Hotel data security storage and privacy computing system

Abstract

The application provides a hotel data security storage and privacy calculation system, relates to the technical field of data security, and solves the technical problem that in the prior art, in the data utilization process, the user privacy security and business data value mining cannot be compatible due to the centralized storage of original sensitive data and plaintext calculation. The system comprises: a data acquisition module for acquiring user original data and data application requests; wherein the user original data comprises identity information, consumption data and behavior data; a decentralized storage module for encrypting and dispersively storing the user original data in multiple independent storage nodes; a privacy calculation module for responding to the data application request, performing collaborative calculation through coordination of multiple storage nodes, and obtaining a calculation result; and a data service interface module for safely outputting the calculation result to a hotel business application end. The application is used in the hotel data management process.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a hotel data security storage and privacy computing system. Background Technology

[0002] Currently, the hotel industry widely adopts centralized systems to store and process various types of user data in order to improve service accuracy and operational efficiency. Existing technologies largely rely on storage encryption and access control for data security, but centralized architectures still pose a risk of mass data leaks. Meanwhile, data analysis and value mining often require access to raw plaintext data, which contradicts increasingly stringent privacy protection requirements. Although privacy-preserving computation technologies exist that can perform calculations directly on encrypted data, they are often independent of the storage layer, forming "security silos." This makes it difficult to build a cohesive, efficient, and fully controlled trusted data loop from the data source to the final application, and fails to systematically resolve the contradiction between data storage risks and compliant utilization in the hotel scenario. Summary of the Invention

[0003] This application provides a hotel data security storage and privacy computing system, which solves the technical problem in the data utilization process where user privacy and security and the mining of business data value cannot be achieved simultaneously due to the centralized storage and plaintext computing of raw sensitive data.

[0004] To achieve the above objectives, this application adopts the following technical solution: Firstly, a hotel data security storage and privacy computing system is provided, including a data acquisition module, a decentralized storage module, a privacy computing module, and a data service interface module; The data acquisition module is used to acquire user raw data and data application requests; wherein, the user raw data includes identity information, consumption data and behavioral data; The decentralized storage module is used to encrypt the user's original data and distribute it across multiple independent storage nodes; The privacy computing module is used to respond to data application requests and obtain computing results by coordinating multiple storage nodes to perform collaborative computing. The data service interface module is used to securely output the calculation results to the hotel business application terminal.

[0005] Based on the above technical solutions, the hotel data security storage and privacy computing system provided in this application achieves end-to-end data security and privacy protection through modular architecture and collaborative design. The data acquisition module aggregates sensitive data from multiple sources, while the decentralized storage module adopts encrypted sharding and distributed routing mechanisms to eliminate the risk of centralized data leakage from the storage source. On this basis, the privacy computing module can directly coordinate the distributed encrypted data to complete collaborative operations such as federated learning and secure multi-party computation without the need for aggregation and decryption, truly achieving "data usable but invisible." Finally, the computation results are securely and controllably output to the business application end through the data service interface module, forming a closed loop from data entry to value exit. This system not only implements security and privacy technical requirements in stages and modules, but also constructs a trusted data infrastructure integrating secure storage, privacy computing, and compliant applications through the organic cooperation between modules, effectively resolving the fundamental contradiction between data utilization and user privacy protection in the hotel industry.

[0006] In conjunction with the first aspect above, in one possible implementation, the decentralized storage module includes a data preprocessing unit, an encrypted sharding unit, and a distributed routing unit; The data preprocessing unit is used to de-identify and standardize the user's original data to obtain preprocessed data; The encrypted fragmentation unit is used to encrypt the preprocessed data and divide it into multiple data fragments using a secret sharing algorithm; The distributed routing unit is used to store multiple data shards to storage nodes located in different physical or logical domains.

[0007] In conjunction with the first aspect above, in one possible implementation, the encryption and segmentation of the preprocessed data using a secret sharing algorithm includes: Set the total number of fragments and the recovery threshold; Secret values ​​are obtained by encoding and mapping the preprocessed data through deterministic coding; Construct a random polynomial based on the secret value and the recovery threshold; Based on the total number of shards, corresponding storage nodes are selected, and a set of node indexes is generated; wherein, the set of node indexes includes multiple node indexes; Substitute the node index into the random polynomial to obtain the secret share, and mark the node index and secret share as data shards; By traversing the set of node indices and substituting them into a random polynomial, multiple data partitions are obtained.

[0008] In conjunction with the first aspect above, in one possible implementation, the determination of the preprocessed data through deterministic coding includes: Define the finite field of the secret sharing algorithm; The preprocessed data is converted into a byte sequence using a serialization protocol to obtain a normalized byte stream; A cryptographic digest is obtained by hashing a normalized byte stream using a hash algorithm. The cryptographic digest is mapped to the finite field of the algorithm through modular arithmetic to obtain the secret value.

