Data processing method, device, equipment and storage medium

Abstract

The present invention discloses a data processing method, device, equipment and storage medium. This method can be applied to a first audit system, which is deployed in a first participant of federated learning. The method may include: receiving a data request sent by a second audit system deployed in a second participant, the data request is used to initiate a cooperation request to the first participant; the data request includes the account information and request content of the second participant; according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, the second participant is subjected to a permission check to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission check result; if the second participant passes the permission check, the data request is responded. The method of the present invention can achieve the purpose of managing the data interaction process between the participants.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] Federated learning uses multi-party secure computing to train models with multiple participants, solving the problem of machine learning in data silos. Due to the multi-party participation and data encryption, real-time or non-real-time audit monitoring is required in the specific federated learning process to facilitate the management of the federated data network.

[0003] However, the related art does not provide relevant technologies to implement these monitoring operations, making it impossible to manage the data transmission between the participants. Summary of the invention

[0004] The main purpose of the present invention is to provide a data processing method, device, equipment and storage medium to manage the data transmission process between the participants of federated learning through an audit system.

[0005] To achieve the above objective, in a first aspect, the present invention provides a data processing method, which is applied to a first audit system, where the first audit system is deployed in a first participant in federated learning, and the method comprises:

[0006] Receiving a data request sent by a second audit system deployed in a second participant, the data request being used to initiate a cooperation request to the first participant; the data request including account information of the second participant and request content;

[0007] Performing a permission check on the second party according to the attribute information of the data of the first party and the account information and request content of the second party in the data request, so as to determine whether the second party has the permission to obtain the data corresponding to the request content according to the permission check result;

[0008] If the second participant passes the authority verification, it responds to the data request.

[0009] Optionally, performing permission verification on the second party according to the attributes of the data of the first party and the account information and request content of the second party in the data request includes:

[0010] Performing identity verification on the second party according to the pre-stored account information and the account information of the second party in the data request;

[0011] If the identity verification of the second participant is successful, the authority of the second participant is verified according to the attributes of the data of the first participant and the account information and request content of the second participant in the data request.

[0012] Optionally, the responding to the data request includes:

[0013] Determine, according to the request content in the data request, the data corresponding to the request content;

[0014] The data corresponding to the request content is sent to the second audit system.

[0015] Optionally, sending the data corresponding to the request content to the second audit system includes:

[0016] Encrypting data corresponding to the request content using an encryption token agreed upon by the first audit system and the second audit system;

[0017] The encrypted data corresponding to the request content is sent to the second audit system.

[0018] Optionally, before encrypting the data corresponding to the request content by using the encryption token agreed upon by the first audit system and the second audit system, the method further includes:

[0019] Verifying the key stored by the first party and the key stored by the second party based on a random number;

[0020] If it is verified that the key stored by the first participant and the key stored by the second participant are correct, an encrypted token is generated according to the random number.

[0021] Optionally, the method further includes:

[0022] The permission verification result is sent to the second audit system as a historical permission verification result, so that the second audit system performs a permission pre-verification on the data request according to the historical permission verification result, and when the permission pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

[0023] Optionally, the method further includes:

[0024] Recording operations performed during data interaction with the second audit system to form an audit record;

[0025] Accordingly, the method further includes:

[0026] receiving a report generation instruction, wherein the report generation instruction includes a record screening condition;

[0027] According to the report generation instruction, a report is generated for the audit records that meet the record screening conditions;

[0028] outputting the report;

[0029] The operations performed during the data interaction with the second audit system include at least one of the following:

[0030] receiving a data request sent by the second audit system;

[0031] Performing identity verification on the second party;

[0032] Performing authority verification on the second party;

[0033] Send the permission verification result to the second audit system;

[0034] respond to requests for data;

[0035] Sending data corresponding to the data request to the second audit system;

[0036] Encrypting data corresponding to the data request using an encryption token;

[0037] A key stored by the first party and a key stored by the second party are verified.

[0038] In a second aspect, the present invention provides a data processing method, which is applied to a second audit system, where the second audit system is deployed in a second participant in federated learning, and the method includes:

[0039] Determine a data request, wherein the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content;

[0040] The data request is sent to a first audit system deployed on the first participant, so that the first audit system receives the data request, and performs a permission check on the second participant based on the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content based on the permission check result; and respond to the data request when the second participant passes the permission check.

