storing the encrypted insurance data and the target tile identifier to the target partition, the insurance data storing method further includes:

acquiring the storage time length of the encrypted insurance data in the target partition, and acquiring a reference storage time length;

acquiring the data type of the encrypted insurance data;

determining a reference storage duration of the encrypted insurance data according to the data type;

determining data operation according to the reference storage time length, the data type and the reference storage time length, wherein the data operation comprises data deleting operation or data migration operation;

and executing the data operation on the encrypted insurance data stored in the target partition.

In some embodiments, the determining the data operation according to the reference storage time length, the data type and the reference storage time length includes:

Comparing the reference storage time length with the reference storage time length;

If the reference storage time length is longer than the reference storage time length, acquiring the data importance level of the encrypted insurance data according to the data type;

If the data importance level is smaller than a preset level threshold, determining the data operation as the data deleting operation;

And if the data importance level is greater than or equal to the preset level threshold, determining the data operation as the data migration operation.

acquiring shared data information;

Screening out candidate partitions from the preset storage database according to the shared data information, determining candidate fragment identifiers according to the candidate partitions and the shared data information, and extracting candidate encrypted data from the candidate partitions according to the candidate fragment identifiers;

performing data integration on the candidate encrypted data according to the candidate fragment identification to obtain target shared data;

And sharing the target shared data to a target shared object through a preset encryption transmission protocol.

In some embodiments, after the target shared data is shared to the target shared object through a preset encryption transmission protocol, the insurance data storage method further includes:

Receiving data integrity check information fed back by the target shared object for carrying out integrity check on the target shared data, wherein the data integrity check information is used for indicating that the target shared data is complete or the target shared data is incomplete;

And removing the data access authority of the target shared object to the target shared data from a preset authority list according to the data integrity check information.

To achieve the above object, a second aspect of an embodiment of the present application proposes an insurance data storage device, the device including:

the acquisition module is used for acquiring the original insurance data;

The slicing module is used for carrying out data slicing on the original insurance data to obtain slicing insurance data and target slicing identifications of the slicing insurance data;

The encryption module is used for encrypting the fragment insurance data according to a preset original key to obtain encrypted insurance data;

the hash calculation module is used for carrying out hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

the determining module is used for determining a target partition of a preset storage database according to the hash value;

And the storage module is used for storing the encrypted insurance data and the target partition identification to the target partition.

To achieve the above object, a third aspect of the embodiments of the present application proposes an electronic device, including a memory storing a computer program and a processor implementing the method according to the first aspect when the processor executes the computer program.

To achieve the above object, a fourth aspect of the embodiments of the present application proposes a computer-readable storage medium storing a computer program which, when executed by a processor, implements the method of the first aspect.

According to the insurance data storage method, the insurance data storage device, the electronic equipment and the computer readable storage medium, the original insurance data are stored in the database by acquiring the original insurance data, so that normal operation of insurance business is supported. With the increase of the data quantity of the insurance data, the processing performance of the insurance system can be reduced by storing the total insurance data by a single node, in order to improve the processing performance of the insurance system, the original insurance data is subjected to data slicing, the total original insurance data is divided into data fragments, and the sliced insurance data and the target sliced identifications of the sliced insurance data are obtained, so that the sliced insurance data are stored on different nodes in a scattered manner, the sliced insurance data can be processed in parallel, and the storage efficiency and the processing efficiency of a database are optimized. The insurance data relates to important information such as personal information data, investment financial data and the like, and in order to ensure the safety of the fragmentation insurance data, the fragmentation insurance data is encrypted according to a preset original key to obtain encrypted insurance data. In order to determine the storage position of the encrypted insurance data in the database, hash calculation is carried out on the encrypted insurance data to obtain a hash value of the encrypted insurance data, and a target partition of a preset storage database is determined according to the hash value. The target partition is determined through the hash value, so that the encrypted insurance data can be uniformly distributed in each partition of the database, and the space utilization rate of the database is improved. The encrypted insurance data and the target fragment identification are stored in the target partition, and the encrypted data fragments are stored in different partitions of the database in a scattered mode, so that the storage efficiency of the database is improved, and the data security of the insurance data is improved.

Drawings

FIG. 1 is a flow chart of an insurance data storage method provided by an embodiment of the present application;

FIG. 2 is another flow chart of an insurance data storage method provided by an embodiment of the present application;

fig. 3 is a flowchart of step S240 in fig. 2;

FIG. 4 is another flow chart of an insurance data storage method provided by an embodiment of the present application;

fig. 5 is a flowchart of step S440 in fig. 4;

FIG. 6 is another flow chart of an insurance data storage method provided by an embodiment of the present application;

FIG. 7 is another flow chart of an insurance data storage method provided by an embodiment of the present application;

FIG. 8 is a schematic diagram of an insurance data storage device according to an embodiment of the present application;

fig. 9 is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present application.