[0009] In conjunction with the first aspect above, in one possible implementation, the privacy computing module includes a task parsing and scheduling unit, a node coordination unit, and a secure computing unit; The task parsing and scheduling unit is used to receive and parse data application requests to obtain parsed data; and generate computing task instructions containing a specified privacy computing protocol based on the parsed data; wherein, the parsed data includes target data fragments and computing functions; The node coordination unit connects the task parsing and scheduling unit and the decentralized storage module. It is used to locate the storage node of the target data shard based on the computing task instructions and the node index set, and mark it as a participating node. The secure computing unit is used, under the coordination of the node coordination unit, to execute computing logic based on at least one protocol in a secure multi-party computation, federated learning, or trusted execution environment, either locally on the participating node or through encrypted interaction, and to obtain computing results.

[0010] In conjunction with the first aspect above, in one possible implementation, the secure computing unit includes: When the computational task is model training, a horizontal or vertical federated learning protocol is adopted. Each participating node updates its local model through local data shards and only exchanges encrypted model parameters or gradients. When the computation task is a joint statistical query, a secure multi-party computation protocol is adopted to convert the computation function into a secure computation circuit. Each participating node inputs local data fragments, collaborates to complete the circuit computation, and outputs the computation results.

[0011] In conjunction with the first aspect above, in one possible implementation, the conversion of the computation function into a secure computation circuit includes: Perform operational logic decomposition on the computation function to obtain the logical operation relationships; The basic arithmetic gates are selected according to the MPC protocol and preset efficiency requirements; wherein, the basic arithmetic gates include arithmetic circuit gates and Boolean circuit gates; By mapping logical operations to basic arithmetic gates, a secure computing circuit is obtained.

[0012] In conjunction with the first aspect described above, in one possible implementation, the privacy computing module further includes: The result synthesis and refinement unit is connected to the secure computing unit and is used to securely aggregate and decrypt the preliminary results generated by the secure computing unit. The output control unit, connected to the result synthesis and refinement unit, is used to perform differential privacy protection or generalization processing on the decrypted preliminary results to obtain calculation results that meet the preset privacy protection level, and then transmit them to the data service interface module.

[0013] In conjunction with the first aspect mentioned above, one possible implementation also includes a policy management and auditing module, which is connected to the decentralized storage module, the privacy computing module, and the data service interface module, respectively. This module is used to configure data classification policies, computing authorization policies, and output control policies; and to record end-to-end audit logs from data collection, storage, computing calls to result output, generating a data traceability report.

[0014] In conjunction with the first aspect above, in one possible implementation, the computation authorization policy in the policy management and auditing module is a dynamic policy, which can adjust the computation protocol parameters adopted by the privacy computation module or the privacy protection strength of the output control unit in real time according to the context of the data application request, the requester's permissions, and the data sensitivity.

[0015] This application provides a hotel data security storage and privacy computing system. By deeply integrating a decentralized storage module and a privacy computing module at the architectural level, it achieves synergistic enhancement of storage and computing security. On the one hand, by secretly sharing and storing encrypted data in fragments from the source, the risk of centralized mass leakage is completely eliminated. On the other hand, the privacy computing module can directly perform federated learning, secure multi-party computation, etc., based on distributed encrypted fragments, ensuring that data is "usable but not visible" during the computing process. The collaborative design of each functional module and the dynamic control of the policy management module enable the system to provide a full-link, auditable, integrated solution from data ingestion, secure storage, privacy computing to result output. This fundamentally constructs a secure and reliable closed loop for data value mining, effectively resolving the core contradiction between data utilization and privacy protection in the hotel industry.

[0016] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0017] Figure 1 A system architecture diagram of a hotel data security storage and privacy computing system provided in this application embodiment; Figure 2 A schematic diagram illustrating a process for secure storage and privacy computation of hotel data, provided as an embodiment of this application; Figure 3 A schematic diagram illustrating another process for secure hotel data storage and privacy computation provided in this application embodiment; Figure 4 This is a flowchart illustrating a hotel data security storage and privacy computing method provided in an embodiment of this application. Detailed Implementation

[0018] In the description of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. The "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0019] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0020] To address the technical problem in existing technologies where user privacy and security cannot be simultaneously achieved due to centralized storage of raw sensitive data and plaintext computation during data utilization, this application provides a hotel data security storage and privacy computation system 100, such as... Figure 1 As shown, the system includes a data acquisition module 10, a decentralized storage module 20, a privacy computing module 30, and a data service interface module 40; The data acquisition module 10 is used to acquire user raw data and data application requests; wherein, the user raw data includes identity information, consumption data and behavioral data; The decentralized storage module 20 is used to encrypt the user's original data and distribute it across multiple independent storage nodes; The privacy computing module 30 is used to respond to data application requests and obtain computing results by coordinating multiple storage nodes to perform collaborative computing. The data service interface module 40 is used to securely output the calculation results to the hotel business application terminal.