[0041] Optionally, sending the data request to a first audit system deployed at the first participant includes:

[0042] Obtaining historical permission verification results within a preset time, where the historical permission verification results are sent by the first audit system after performing permission verification on the second party;

[0043] Performing a permission pre-verification on the data request according to the historical permission verification result;

[0044] If the authority pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

[0045] In a third aspect, the present invention provides a data processing device, comprising:

[0046] A receiving module, used to receive a data request sent by a second audit system deployed in a second participant, wherein the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content;

[0047] an authority verification module, configured to perform an authority verification on the second party according to the attribute information of the data of the first party and the account information and request content of the second party in the data request, so as to determine whether the second party has the authority to obtain the data corresponding to the request content according to the authority verification result;

[0048] The request response module is used to respond to the data request when the second participant passes the authority verification.

[0049] In a fourth aspect, the present invention provides a data processing device, comprising:

[0050] A request determination module, used to determine a data request, wherein the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content;

[0051] A sending module is used to send the data request to a first audit system deployed on the first participant, so that the first audit system receives the data request and performs a permission check on the second participant based on the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content based on the permission check result; and respond to the data request when the second participant passes the permission check.

[0052] In a fifth aspect, the present invention provides a data processing device, comprising: a memory, a processor, and a data processing program stored in the memory and executable on the processor, wherein the data processing program, when executed by the processor, implements the steps of the data processing method described in the first aspect or the second aspect.

[0053] In a sixth aspect, the present invention provides a computer-readable storage medium having a data processing program stored thereon, and when the data processing program is executed by a processor, the steps of the data processing method described in the first aspect or the second aspect are implemented.

[0054] In a seventh aspect, the present invention provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the data processing method described in the first aspect or the second aspect is implemented.

[0055] The present invention provides a data processing method, device, equipment and storage medium. This method can be applied to a first audit system, which is deployed in the first participant of federated learning. The method may include: receiving a data request sent by a second audit system deployed in a second participant, the data request is used to initiate a cooperation request to the first participant; the data request includes the account information and request content of the second participant; according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, the second participant is subjected to a permission check, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission check result; if the second participant passes the permission check, the data request is responded. The method of the present invention achieves the purpose of managing the data interaction process between the participants by deploying an audit system in each participant, checking the permissions of the participant through the audit system and responding to the data request. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of an application scenario provided by the present invention;

[0057] Figure 2 A flowchart of a data processing method provided by one embodiment of the present invention;

[0058] Figure 3 A flowchart of a method for generating a token provided by an embodiment of the present invention;

[0059] Figure 4 A flowchart of another data processing method provided by an embodiment of the present invention;

[0060] Figure 5 A schematic diagram of the structure of a data processing device provided by an embodiment of the present invention;

[0061] Figure 6 A schematic diagram of the structure of another data processing device provided by an embodiment of the present invention;

[0062] Figure 7A schematic diagram of the structure of a data processing device provided by an embodiment of the present invention.

[0063] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0064] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0065] In many fields, technologies such as machine learning and model training based on big data are constantly developing. By mining big data, a lot of valuable information can be obtained. With the development of technology, the source of raw data is becoming more and more extensive, and there will even be cross-field collaboration.

[0066] In some business scenarios, multiple business platforms collect their own business data. This business data is very valuable and is usually saved as the privacy information of the business platform. Each business platform does not expect to share the original business data with other business platforms. However, in some requirements, multiple business platforms expect to perform collaborative computing without disclosing the business data of each party to improve business processing capabilities. Based on this, methods such as federated machine learning came into being.

[0067] Federated Machine Learning, also known as Federated Learning, can unite all parties to use data and conduct collaborative modeling without leaving the local data, and has gradually become a common method in privacy-preserving computing.

[0068] In the process of federated learning, the privacy data of the participants can be protected through parameter exchange under the encryption mechanism. The data itself will not be transmitted. The participants do not need to expose their own data to other participants, nor can they infer the data of other participants. Therefore, federated learning can well protect user privacy and ensure data security, and can solve the problem of data islands.

[0069] Based on the characteristics of federated learning, four questions need to be answered in real time or non-real time during the process of federated learning, which can be summarized as 4A:

[0070] a.Account: Who is the participant?

[0071] b.Authentication: How do participants authenticate themselves and access the federated data network?

[0072] c. Authorization: What permissions does the participant have in the federated data network and whether it has the permission to perform a certain operation;

[0073] d.Audit: What operations did the participants perform, with whom did they communicate what data, and how much communication volume was there.