Detailed Description

The present application will be described in further detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present application more apparent. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.

It should be noted that although functional block division is performed in a device diagram and a logic sequence is shown in a flowchart, in some cases, the steps shown or described may be performed in a different order than the block division in the device, or in the flowchart. The terms first, second and the like in the description and in the claims and in the above-described figures, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of the application only and is not intended to be limiting of the application.

Based on the above, the embodiment of the application provides an insurance data storage method, an insurance data storage device, electronic equipment and a computer readable storage medium, aiming at improving the security of insurance data storage.

The insurance data storage method, the insurance data storage device, the electronic device and the computer readable storage medium provided by the embodiment of the application are specifically described by the following embodiments, and the insurance data storage method in the embodiment of the application is described first.

The embodiment of the application provides an insurance data storage method, which relates to the technical field of financial science and technology. The insurance data storage method provided by the embodiment of the application can be applied to a terminal, a server and software running in the terminal or the server. In some embodiments, the terminal may be a smart phone, a tablet computer, a notebook computer, a desktop computer, etc., the server may be configured as an independent physical server, may be configured as a server cluster or a distributed system formed by a plurality of physical servers, and may be configured as a cloud server for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs, and basic cloud computing services such as big data and artificial intelligence platforms, and the software may be an application for implementing an insurance data storage method, but is not limited to the above form.

The application is operational with numerous general purpose or special purpose computer system environments or configurations. Such as a personal computer, a server computer, a hand-held or portable device, a tablet device, a multiprocessor system, a microprocessor-based system, a set top box, a programmable consumer electronics, a network PC, a minicomputer, a mainframe computer, a distributed computing environment that includes any of the above systems or devices, and the like. The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

It should be noted that, in each specific embodiment of the present application, when related processing is required according to user information, user behavior data, user history data, user location information, and other data related to user identity or characteristics, permission or consent of the user is obtained first, and the collection, use, processing, and the like of the data comply with related laws and regulations and standards. In addition, when the embodiment of the application needs to acquire the sensitive personal information of the user, the independent permission or independent consent of the user is acquired through popup or jump to a confirmation page and the like, and after the independent permission or independent consent of the user is definitely acquired, the necessary relevant data of the user for enabling the embodiment of the application to normally operate is acquired.

Fig. 1 is an optional flowchart of an insurance data storage method provided in an embodiment of the present application, where the method in fig. 1 may include, but is not limited to, steps S110 to S160.

Step S110, obtaining original insurance data;

step S120, data slicing is carried out on the original insurance data, and sliced insurance data and target sliced identifications of the sliced insurance data are obtained;

step S130, encrypting the fragment insurance data according to a preset original key to obtain encrypted insurance data;

Step S140, carrying out hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

step S150, determining a target partition of a preset storage database according to the hash value;

step S160, the encrypted insurance data and the target partition identification are stored in the target partition.

In the steps S110 to S160 shown in the embodiment of the application, the safety data is fragmented and the encrypted data fragments are stored in different partitions of the database in a scattered way, so that the storage efficiency of the database is improved and the data security of the safety data is enhanced.

In step S110 of some embodiments, insurance companies collect insurance data through various channels, such as internal service systems of insurance companies, third party data providers, public data platforms, and the like, where some errors or deletions often exist in the collected insurance data, so as to ensure quality and availability of the insurance data, data cleaning can be performed on the insurance data, and the insurance data can be consolidated according to a uniform format and standard to obtain original insurance data. The original insurance data is a data set related to insurance business, the original insurance data comprises customer information, insurance policy details, claim records, health information, financial information and the like, the customer information comprises names, identity card numbers, contact ways, addresses and the like, the insurance policy details comprise insurance policy numbers, insurance types, insurance deadlines, insurance amounts and the like, the claim records comprise claim case numbers, claim amounts, claim dates, claim states and the like, the health information comprises physical examination reports, medical records, health conditions and the like, and the financial information comprises payment records, bills, refund records and the like.

In step S120 of some embodiments, as the service range of the insurance service is expanded, such as the push-out of new insurance products and the increase of the number of clients, the data amount of the insurance data is increased, and if a large amount of insurance data is stored on a single node, the storage efficiency of the database is lower. In addition, insurance data may relate to sensitive information such as customer information, application records, claim records, and the like. In order to ensure the data security of the insurance data and optimize the storage efficiency of the database, a data slicing algorithm is called to carry out data slicing on the original insurance data, the original insurance data is sliced into data slices, the sliced insurance data is obtained, and a target slicing identifier is generated for the sliced insurance data. The slicing insurance data is a data segment of the original insurance data, and the target slicing identifier is a unique identifier of the data segment and is used for distinguishing different data segments.