[0021] It should be noted that the decentralized storage module provides data sources for the privacy computing module, and the privacy computing module performs calculations based on the decentralized storage architecture of the decentralized storage module, together forming a secure closed loop for data storage and value mining.

[0022] Based on this, the technical problem of the incompatibility between user privacy and security and the mining of business data value caused by the centralized storage of raw sensitive data and plaintext calculation in the data utilization process of existing technologies has been solved.

[0023] like Figure 1 As shown in the embodiment of this application, the hotel data secure storage and privacy computing system includes: The data acquisition module 10 is used to acquire user raw data and data application requests.

[0024] The original user data includes identity information, consumption data, and behavioral data.

[0025] For example, the data acquisition module 10 is deployed on the hotel's business server cluster. By integrating IoT sensors, POS payment systems, access control systems, and the API interfaces of the online booking platform, it collects in real time the identity information provided by guests upon check-in, such as their ID card number and mobile phone number; transaction data such as room and catering consumption; and behavioral logs such as the frequency of use of room equipment and the duration of stay in public areas. This forms a multi-dimensional raw user dataset containing name, consumption amount, number of check-ins, and behavioral preferences. When the hotel marketing department initiates a data application request, such as for "high-net-worth customer segmentation," this module receives the request through a predefined secure communication protocol and immediately calls the decentralized... The preprocessing unit in the storage module performs real-time standardization and tagging on the collected raw data (such as Zhang San, ID number 310XXXXXXXXXXXXXXX, single consumption of 1500 yuan, 3 check-ins this month, and 2 gym visits per day). Then, the encryption sharding unit is triggered to generate a hash value using the SHA256 algorithm and combine it with AES encryption to form ciphertext. The Shamir secret sharing algorithm is then used to divide the ciphertext into 5 data shards according to the 3 / 5 threshold scheme. These shards are then distributed to 3 independent storage nodes located at nodes A, B, and C via the distributed routing unit, thus completing the closed-loop process from data perception to secure preprocessing.

[0026] The decentralized storage module 20 is used to encrypt the user's original data and distribute it across multiple independent storage nodes.

[0027] In some implementations, the decentralized storage module includes a data preprocessing unit, an encrypted sharding unit, and a distributed routing unit; The data preprocessing unit is used to de-identify and standardize the user's original data to obtain preprocessed data; The encrypted fragmentation unit is used to encrypt the preprocessed data and divide it into multiple data fragments using a secret sharing algorithm; The distributed routing unit is used to store multiple data shards to storage nodes located in different physical or logical domains.

[0028] For example, the data preprocessing unit receives a raw record from the data acquisition module, which may contain fields such as name "Li Si", ID number "330XXXXXXXXXXXXXXX", mobile phone number "139XXXXXXXX", daily dining expenses of "380" yuan, and total stays of "2" times this month. This unit first calls a de-identification rule based on regular expressions to process the ID number as "330XXXXXXXXXXX" and the mobile phone number as "139XXXXXXX". Then, according to predefined hotel data standards, it uniformly converts the consumption amount to RMB "yuan" as the unit and the number of stays to integers, generating a standardized JSON format preprocessed data record. The encryption and sharding unit then uses... The AES-256 algorithm encrypts the JSON data to obtain ciphertext. Based on the Shamir secret sharing scheme, with a threshold parameter of 3 and a total number of shards of 5, the ciphertext is divided into 5 independent data shards within a finite field of prime numbers of size 2^255 minus 19. The distributed routing unit, according to preset node health and regional policies, stores shards 1 and 2 in node A of the first data center, shard 3 in node B of the second data center, shard 4 in node C of the third data center, and shard 5 in node D of the fourth data center. At the same time, the shard index and storage location metadata are recorded in the blockchain ledger to ensure immutability, thereby completing the transformation and placement of data from plaintext to distributed ciphertext shards.

[0029] In this embodiment, by combining standardized desensitization, strong encrypted fragmentation, and intelligent distributed routing, a complete piece of user data is transformed into multiple scattered ciphertext fragments that cannot be individually deciphered. This ensures that even if one or more storage nodes are compromised, attackers cannot obtain any meaningful complete information, fundamentally eliminating the risk of batch data leakage. At the same time, the threshold-based secret sharing scheme and cross-regional storage strategy provide good disaster recovery and availability while ensuring high data confidentiality. Even if individual nodes fail or the network is isolated, the system can still recover data through the remaining nodes to support subsequent computations. Standardized preprocessing also provides a consistent and well-organized data input foundation for subsequent cross-node privacy computations.