[0074] Only by solving the above four problems can the federated data network be managed in a way that is visible and controllable to business / security personnel. However, the management system of federated learning is not perfect, and a system is needed to complete these functions and realize efficient management of the federated learning process.

[0075] Based on this, the present invention provides a data processing method, apparatus, device and storage medium, and manages the data transmission process between the participants of federated learning based on the audit system provided by the present invention.

[0076] Figure 1 A schematic diagram of an application scenario provided by the present invention, such as Figure 1 As shown, participant A communicates with participant B. There are corresponding computing clusters and deployed federated learning audit systems at participants A and B. In the federated learning process, participant A and participant B communicate through their respective audit systems, and all channels for data to arrive or send out pass through this audit system, so that the audit system can manage the communication process based on the system function and the data processing method of the present invention.

[0077] Among them, the functions of the audit systems of all parties can be the same, including the ability to implement participant account definition, identity verification, authority verification, data encryption, process recording, report generation, data storage, etc. by accessing specific interfaces.

[0078] For the specific implementation process, please refer to the following embodiments.

[0079] Figure 2 A flowchart of a data processing method provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method of this embodiment can be applied to a first audit system, which is deployed in a first participant of federated learning. The method of this embodiment includes:

[0080] S201. Receive a data request sent by a second audit system deployed in a second participant, where the data request is used to initiate a cooperation request to a first participant; the data request includes the account information of the second participant and request content.

[0081] The first participant and the second participant communicate through their respective audit systems. The second participant is the request initiator, determines the data request according to its own needs, and sends the data request to the first audit system through the second audit system to initiate a cooperation request to the first participant through the data request.

[0082] Specifically, the data request may include the account information of the second participant (such as device identification, user name, etc.) to declare the identity of the request initiator to the first participant; it may also include the request content, that is, the data content requested by the second participant to the first participant.

[0083] The content of the request can be determined according to the needs of the second participant. For example, if the second participant wants to request the data of the first participant to train the model, the request content can be a certain type of data of the first participant; for another example, if the second participant wants to request the first participant to assist in predicting the trained model, the request content can be test data; for another example, if the second participant wants to request to modify the permission information provided by the first participant, the request content can be the corresponding permission modification content.

[0084] S202. Perform a permission check on the second participant based on the attribute information of the first participant's data and the second participant's account information and request content in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content based on the permission check result.

[0085] The data of the first participant may include sample data that the first participant can use for model training and model data that has been constructed with a certain participant.

[0086] The data attributes of a certain sample data may include: whether the sample data is public data. If the sample data is public data, it means that other participants are allowed to obtain the sample data; if the sample data is partially public data, it means that some participants are allowed to obtain the sample data. Accordingly, the information of the participants who can obtain the sample data can be used as another data attribute.

[0087] The data attributes of the sample data may also include whether the sample data contains label data. For example, in a user credit assessment model, the user's historical credit record is the label data for model training. If the sample data contains label data, the first participant can provide the sample data to jointly build a related model with other participants; if the sample data does not contain label data, the first participant can only jointly build a related model with other participants who have label data.

[0088] The data attributes of the sample data may also include whether the sample data is paid data. If the sample data is paid data, the second party must obtain the right to use the data by paying.

[0089] The data attributes of a certain model data may include basic information of the model data, such as information of other participants in the model building process, the model used to predict a certain behavior of the user, and the model prediction accuracy.

[0090] The data attributes of the model data may also include whether a certain type of party is allowed to use the data or whether the data is paid data.

[0091] Based on the attribute information of the data in the first participant and the data request of the second participant, the authority of the second participant can be verified to determine whether the second participant has the authority to obtain the requested content.

[0092] The contents of permission verification include but are not limited to the following:

[0093] a. Modeling authority: whether the second party can jointly model with the first party;

[0094] b. Model usage rights: whether the second party can use a model of the first party; if the second party can use the model, whether it can be used in offline / online scenarios.

[0095] c. Data usage rights: Whether the second party can use the data of the first party for modeling / prediction.

[0096] In order to support flexible permission verification, permission verification can be connected to the audit system as a plug-in. As long as a specific interface is implemented, it can be connected.

[0097] S203. If the second party passes the authority verification, it responds to the data request.

[0098] If it is determined through verification that the second party does have the authority to obtain the requested content, the data request is responded to.