The data slicing algorithm comprises a transverse data slicing algorithm and a longitudinal data slicing algorithm. The original insurance data is stored in the database in the form of a table consisting of a plurality of rows and a plurality of columns, the rows representing data records and the columns representing attributes of the data records. Taking the client information table as an example, the information of a specific client entity is a data record, and the name, age, sex and the like are all attributes of the data record. Under the condition that the data volume of the original insurance data is large or the data access frequency is high, the original insurance data can be divided into a plurality of data fragments by adopting a transverse data slicing algorithm according to a behavior standard, and each data fragment comprises data records of different rows, and the data structures of the rows are the same. In the case where the original insurance data contains a large number of columns, particularly when certain columns are frequently queried, a longitudinal data slicing algorithm may be employed to divide the original insurance data into a plurality of data fragments on a column by column basis, each data fragment containing a different column of data, each data fragment including at least one attribute. For example, in a customer information table, name, age, gender, telephone number are different attributes, and in a vertical tile, name and age may be placed in one piece of data, telephone number and email in another piece of data.

In step S130 of some embodiments, in order to ensure the security of the data fragment, the original key is generated by an encryption algorithm, which may be an advanced encryption standard (Advanced Encryption Standard, AES), an asymmetric encryption algorithm, or the like. If the AES encryption algorithm is adopted, the original key is a key, and the same key can be used to encrypt and decrypt data. If an asymmetric encryption algorithm is used, the original key includes a public key and a private key, the public key is used for encrypting the data, and the private key is used for decrypting the data. The fragment insurance data can be encrypted according to the original key or the public key in the original key to obtain the encrypted insurance data.

In step S140 of some embodiments, a hash function is obtained, which may be a message digest Algorithm (MESSAGE DIGEST Algorithm, MD 5), a secure hash Algorithm (Secure Hash Algorithm, SHA), or the like. The encrypted insurance data can be any data type data, such as character type data, date type data and numerical value type data, and for rapidly positioning the storage position of the encrypted insurance data in a preset storage database, hash calculation is performed on the encrypted insurance data according to a hash function so as to convert the insurance data of any data type into output in a unified format, and an initial value is obtained. The preset storage database is a local database of an insurance company, and the storage space of the preset storage database is divided into a plurality of subintervals with equal size to obtain a plurality of partitions. Each partition is a separate storage unit and may be a physical partition or a logical partition. And obtaining the partition number of the partitions, and taking the partition number as a modulus of a hash function. And performing modular operation on the initial value according to the modulus of the hash function to obtain the hash value of the encrypted insurance data.

In step S150 of some embodiments, the partition has a partition identifier, and a partition with the partition identifier equal to the hash value is selected from the preset storage database as a target partition. For example, the preset storage database has 10 partitions, partition identifiers of 1 to 10 are set for the partitions, the hash value of the encrypted insurance data is 3, and the partition with the partition identifier of 3 is taken as the target partition.

In step S160 of some embodiments, in order to distinguish different encrypted insurance data, the encrypted insurance data and the target partition identifier are stored together to the target partition, so that each encrypted insurance data obtained by using the transverse data partition algorithm can be distributed in different partitions, so that each encrypted insurance data is stored and processed in parallel, and the storage efficiency and the processing efficiency of the encrypted insurance data are improved. Meanwhile, the encrypted insurance data with lower access frequency and the encrypted insurance data with higher access frequency obtained by using the longitudinal data slicing algorithm can be stored in different partitions, so that the access speed of the data is improved. By storing the fragmented data fragments in different partitions, the uniformity of data distribution is ensured, and the efficiency of data query is improved.

Further, to ensure the integrity of the encrypted insurance data, an initial value obtained by performing hash calculation on the encrypted insurance data through a hash function may be used as a check hash value, the check hash value and the target fragment identifier are stored in another database different from the preset storage database, and the encrypted insurance data and the check hash value are stored separately, so that the encrypted insurance data is subjected to hash check by using the check hash value.

The insurance data relates to sensitive information such as customer information, health condition, financial condition and the like, and in order to ensure data security and privacy protection, access control is required to be performed on the insurance data after the insurance data is stored in a preset storage database. According to the embodiment of the application, the intelligent contracts are deployed in the preset storage database by designing the intelligent contracts, and the conditions, the authority and the operation logic of data access are defined in the intelligent contracts, including who can access which data, when the data can be accessed, and the like, so that the access authority and the operation rule of the insurance data are managed. When access to specific insurance data is requested, the intelligent contract automatically verifies the identity and authority of the requester, and after the authority verification is passed, the corresponding data fragment can be decrypted and accessed. Through an intelligent contract access control mechanism, data leakage and illegal access are effectively prevented, and sensitive information is protected.