[0030] In some implementations, the preprocessed data is encrypted and segmented using a secret sharing algorithm, such as... Figure 2 As shown, it includes: Set the total number of fragments and the recovery threshold; Secret values ​​are obtained by encoding and mapping the preprocessed data through deterministic coding; Construct a random polynomial based on the secret value and the recovery threshold; Based on the total number of shards, corresponding storage nodes are selected, and a set of node indexes is generated; wherein, the set of node indexes includes multiple node indexes; Substitute the node index into the random polynomial to obtain the secret share, and mark the node index and secret share as data shards; By traversing the set of node indices and substituting them into a random polynomial, multiple data partitions are obtained.

[0031] For example, the system first sets the total number of shards to 5 and the recovery threshold to 3. Then, it preprocesses a JSON-formatted data entry containing user ID 12345, cumulative spending of 1500 yuan, and 3 check-ins. This data is converted to a byte sequence using UTF-8 encoding and a 256-bit hash value is generated using the SHA256 hash algorithm. This hash value is then used as a large integer, and a modulo operation is performed on a pre-selected 218-bit secure prime number to obtain the secret value 183. Next, based on this secret value and the recovery threshold of 3, a quadratic polynomial F(x) = 183 + 42x + 17x is randomly generated within a finite field. 2 The system selects 5 nodes from the storage node pool and assigns index values ​​1 to 5. Substituting index 1 into the polynomial yields a secret share of 242, forming the first data shard (1,242). The remaining four data shards (2,323), (3,438), (4,587), and (5,770) are calculated and generated in sequence. Finally, these data shards are distributed to the corresponding 5 physical storage nodes through a secure channel.

[0032] In this embodiment, by converting specific business data into deterministic cryptographic values ​​and using random polynomials to generate multiple mathematically associated fragments, the security feature of a single data fragment not revealing any original information is achieved. Even if an attacker obtains no more than two fragments, they cannot reconstruct the secret, while a legitimate system only needs to collect any three fragments to accurately recover the data. This ensures data confidentiality while providing redundancy and fault tolerance, and the entire process has deterministic computational consistency, laying a verifiable data foundation for subsequent privacy computations.

[0033] In some implementations, the preprocessed data is encoded and mapped using deterministic coding, such as... Figure 3 As shown, it includes: Define the finite field of the secret sharing algorithm; The preprocessed data is converted into a byte sequence using a serialization protocol to obtain a normalized byte stream; A cryptographic digest is obtained by hashing a normalized byte stream using a hash algorithm. The cryptographic digest is mapped to the finite field of the algorithm through modular arithmetic to obtain the secret value.

[0034] For example, the system pre-sets the finite field of the secret sharing algorithm to be a large prime number P = 2^256 minus 189. When a piece of preprocessed data, such as user ID 1001, total consumption amount of 2000 yuan, and stay duration of 4 days, is input in JSON format, the data preprocessing unit first uses the UTF8 encoding standard to convert it into a canonical byte stream, for example, obtaining a sequence of length 48 bytes. Then, it uses the SHA256 hash algorithm to perform one-way hash calculation on the byte stream, generating a 256-bit cryptographic key. The digest, represented in hexadecimal as A7B3C4D5E6F7890123456789ABCDEF1234567890ABCDEF1234567890ABCDEF12, is then moduloed by the finite field size P. Specifically, the remainder of the decimal integer corresponding to the digest is divided by P, resulting in the secret value S = 123456789012345678901234567890123456789.

[0035] In this embodiment, by standardizing user data of any format into a uniquely determined byte stream and compressing it into a fixed-length digest using a cryptographic hash function, the influence of data format differences on subsequent cryptographic operations is effectively eliminated. By mapping the digest to a strictly defined finite field through modular arithmetic, it is ensured that the generated secret value fully meets the mathematical requirements of the secret sharing algorithm. The entire process has strong collision resistance and one-wayness, making it computationally infeasible to deduce the original data from the secret value. This provides an unpredictable and consistent numerical basis for constructing a secure random polynomial.

[0036] The privacy computing module 30 is used to respond to data application requests and obtain computing results by coordinating multiple storage nodes to perform collaborative computing.

[0037] In some implementations, the privacy computing module includes a task parsing and scheduling unit, a node coordination unit, and a secure computing unit; The task parsing and scheduling unit is used to receive and parse data application requests to obtain parsed data; and generate computing task instructions containing a specified privacy computing protocol based on the parsed data; wherein, the parsed data includes target data fragments and computing functions; The node coordination unit connects the task parsing and scheduling unit and the decentralized storage module. It is used to locate the storage node of the target data shard based on the computing task instructions and the node index set, and mark it as a participating node. The secure computing unit is used, under the coordination of the node coordination unit, to execute computing logic based on at least one protocol in a secure multi-party computation, federated learning, or trusted execution environment, either locally on the participating node or through encrypted interaction, and to obtain computing results.