[0099] Specifically, responding to the data request may include determining data corresponding to the request content according to the request content, and sending the data corresponding to the request content to the second audit system. Correspondingly, the second audit system receives the data corresponding to the request content.

[0100] In a specific embodiment, if the data request initiated by the second participant is for joint modeling with the first participant, after obtaining the requested sample data, the first participant and the second participant can also perform subsequent data transmission in the model training process. At this time, the arbitrator may also be invited to join as a third party to assist in completing the model training process. The direction and content of data interaction in the specific process of model training may be subject to the specific design plan.

[0101] In addition, it should be noted that the first participant and the second participant mentioned in the present invention are only distinguished based on the roles of the participants, that is, the first participant represents the recipient of the request, and the second participant represents the initiator of the request. It is not used to limit the data transmission direction or the number of participants. For example, the first participant can be one or more, the second participant can also be one or more, and the first participant can initiate data requests to one or more participants at the same time.

[0102] The data processing method provided in this embodiment is applied to the first audit system, and the first audit system is deployed in the first participant of federated learning. The method may include: receiving a data request sent by the second audit system deployed in the second participant, the data request is used to initiate a cooperation request to the first participant; the data request includes the account information and request content of the second participant; according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, the second participant is subjected to permission verification, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission verification result; if the second participant passes the permission verification, the data request is responded. The method of the present invention achieves the purpose of managing the data interaction process between the participants by deploying an audit system in each participant, verifying the permissions of the participant through the audit system and responding to the data request.

[0103] Before performing permission verification on the second participant according to the attributes of the data of the first participant and the account information and request content of the second participant in the data request, the identity of the second participant may be verified first. Specifically, it may include: performing identity verification on the second participant according to the pre-stored account information and the account information of the second participant in the data request; after the identity verification of the second participant is successful, performing permission verification on the second participant according to the attributes of the data of the first participant and the account information and request content of the second participant in the data request.

[0104] To ensure the data security of all participants, account information, i.e. user name and password, can be assigned to each participant who joins the federated learning network through the audit system for identity verification in the subsequent data exchange process. The assigned account information can be stored in the form of files, databases or management systems, and stored in the audit systems of each participant, or connected to the audit systems of each participant in the form of interfaces.

[0105] After receiving the data request from the second participant, the first participant can compare the account information of the second participant with the pre-stored account information to determine whether it is a legitimate account in the federated learning network to achieve identity verification.

[0106] The identity verification function module can be connected to the audit system as a plug-in and access can be achieved through a specific interface.

[0107] To ensure the security of data transmission, the audit system can encrypt the data during the transmission process, including encrypting the data request, encrypting the data corresponding to the data request, etc.

[0108] For example, the data corresponding to the request content may be encrypted using an encryption token agreed upon by the first audit system and the second audit system; and then the encrypted data corresponding to the request content may be sent to the second audit system.

[0109] The agreed encryption token may be, for example, a token in a format predetermined by each party. For example, a token is generated using random information such as sending time and device number, and is encrypted using the token as a password. Symmetric encryption may be used for encryption.

[0110] In some embodiments, before encrypting the data corresponding to the request content using the encryption token agreed upon by the first audit system and the second audit system, the keys of each party may be verified first. To ensure that multiple parties in communication can encrypt and decrypt normally, each party stores its own private key and the other party's public key. To ensure that the transmitted data can be correctly decrypted between the parties, the correctness of the stored public key may be verified first. For example, the key stored by the first participant and the key stored by the second participant may be verified based on a random number; after verifying that the key stored by the first participant and the key stored by the second participant are correct, an encryption token is generated based on the random number.

[0111] Figure 3 A flowchart of generating a token is provided in one embodiment of the present invention. Figure 3 As shown, multiple parties A, B, and K jointly agree on an encrypted token, namely, a token.

[0112] Party A uses A's private key and other parties' public keys to encrypt a random number, and then transmits it to other parties respectively. Other parties use A's public key and their own private keys to decrypt the random number, and then encrypt it with A's public key and their own private key based on the random number, and then send it to party A. A uses A's private key to decrypt the received data to obtain a random number, and compares it with the random number initially sent to verify whether they are the same. If they are the same, it proves that the keys stored by each party are correct, and tokens can be further generated.