Referring to fig. 2, in some embodiments, after step S160, the insurance data storage method may further include, but is not limited to, steps S210 to S240:

step S210, access object information and access data information are obtained;

step S220, performing object authority verification on the access object information through the intelligent contract to obtain authorized object information;

Step S230, screening out a reference partition from a preset storage database according to the authorization object information and the access data information, determining a reference partition identifier according to the reference partition and the access data information, and extracting target encryption data from the reference partition according to the reference partition identifier;

Step S240, determining target access data according to the target encrypted data.

In step S210 of some embodiments, when accessing insurance data, a user may initiate a data access request to a preset storage database through an application program on a terminal device, where the preset storage database extracts access object information and access data information from the data access request, where the access object information is identity information of a data requester, such as a user account number, a user name, and the like, the access data information is a data resource type to be requested by the data requester and a data operation type for the data resource type, where the data resource type may be a claim record, a financial condition, and the like, and the data operation type may be a read operation, a write operation, a delete operation, and the like.

In step S220 of some embodiments, in order to avoid an unauthorized user accessing a data resource and reduce the risk of encountering a network attack in a preset storage database, the embodiments of the present application perform identity verification on access object information, ensure that only a user passing the identity verification can interact with an intelligent contract, and use the access object information passing the identity verification as verification object information. The identity verification method can be off-center identity verification, zero knowledge proof, adaptive multi-factor authentication and the like. In the insurance industry, insurance data plays a vital role in normal operation of a service, in order to ensure the security of data access, a resource access process is controlled in a finer granularity through an intelligent contract, rules and rights are defined in the intelligent contract, and a user role, role rights, data managed by the role rights and an access period allowed by the data are defined, so that a user with the access rights can access specific data resources. Specifically, determining a user role of the verification object information through an intelligent contract, determining role authority according to the user role, comparing the role authority with the data operation type in the access data information, if the data operation type accords with the role authority, comparing the data resource type in the access data information with the data managed by the role authority, if the data resource type is the same as the data managed by the role authority, judging whether the current access time is in an access period allowed by the data, if so, taking the verification object information as authorization object information to provide data access service for the user in the service period. And if the data operation type does not accord with the role authority, the data resource type is different from the data managed by the role authority or the current access time is not in the access period, rejecting the access of the user to which the access object information belongs.

In step S230 of some embodiments, after the preset storage database stores the encrypted insurance data, a metadata table is maintained, where the metadata table records the data resource type of the data segment, the partition of the data segment, and the fragment identifier of the data segment. After the intelligent contract obtains the authorization object information, namely after the permission verification is passed, the partition of the data resource type in the access data information is retrieved from the preset storage database according to the metadata table, and the reference partition is obtained. The reference partition is stored with a plurality of data fragments, and in order to obtain the data fragments related to the access data information, the fragment identifiers are screened out from the metadata table according to the reference partition and the data resource types in the access data information, so that the reference fragment identifiers are obtained. The fragment identification is stored in the partition together with the data fragment, and the target encrypted data can be extracted from the reference partition according to the reference fragment identification.

In step S240 of some embodiments, insurance data to which the data resource type belongs is composed of one or more data pieces. And obtaining the number of the reference fragment identifiers, and if the number is 1, indicating that the access data information only relates to the access of one data fragment, decrypting the target encrypted data to obtain the target access data. The fragment identification of the data fragment may characterize the location of the data fragment in the protection data. If the number is greater than 1, the access data information relates to the access of a plurality of data fragments, then the target encrypted data is decrypted to obtain target fragment data, and the target fragment data are spliced in sequence according to the sequence of the reference fragment identifications to obtain complete target access data.

In the steps S210 to S240, the access object information is subjected to the permission verification, so that only the authorized user can access the specific data segment, thereby ensuring the security of the insurance data.

Referring to fig. 3, in some embodiments, step S240 may include, but is not limited to, steps S310 to S350:

step S310, a reference key of target encrypted data is obtained;

step S320, storing the reference key and the reference fragment identifier into a preset key management database;

step S330, obtaining a reference key from a preset key management database through an intelligent contract to obtain a target key;

step S340, decrypting the target encrypted data according to the target key to obtain target fragment data;

Step S350, according to the reference fragment identification, data integration is carried out on the target fragment data, and target access data is obtained.

In step S310 of some embodiments, the target encrypted data is obtained by encrypting the data segment with the key, and the key for generating the target encrypted data is obtained to obtain the reference key.