[0038] For example, when the hotel operations department initiates a data application request called "VIP Customer Quarterly Consumption Trend Analysis," the task parsing and scheduling unit receives the request, parses it using natural language processing to identify data shards that require nearly 90 days of consumption records and involve three branches, and determines to use a vertical federated learning protocol for model training. This generates a computation task instruction containing data shard identifiers ID001 to ID003 and gradient descent algorithm parameters. The node coordination unit, based on a pre-stored node index mapping table, locates nodes A, B, and C that store these shards, marks them as participating nodes, and establishes a secure communication link. The secure computation unit then initiates the vertical federated learning process. Each node locally calculates the encrypted gradient based on the sharded data (e.g., node A holds user IDs and basic attributes, node B holds consumption time series, and node C holds service evaluation data) using homomorphic encryption technology. Multiple rounds of gradient exchange are performed through a secure aggregation protocol, and after 15 iterations, a predictive model is collaboratively trained. Finally, the model parameters are output as the computation result.

[0039] In this embodiment, by intelligently parsing business requirements and automatically matching the optimal privacy computing protocol, collaborative modeling of geographically dispersed data is achieved. Complex analysis tasks are completed without decrypting any original data fragments throughout the process. This fully explores the data value distributed across multiple business units, strictly protects user privacy and data security, and the standardized process significantly improves the efficiency and reliability of cross-node collaborative computing.

[0040] In some implementations, the secure computing unit includes: When the computational task is model training, a horizontal or vertical federated learning protocol is adopted. Each participating node updates its local model through local data shards and only exchanges encrypted model parameters or gradients. When the computation task is a joint statistical query, a secure multi-party computation protocol is adopted to convert the computation function into a secure computation circuit. Each participating node inputs local data fragments, collaborates to complete the circuit computation, and outputs the computation results.

[0041] For example, when a business initiates a task to train a "room service demand prediction model," the secure computing unit identifies it as a horizontal federated learning scenario. In this case, the three participating nodes (nodes D, E, and F) each possess 2000 local customer behavior data shards. The unit distributes an initial neural network model to each node. After each node performs five rounds of training locally, it encrypts the generated gradient parameters using the Paillier homomorphic encryption algorithm. Only the encrypted gradients are uploaded to the secure aggregator for average aggregation. The aggregated ciphertext gradients are decrypted and then distributed. Each node updates its local model, and this process is repeated 20 times to obtain the final model. When the business initiates a " When querying "average monthly spending of customers in the Yangtze River Delta region", the unit identifies it as a joint statistical query and adopts a secure multi-party computation protocol to convert the summation and division calculation functions into an arithmetic circuit consisting of 15 addition gates and 1 multiplication gate. The three participating nodes divide their secretly held local total spending data into fragments (e.g., node D inputs a secret share of 150, node E inputs a secret share of 230, and node F inputs a secret share of 190) as circuit inputs. The circuit calculation is completed collaboratively through a Beaver triplet-assisted multiplication protocol, and finally the plaintext result 190 is securely output. The original input data of each node remains encrypted throughout the entire calculation process.

[0042] In this embodiment, by intelligently identifying task types and automatically calling the appropriate underlying cryptographic protocols, secure and efficient processing of heterogeneous computing needs is achieved. The federated learning mode enables distributed data to collaboratively train high-quality models without the need to centralize the original data. Secure multi-party computation ensures that accurate statistical queries can be completed even in an untrusted environment. Both modes strictly adhere to the principle of data remaining stationary while value is dynamic, releasing the value of data fusion while building a solid privacy and security defense.

[0043] In some implementations, the conversion of the computation function into a secure computation circuit includes: Perform operational logic decomposition on the computation function to obtain the logical operation relationships; The basic arithmetic gates are selected according to the MPC protocol and preset efficiency requirements; wherein, the basic arithmetic gates include arithmetic circuit gates and Boolean circuit gates; By mapping logical operations to basic arithmetic gates, a secure computing circuit is obtained.

[0044] For example, the system receives a joint query to "determine if a customer is a potential VIP". The calculation function is defined as follows: if the customer has checked in 3 or more times in the past 30 days and the cumulative consumption exceeds 5,000 yuan, the output is true. The function is first decomposed into three basic logical operations: "check-in times ≥ 3", "consumption > 5,000", and "logical AND". Based on the analysis of computational efficiency, the system chooses to use Boolean circuit gates to implement comparison and logical operations. Specifically, a 32-bit integer comparator circuit (composed of 120 AND gates, 80 XOR gates, and 40 OR gates) is used to process the two condition judgments, and an AND gate is used for final aggregation. The system takes the secret share of customer A's data (4 check-ins, consumption of 6,200 yuan) as input, loads and runs the secure calculation circuit composed of 241 logic gates in the secure execution environment of each participating node through a pre-compiled circuit description file, and collaboratively completes the ciphertext calculation of all gates before outputting an encrypted Boolean value result.