In step S320 of some embodiments, the preset key management database is a system or service for securely storing and managing keys, such as a key management service (KEY MANAGEMENT SERVICE, KMS), a hardware security module (Hardware Security Module, HSM). Each data segment corresponds to a key, so that the key of each data segment is convenient to be managed in a centralized way in order to ensure the security of the key, and the reference key and the reference fragment identifier are stored in a preset key management database together.

In step S330 of some embodiments, after the rights verification is passed, the smart contract obtains the reference key from the preset key management database according to the reference fragment identifier, and obtains the target key.

In step S340 of some embodiments, the target encrypted data is decrypted according to the target key, and the target encrypted data is recovered from the ciphertext to plaintext, so that the data fragment is readable and usable, and the target fragment data is obtained.

In step S350 of some embodiments, the target fragment data is spliced according to the sequence of the reference fragment identifiers, so as to obtain target access data, so that the user performs read-write operation on the target access data according to the data operation type.

In the steps S310 to S350, the key management database is preset to store the key, so that the security of the key can be ensured. For any one data segment, the content of the encrypted data cannot be interpreted even if the encrypted data is obtained without the correct key, so that the safety of the insurance data is enhanced. By splicing the data segments, the data integrity is ensured.

Referring to fig. 4, in some embodiments, after step S160, the insurance data storage method may further include, but is not limited to, steps S410 to S450:

Step S410, obtaining the storage time length of the encrypted insurance data in the target partition, and obtaining a reference storage time length;

Step S420, obtaining the data type of the encrypted insurance data;

Step S430, determining a reference storage time length of the encrypted insurance data according to the data type;

step S440, determining data operation according to the reference storage time length, the data type and the reference storage time length, wherein the data operation comprises data deleting operation or data migration operation;

in step S450, a data operation is performed on the encrypted insurance data stored in the target partition.

In step S410 of some embodiments, the storage of expired insurance data in the local database consumes excessive storage resources, and embodiments of the present application utilize intelligent contracts to automatically manage the entire lifecycle of insurance data from creation to destruction to manage and optimize the local storage resources. In order to judge whether the encrypted insurance data is the expiration data, the storage time length of the encrypted insurance data in the target partition is acquired, and the reference storage time length is obtained.

In step S420 of some embodiments, a data type of the encrypted insurance data is obtained, which may be customer information, policy details, claim records, and the like.

In step S430 of some embodiments, a data retention period is defined in the smart contract, and different data types have different data retention periods. For example, customer information relates to sensitive information such as names, identification numbers, contact information and the like, and needs to be reserved for a long time, and the data retention time is 10 years. The claim records comprise claim case numbers, claim amounts and the like, and the claim records still have reference requirements after finishing the claim records for several years, and the data retention time is 5 years. And determining the data retention time length of the encrypted insurance data according to the data type to obtain the reference storage time length.

In step S440 of some embodiments, it is determined whether the encrypted insurance data is the expiration data according to the reference storage duration and the reference storage duration, and if the encrypted insurance data is the expiration data, the data operation is determined according to the data type, and the data operation includes a data deletion operation or a data migration operation. The data deleting operation is used for deleting the encrypted insurance data from the preset storage database, and the data migration operation is used for migrating the encrypted insurance data from the preset storage database to the long-term storage database. The long-term storage database may be a low cost storage device or cloud archiving service. If the encrypted insurance data is non-expired data, no processing is performed on the encrypted insurance data.

In step S450 of some embodiments, in order to reduce the storage burden of the local database, a data deletion operation or a data migration operation is performed on the encrypted insurance data stored in the target partition, so as to avoid that the expired data is improperly reserved. For example, after an insurance contract expires, the smart contract automatically triggers a data migration or data deletion process to ensure that data is not improperly retained.

In deleting the encrypted insurance data, to ensure that the encrypted insurance data is completely deleted and cannot be recovered, an encrypted erasure technique or multiple verification mechanisms may be used. Encryption erasure techniques make data inaccessible by deleting or overwriting keys, rather than directly erasing the data itself. Multiple verification mechanisms record the status of data deletion using blockchain techniques and verify the authenticity of the data deletion operation on multiple nodes. In the data migration process, the encrypted insurance data is divided into a plurality of small fragments, and the small fragments are respectively stored on different storage nodes by using a distributed storage technology so as to improve the safety and reliability of the data.

Through the steps S410 to S450, the life cycle of the insurance data can be automatically managed, and the deleting or migrating operation is performed on the expired insurance data, so that the storage resources of the local database are optimized, and the space utilization rate and the data access efficiency of the local storage space are improved.

Referring to fig. 5, in some embodiments, step S440 may include, but is not limited to, steps S510 to S540:

Step S510, comparing the reference storage time length with the reference storage time length;

step S520, if the reference storage time length is longer than the reference storage time length, acquiring the data importance level of the encrypted insurance data according to the data type;

Step S530, if the data importance level is smaller than the preset level threshold, determining that the data operation is a data deleting operation;

In step S540, if the data importance level is greater than or equal to the preset level threshold, it is determined that the data operation is a data migration operation.

In step S510 of some embodiments, in order to determine whether the encrypted insurance data is expired data, the sizes of the reference storage period and the reference storage period are compared.

In step S520 of some embodiments, the data importance level is used to evaluate the importance level of the encrypted insurance data, and the higher the data importance level is, the more important the encrypted insurance data is, the data importance level is positive. For example, the data importance level of the client information is 3, the data importance level of the temporary log is 1, and the importance level of the client information is higher than that of the temporary log. If the reference storage time length is longer than the reference storage time length, the encrypted insurance data is described as the outdated data, and in order to determine the data operation of the encrypted insurance data, the data importance level of the encrypted insurance data is obtained according to the data type.

In step S530 of some embodiments, the preset level threshold is greater than the minimum data importance level and less than the maximum data importance level, and may be set by itself according to the actual situation, for example, 2. If the importance level of the data is smaller than the preset level threshold value, the encrypted insurance data is not important, and the data operation is determined to be the data deleting operation.

In step S540 of some embodiments, if the data importance level is greater than or equal to the preset level threshold, which indicates that the encrypted insurance data is the insurance data with higher importance level, the data operation is determined to be the data migration operation.

The steps S510 to S540 determine the data operation on the outdated insurance data according to the importance degree of the data, so as to avoid the occupation of the storage resources by the unimportant data, so that the limited storage resources can store more important data, and support the normal operation of the insurance service.

In order to realize data sharing and cross-mechanism cooperation among different insurance companies, on the premise of ensuring data privacy, a cross-mechanism data sharing mechanism is established through an intelligent contract, so that data can be safely exchanged and verified among different insurance companies, a safe and efficient mode is provided for insurance data exchange, collaborative operation and efficiency improvement of insurance industry are promoted, and the method has important significance for constructing a safer, efficient and collaborative insurance system. For example, an insurance company may share a claim report with other insurance companies via smart contracts to verify that there are duplicate claims.

Referring to fig. 6, in some embodiments, after step S160, the insurance data storage method may further include, but is not limited to, steps S610 to S640:

step S610, obtaining shared data information;

Step S620, candidate partitions are screened from a preset storage database according to the shared data information, candidate fragment identifiers are determined according to the candidate partitions and the shared data information, and candidate encrypted data are extracted from the candidate partitions according to the candidate fragment identifiers;

step S630, data integration is carried out on the candidate encrypted data according to the candidate fragment identification, and target shared data is obtained;

In step S640, the target shared data is shared to the target shared object through a preset encryption transmission protocol.

In step S610 of some embodiments, a smart contract is designed that allows data sharing, the smart contract including data transfer rules, encryption standards, and data access rights. The data transmission rule is used for restricting data exchange and processing flow, such as triggering conditions of data transmission, data format and the like, the encryption standard is the encryption mode of data, such as hash function, public key encryption, digital signature and the like, and the data access authority is used for controlling the operation authority of a user on the data, such as reading authority, writing authority and the like. When an insurance company initiates a data sharing request, the intelligent contract verifies the validity of the data sharing request, extracts shared data information from the data sharing request, and the shared data information comprises a data resource type of insurance data to be shared and a data sharing object. The insurance company is a data sender, and the data sharing object is a data receiver.

In step S620 of some embodiments, the required data is extracted from the local database according to the shared data information and sent to the data sharing object. Specifically, referring to step S230, the partitions of the data resource type in the shared data information are retrieved from the preset storage database according to the metadata table, and candidate partitions are obtained. And screening the fragment identifiers from the metadata table according to the candidate partitions and the data resource types in the shared data information to obtain the candidate fragment identifiers, and extracting the candidate encrypted data from the candidate partitions according to the candidate fragment identifiers. The candidate encrypted data identifies associated data segments for the candidate shards.

In step S630 of some embodiments, referring to step S240, if the number of candidate fragment identifications is 1, the candidate encrypted data is taken as target shared data. And if the number of the candidate fragment identifiers is greater than 1, performing data splicing on the candidate encrypted data according to the sequence of the candidate fragment identifiers to obtain target shared data.