[0045] In this embodiment, by automatically compiling complex business rules into standardized underlying cryptographic circuits, operations that originally required plaintext comparison and logical judgment can be securely executed entirely on encrypted data, achieving complete isolation between computational logic and original data. The precise definition of Boolean circuits ensures the accuracy of the computation results, while the optimized control of circuit size ensures the feasibility and efficiency of multi-party collaborative computation. Ultimately, with sensitive information such as the number of customer check-ins and consumption amounts encrypted throughout the process, a reliable customer segmentation judgment is obtained, providing secure and practical data support for business decisions.

[0046] In some implementations, the privacy computing module further includes: The result synthesis and refinement unit is connected to the secure computing unit and is used to securely aggregate and decrypt the preliminary results generated by the secure computing unit. The output control unit, connected to the result synthesis and refinement unit, is used to perform differential privacy protection or generalization processing on the decrypted preliminary results to obtain calculation results that meet the preset privacy protection level, and then transmit them to the data service interface module.

[0047] For example, after the secure computing unit completes a multi-party secure summation calculation, the result synthesis and refinement unit receives encrypted intermediate results from the three participating nodes, namely ciphertexts C1, C2, and C3. The unit uses a Paillier homomorphic encryption private key collaborative decryption protocol to securely aggregate and decrypt the preliminary plaintext result "the total consumption of the three branches this month is 150,000 yuan". The output control unit then adds random noise conforming to the Laplace mechanism to this numerical result according to the preset privacy protection level 3, generating a new result that meets the differential privacy requirements, "the total consumption this month is approximately 150,120 yuan". At the same time, it performs generalization processing on the detailed results involving individual users, such as generalizing the user's age "28 years old" to the age range "20 to 30 years old". Finally, the processed secure result is transmitted to the marketing analysis system through a standardized interface.

[0048] In this embodiment, a two-level security processing mechanism is used to further strengthen the privacy of the data after decryption, effectively preventing inference attacks that use calculation results to deduce the original individual information. The added random noise mathematically limits the amount of information leakage, while data generalization further reduces the risk of re-identification. Thus, while providing highly available statistical results, a multi-layered privacy protection is constructed to ensure that the output data complies with compliance requirements such as the principles of data minimization and purpose limitation.

[0049] The data service interface module 40 is used to securely output the calculation results to the hotel business application.

[0050] For example, the data service interface module 40 receives secure result data from the output control unit, such as a JSON object processed with differential privacy, containing the customer segmentation label "high-value customer" and the generalized attribute range "monthly consumption of 1,000 to 2,000 yuan". The module first verifies the identity of the requesting hotel CRM system through an authentication service based on the OAuth 2.0 protocol, and uses the system's public key to encrypt the result data with RSA. Then, it transmits the encrypted data packet to the CRM system's preset API endpoint through a secure channel with TLS 1.3 encryption enabled. At the same time, the interface module generates and records an audit log for this data exchange, including the timestamp 20231025143000, the requester ID CRM001, the number of data records 1500, and the data hash value, for subsequent auditing and tracing.

[0051] In this embodiment, a strict end-to-end encryption and authentication mechanism ensures the security and controllability of the value data generated by privacy computing during the delivery process, effectively preventing the data from being stolen or tampered with during transmission. The standardized interface design enables business systems to seamlessly integrate and securely consume data results, while the complete audit trail capability meets the requirements for compliant data flow, ultimately realizing a closed loop of data value from secure computing to secure delivery.

[0052] Some implementations also include a policy management and auditing module, which is connected to the decentralized storage module, privacy computing module, and data service interface module, respectively. This module is used to configure data classification policies, computing authorization policies, and output control policies; and to record end-to-end audit logs from data collection, storage, computing calls to result output, generating data traceability reports.

[0053] For example, the strategy management and auditing module configures data classification strategies through the central management console, such as marking ID card numbers as P3 level (highest sensitivity data) and consumption amounts as P2 level (sensitive data); it sets computation authorization strategies, such as only allowing the "Revenue Analysis Department" to initiate federated learning tasks on P2 level data every Monday from 9:00 to 18:00; and it defines output control strategies, such as requiring all statistical results to have Laplace noise added and the noise scale parameter ε set to 0.1. When the system processes a consumption record containing the user "Wang Wu", this module automatically records a full-link audit log, including the collection time 202310261030, storage shard locations node A and node B, privacy computation task ID FL20231026001, the called algorithm for vertical federated learning, the output result hash value A1B2C3, and the receiving end marketing system ID, and puts all log entries on the blockchain for evidence storage, and finally automatically generates a verifiable data traceability report, clearly showing the complete lifecycle of the data from generation to use.

[0054] In this embodiment, centralized policy configuration and automated end-to-end audit tracing enable unified control and execution verification of data security policies, transforming compliance requirements into executable technical rules. Blockchain-based log storage ensures the immutability and traceability of audit records, and the generated data traceability report provides a complete and credible chain of evidence for internal security reviews and external compliance audits, significantly improving the transparency and credibility of data governance.