In step S640 of some embodiments, after the target shared data is acquired, the intelligent contract triggers a transmission flow of the target shared data according to a data transmission rule, encapsulates the target shared data into a data packet, and signs the data packet with a private key of a data sender to ensure the integrity and source authenticity of the data. In order to ensure the security of the insurance data in the transmission process, an encryption transmission protocol such as a transmission layer security protocol (Transport Layer Secur ity, TLS) and a secure socket layer (Secure Sockets Layer, SSL) are acquired according to an encryption standard, a data packet containing a data signature and target sharing data is encrypted according to the encryption transmission protocol, a data sharing object in the sharing data information is taken as a target sharing object, and the encrypted data packet is shared to the target sharing object.

In the steps S610 to S640, a data sharing channel may be established through the smart contract, so as to facilitate inter-institution collaboration of insurance data. And in the data transmission process, the insurance data can be encrypted, so that the safety and privacy of the data are ensured.

Referring to fig. 7, in some embodiments, after step S640, the insurance data storage method may further include, but is not limited to, steps S710 to S720:

Step S710, receiving data integrity check information fed back by the integrity check of the target shared object on the target shared data, wherein the data integrity check information is used for indicating that the target shared data is complete or the target shared data is incomplete;

step S720, removing the data access rights of the target shared object to the target shared data from a preset rights list according to the data integrity check information.

In step S710 of some embodiments, the target shared object receives target shared data, decrypts the target shared data using the smart contract, and obtains decrypted shared data. The target shared object verifies the digital signature of the decrypted shared data according to the public key of the data sender to perform integrity check on the decrypted shared data. If the digital signature verification is passed, the data integrity verification information is determined to be complete of the target shared data, and if the digital signature verification is not passed, the data integrity verification information is determined to be incomplete of the target shared data.

In step S720 of some embodiments, an object that has access to specific data is recorded in the rights list. If the data integrity check information is that the target shared data is complete, and the purpose of data sharing is achieved, the intelligent contract deletes the data access authority of the target shared object to the target shared data from the authority list associated with the target shared data, so that the target shared data is ensured not to be used unauthorized. If the data integrity check information is that the target shared data is incomplete, the target shared data is not shared.

To prevent data loss or corruption, the target shared object may temporarily create a copy of the data as a backup, and after the data sharing is completed, the smart contract may instruct the target shared object to delete all temporarily stored copies of the data, preventing data leakage and abuse.

The inability of the smart contract to directly access the local storage system of the target shared object ensures that the target shared object deletes all copies of data is a challenge. To increase the trust of data deletion, after the target shared object deletes the target shared data, an evidence may be generated and recorded on the blockchain, and the intelligent contract may verify the evidence and ensure that it is consistent with the hash value of the original data, thereby proving that the data has been deleted. Multiple trusted third parties may also be involved in the data deletion process using multiparty computing techniques. Each third party holds a key of a part of data copy, and when the data needs to be deleted, the parties cooperate to complete the key destruction, so that the data copy cannot be restored. Encryption erasure techniques can also be used to ensure that copies of data are completely deleted and verify the erasure process through smart contracts. For example, the target shared object may provide a physical or logical proof of an erased hard disk or storage medium that the data has been irreversibly erased.

Through the above steps S710 to S720, once the data exchange is completed, the smart contract automatically terminates the shared channel so that the insurance data is exchanged only for an authorized period of time.

Referring to fig. 8, an embodiment of the present application further provides an insurance data storage device, which can implement the insurance data storage method, where the insurance data storage device includes:

An acquiring module 810, configured to acquire original insurance data;

The slicing module 820 is configured to perform data slicing on the original insurance data to obtain sliced insurance data and a target sliced identifier of the sliced insurance data;

The encryption module 830 is configured to encrypt the fragment insurance data according to a preset original key to obtain encrypted insurance data;

the hash calculation module 840 is configured to perform hash calculation on the encrypted insurance data to obtain a hash value of the encrypted insurance data;

a determining module 850, configured to determine a target partition of the preset storage database according to the hash value;

The storage module 860 is configured to store the encrypted insurance data and the target partition identifier to the target partition.

The specific implementation of the insurance data storage device is basically the same as the specific embodiment of the insurance data storage method, and will not be described herein.

The embodiment of the application also provides electronic equipment, which comprises a memory and a processor, wherein the memory stores a computer program, and the processor realizes the insurance data storage method when executing the computer program. The electronic equipment can be any intelligent terminal including a tablet personal computer, a vehicle-mounted computer and the like.