[0055] In some implementations, the computation authorization policy in the policy management and auditing module is a dynamic policy, which can adjust the computation protocol parameters adopted by the privacy computation module or the privacy protection strength of the output control unit in real time according to the context of the data application request, the requester's permissions, and the data sensitivity.

[0056] For example, the strategy management and audit module has a built-in dynamic strategy engine. When it receives a data application request for "customer consumption behavior analysis" initiated by "Marketing Department" user ID MKT2024 at 6:30 PM outside of working hours, the engine analyzes the request context in real time, identifying that the requesting department is a non-core technology department, the request time is outside of regular working hours, and the target data involves P3-level highly sensitive consumption behavior data. Combined with the requester's permission level of 2, the module dynamically decides to strengthen privacy protection, switching the originally planned federated learning protocol to a more secure multi-party computation protocol based on obfuscated circuits, and adjusting the differential privacy noise parameter of the output control unit from 1.0 to 0.5. At the same time, the system is authorized to use only historical data from 3 months ago for calculation. This dynamic strategy takes effect within 50 milliseconds and drives the subsequent calculation process. All strategy decisions and adjustments are recorded in the audit log in real time.

[0057] In this embodiment, a dynamic policy mechanism is used to achieve intelligent adaptation of security policies to specific business scenarios. The system can automatically upgrade the protection level or limit the calculation range based on real-time risk profiles. In high-risk scenarios, data security is prioritized, while in trusted scenarios, computational efficiency and data utility are optimized. This adaptive capability achieves a fine balance between security and availability, making the data utilization process both flexible and controllable and always operating within appropriate security boundaries.

[0058] Based on the above technical solutions, the hotel data security storage and privacy computing system provided in this application achieves synergistic enhancement of storage security and computing security by deeply integrating the decentralized storage module and the privacy computing module at the architectural level. On the one hand, by secretly sharing data through encrypted and fragmented storage from the source, the risk of centralized mass leakage is completely eliminated; on the other hand, the privacy computing module can directly perform federated learning, secure multi-party computation, etc., based on the distributed encrypted fragments, ensuring that the data is "usable but not visible" during the computing process. The collaborative design of each functional module and the dynamic control of the policy management module enable the system to provide an auditable, integrated solution covering the entire chain from data ingestion, secure storage, privacy computing to result output, fundamentally constructing a secure and reliable closed loop for data value mining, and effectively resolving the core contradiction between data utilization and privacy protection in the hotel industry.

[0059] In one possible implementation, this application embodiment also provides a method for secure storage and privacy computation of hotel data, such as... Figure 4 As shown, it includes: Obtain user raw data and data application requests; wherein, the user raw data includes identity information, consumption data, and behavioral data; The user's original data is encrypted and distributed across multiple independent storage nodes; In response to data application requests, the system coordinates multiple storage nodes to perform collaborative computation and obtain the computation results. The calculation results are securely output to the hotel's business application.

[0060] For example, the system first obtains the original data of guest Zhang Moumou through a data collection terminal deployed at the front desk. This data includes his ID number, mobile phone number, and other identity information; his daily dining expenses of 380 yuan and room expenses of 1200 yuan; and his behavioral data such as using the gym twice and the swimming pool once. When the marketing department initiates a request to "calculate the average spending of high-end customers this month," the system immediately encrypts Zhang Moumou's original records using the AES-256 algorithm and divides them into 5 data fragments using the Shamir secret sharing algorithm with a threshold of (3,5). These fragments are then distributed and stored across 5 data center nodes in locations A, B, and C. The privacy computing module responds to the request by coordinating three nodes that store relevant customer data shards. It uses a secure multi-party computation protocol to convert the summation and averaging functions into secure computation circuits. Each node inputs its locally encrypted shard for collaborative computation, obtaining encrypted intermediate statistics without revealing any original consumption amounts. The results are then securely aggregated and decrypted, and differential privacy protection is achieved by adding Laplace noise. Finally, a desensitized result, such as "This month's average consumption for high-end customers is approximately 1580 yuan," is obtained and securely transmitted to the hotel management dashboard system for visualization via an HTTPS channel based on two-way certificate authentication.

[0061] Based on the above technical solutions, the distributed and confidential data storage is guaranteed from the source through strong encryption and secret sharing technologies. Accurate joint statistics are completed in the encrypted state by using secure multi-party computation. Finally, the results are output in a strictly controlled manner that meet both business needs and privacy protection requirements, realizing secure closed-loop management of the entire data lifecycle.

[0062] In implementation, each step of the method provided in this embodiment can be completed by integrated logic circuits in the processor or by instructions in software form. The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules in the processor.

[0063] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0064] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple instances. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0065] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

Claims

1. A hotel data security storage and privacy computing system, characterized in that, It includes a data acquisition module, a decentralized storage module, a privacy computing module, and a data service interface module; The data acquisition module is used to acquire user raw data and data application requests; wherein, the user raw data includes identity information, consumption data and behavioral data; The decentralized storage module is used to encrypt the user's original data and distribute it across multiple independent storage nodes; The privacy computing module is used to respond to data application requests and obtain computing results by coordinating multiple storage nodes to perform collaborative computing. The data service interface module is used to securely output the calculation results to the hotel business application terminal.

2. The hotel data security storage and privacy computing system according to claim 1, characterized in that, The decentralized storage module includes a data preprocessing unit, an encrypted sharding unit, and a distributed routing unit; The data preprocessing unit is used to de-identify and standardize the user's original data to obtain preprocessed data; The encrypted fragmentation unit is used to encrypt the preprocessed data and divide it into multiple data fragments using a secret sharing algorithm; The distributed routing unit is used to store multiple data shards to storage nodes located in different physical or logical domains.

3. The hotel data security storage and privacy computing system according to claim 2, characterized in that, The process of encrypting and segmenting preprocessed data using a secret sharing algorithm includes: Set the total number of fragments and the recovery threshold; Secret values ​​are obtained by encoding and mapping the preprocessed data through deterministic coding; Construct a random polynomial based on the secret value and the recovery threshold; Based on the total number of shards, corresponding storage nodes are selected, and a set of node indexes is generated; wherein, the set of node indexes includes multiple node indexes; Substitute the node index into the random polynomial to obtain the secret share, and mark the node index and secret share as data shards; By traversing the set of node indices and substituting them into a random polynomial, multiple data partitions are obtained.

4. The hotel data security storage and privacy computing system according to claim 3, characterized in that, The step of encoding and mapping the preprocessed data through deterministic encoding includes: Define the finite field of the secret sharing algorithm; The preprocessed data is converted into a byte sequence using a serialization protocol to obtain a normalized byte stream; A cryptographic digest is obtained by hashing a normalized byte stream using a hash algorithm. The cryptographic digest is mapped to the finite field of the algorithm through modular arithmetic to obtain the secret value.

5. The hotel data security storage and privacy computing system according to claim 3, characterized in that, The privacy computing module includes a task parsing and scheduling unit, a node coordination unit, and a secure computing unit; The task parsing and scheduling unit is used to receive and parse data application requests to obtain parsed data; and generate computing task instructions containing a specified privacy computing protocol based on the parsed data; wherein, the parsed data includes target data fragments and computing functions; The node coordination unit connects the task parsing and scheduling unit and the decentralized storage module. It is used to locate the storage node of the target data shard based on the computing task instructions and the node index set, and mark it as a participating node. The secure computing unit is used, under the coordination of the node coordination unit, to execute computing logic based on at least one protocol in a secure multi-party computation, federated learning, or trusted execution environment, either locally on the participating node or through encrypted interaction, and to obtain computing results.

6. The hotel data security storage and privacy computing system according to claim 5, characterized in that, The secure computing unit includes: When the computational task is model training, a horizontal or vertical federated learning protocol is adopted. Each participating node updates its local model through local data shards and only exchanges encrypted model parameters or gradients. When the computation task is a joint statistical query, a secure multi-party computation protocol is adopted to convert the computation function into a secure computation circuit. Each participating node inputs local data fragments, collaborates to complete the circuit computation, and outputs the computation results.

7. The hotel data security storage and privacy computing system according to claim 6, characterized in that, The process of converting the computation function into a secure computation circuit includes: Perform operational logic decomposition on the computation function to obtain the logical operation relationships; The basic arithmetic gates are selected according to the MPC protocol and preset efficiency requirements; wherein, the basic arithmetic gates include arithmetic circuit gates and Boolean circuit gates; By mapping logical operations to basic arithmetic gates, a secure computing circuit is obtained.

8. The hotel data security storage and privacy computing system according to claim 5, characterized in that, The privacy computing module also includes: The result synthesis and refinement unit is connected to the secure computing unit and is used to securely aggregate and decrypt the preliminary results generated by the secure computing unit. The output control unit, connected to the result synthesis and refinement unit, is used to perform differential privacy protection or generalization processing on the decrypted preliminary results to obtain calculation results that meet the preset privacy protection level, and then transmit them to the data service interface module.

9. The hotel data security storage and privacy computing system according to claim 8, characterized in that, It also includes a policy management and auditing module, which is connected to the decentralized storage module, privacy computing module and data service interface module respectively, and is used to configure data classification policies, computing authorization policies and output control policies; It also records the entire audit log from data collection, storage, computation and call to result output, and generates a data traceability report.

10. The hotel data security storage and privacy computing system according to claim 9, characterized in that, The computation authorization policy in the policy management and auditing module is a dynamic policy, which can adjust the computation protocol parameters adopted by the privacy computation module or the privacy protection strength of the output control unit in real time according to the context of the data application request, the permissions of the requester, and the data sensitivity.

Images