Referring to fig. 9, fig. 9 illustrates a hardware structure of an electronic device according to another embodiment, the electronic device includes:

The processor 910 may be implemented by a general purpose CPU (Central Processing Unit ), a microprocessor, an Application SPECIFIC INTEGRATED Circuit (ASIC), or one or more integrated circuits, etc. for executing related programs to implement the technical solutions provided by the embodiments of the present application;

the Memory 920 may be implemented in the form of a Read Only Memory (ROM), a static storage device, a dynamic storage device, or a random access Memory (Random Access Memory, RAM). Memory 920 may store an operating system and other application programs, and when the technical solutions provided in the embodiments of the present disclosure are implemented in software or firmware, relevant program codes are stored in memory 920 and called by processor 910 to implement the insurance data storage method of the embodiments of the present disclosure;

an input/output interface 930 for inputting and outputting information;

The communication interface 940 is configured to implement communication interaction between the device and other devices, and may implement communication in a wired manner (e.g., USB, network cable, etc.), or may implement communication in a wireless manner (e.g., mobile network, WIFI, bluetooth, etc.);

A bus 950 for transferring information between components of the device (e.g., processor 910, memory 920, input/output interface 930, and communication interface 940);

wherein processor 910, memory 920, input/output interface 930, and communication interface 940 implement communication connections among each other within the device via a bus 950.

The embodiment of the application also provides a computer readable storage medium, which stores a computer program, and the computer program realizes the insurance data storage method when being executed by a processor.

The memory, as a non-transitory computer readable storage medium, may be used to store non-transitory software programs as well as non-transitory computer executable programs. In addition, the memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory optionally includes memory remotely located relative to the processor, the remote memory being connectable to the processor through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

According to the insurance data storage method, the insurance data storage device, the electronic equipment and the computer storage medium, the insurance data are subjected to fragmentation processing, and the encrypted data fragments are stored in different partitions of the database in a scattered mode, so that the storage efficiency of the database is improved, and the data security of the insurance data is enhanced.

The embodiments described in the embodiments of the present application are for more clearly describing the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application, and those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.

It will be appreciated by persons skilled in the art that the embodiments of the application are not limited by the illustrations, and that more or fewer steps than those shown may be included, or certain steps may be combined, or different steps may be included.

The above described apparatus embodiments are merely illustrative, wherein the units illustrated as separate components may or may not be physically separate, i.e. may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Those of ordinary skill in the art will appreciate that all or some of the steps of the methods, systems, functional modules/units in the devices disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof.

The terms "first," "second," "third," "fourth," and the like in the description of the application and in the above figures, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

It should be understood that in the present application, "at least one (item)" means one or more, and "a plurality" means two or more. "and/or" is used to describe an association relationship of an associated object, and indicates that three relationships may exist, for example, "a and/or B" may indicate that only a exists, only B exists, and three cases of a and B exist simultaneously, where a and B may be singular or plural. The character "/" generally indicates that the context-dependent object is an "or" relationship. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one of a, b or c may represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, c may be single or plural.

In the several embodiments provided by the present application, it should be understood that the disclosed apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the above-described division of units is merely a logical function division, and there may be another division manner in actual implementation, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described above as separate components may or may not be physically separate, and components shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied in essence or a part contributing to the prior art or all or part of the technical solution in the form of a software product stored in a storage medium, including multiple instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method of the various embodiments of the present application. The storage medium includes various media capable of storing programs, such as a U disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory RAM), a magnetic disk, or an optical disk.

The preferred embodiments of the present application have been described above with reference to the accompanying drawings, and are not thereby limiting the scope of the claims of the embodiments of the present application. Any modifications, equivalent substitutions and improvements made by those skilled in the art without departing from the scope and spirit of the embodiments of the present application shall fall within the scope of the claims of the embodiments of the present application.

Claims

1. A method of insurance data storage, the method comprising:

Acquiring original insurance data;

2. The method of claim 1, wherein the pre-set storage database is deployed with a smart contract, the insurance data storage method further comprising, after the storing of the encrypted insurance data and the target shard identification to the target partition:

acquiring access object information and access data information;

And determining target access data according to the target encryption data.

3. The method of claim 2, wherein said determining target access data from said target encrypted data comprises:

acquiring a reference key of the target encrypted data;

4. The method of claim 2, wherein after said storing the encrypted insurance data and the target tile identifier to the target partition, the insurance data storing method further comprises:

acquiring the data type of the encrypted insurance data;

5. The method of claim 4, wherein said determining a data operation based on said reference storage time period, said data type, and said baseline storage time period comprises:

6. The method of any of claims 1 to 5, wherein after said storing the encrypted insurance data and the target tile identifier to the target partition, the insurance data storing method further comprises:

acquiring shared data information;

7. The method of claim 6, wherein after the target shared data is shared to the target shared object via a preset encrypted transmission protocol, the insurance data storage method further comprises:

8. An insurance data storage device, said device comprising:

the acquisition module is used for acquiring the original insurance data;

9. An electronic device comprising a memory storing a computer program and a processor implementing the method of any of claims 1 to 7 when the computer program is executed by the processor.

10. A computer readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the method of any one of claims 1 to 7.