[0113] Party A can generate a token based on time information, machine information, and the random number involved in the verification, and encrypt it with A's private key and the public keys of other parties in turn; the encrypted ciphertext is sent to each party; after receiving the ciphertext, each party decrypts it with its own private key and A's public key in turn to obtain a token.

[0114] In this way, all parties agree on a unique token to encrypt data during the communication process.

[0115] In some embodiments, after the permission verification is completed, the permission verification result can also be sent to the second audit system as a historical permission verification result, so that the second audit system can perform a permission pre-verification on the data request based on the historical permission verification result, and when the permission pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

[0116] Considering that the authority of each participant in other participants generally does not change over a period of time, the second audit system can grasp the scope of its authority in other participants through the feedback of the verification results. When the same data request is initiated again in a short period of time, it can be pre-verified through its own audit system. If the pre-verification finds that the same request has been rejected by the first participant within a period of time, there is no need to re-initiate the data request to the first participant, reducing the complexity of communication.

[0117] Specifically, the historical permission verification result used for pre-verification may be a historical permission verification result within a preset time period before the moment when the current data request is initiated, and the length of the preset time period may be set according to business requirements.

[0118] In some embodiments, the above method may also include: recording the operations performed during data interaction with the second audit system to form an audit record; accordingly, the method also includes: receiving a report generation instruction, the report generation instruction including a record filtering condition; according to the report generation instruction, generating a report for the audit records that meet the record filtering condition; and outputting the report.

[0119] The operations performed during the data interaction with the second audit system include at least one of the following:

[0120] receiving a data request sent by the second audit system;

[0121] Performing identity verification on the second party;

[0122] Performing authority verification on the second party;

[0123] Send the permission verification result to the second audit system;

[0124] respond to requests for data;

[0125] Sending data corresponding to the data request to the second audit system;

[0126] Encrypting data corresponding to the data request using an encryption token;

[0127] The key stored by the first party and the key stored by the second party are verified.

[0128] Specifically, the federated learning audit system can also record the data processing process, including but not limited to the following:

[0129] a. Operation records. Which party did what operation and when, and the results of the operation. These operations may include modeling, prediction, data query, etc., and the results may include whether it was successful, etc.

[0130] b. Communication records. Which participant communicated with which participant in the modeling / reasoning process. The records may also include information such as communication protocol, multi-party security encryption protocol, communication content, data volume, etc.

[0131] c. Self-audit of the federated learning audit system, including identity verification records and permission verification records of participants.

[0132] The Federated Learning Audit System can also generate reports regularly or irregularly, or generate reports according to user instructions. Users can set or select some dimensions to generate statistics and details of data. These dimensions include but are not limited to the following:

[0133] a. Time.

[0134] b.Parties.

[0135] c. Record type, such as modeling record, etc.

[0136] d. Operation result type, such as selecting only rejected operations.

[0137] In addition, the records of the federated learning audit system can be stored persistently in a variety of media, including but not limited to the following:

[0138] a. Files on persistent storage media, including disks, non-volatile storage (such as Intel Optane), etc.

[0139] b. Distributed storage, such as Eggroll, HDFS, etc.

[0140] c. Storage components, such as Mongodb and ELK components.

[0141] d. Blockchain.

[0142] You can also choose to store data in encrypted form.

[0143] The audit system can also reject the operations of the participants in real time, and can also issue warning notifications offline, including but not limited to text messages, emails, phone calls, etc.

[0144] Figure 4 A flowchart of another data processing method provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the method of this embodiment can be applied to a second audit system, and the second audit system is deployed in a second participant of federated learning. The method may include:

[0145] S401. Determine a data request, where the data request is used to initiate a cooperation request to a first participant; the data request includes account information of a second participant and request content.

[0146] S402. Send the data request to the first audit system deployed on the first participant, so that the first audit system receives the data request, and performs permission verification on the second participant according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission verification result; and respond to the data request when the second participant passes the permission verification.

[0147] Optionally, sending the data request to a first audit system deployed at the first participant includes:

[0148] Obtain historical permission verification results within a preset time period. The historical permission verification results are sent by the first audit system after performing permission verification on the second party.

[0149] Perform a pre-authorization check on data requests based on historical authority verification results;

[0150] If the permission pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

[0151] The method of this embodiment corresponds to the method of the above embodiment, and the specific implementation process and technical effects can refer to the above embodiment.

[0152] Figure 4 Corresponding embodiments and Figure 2 The corresponding embodiment is described by taking the first participant as the sender of the data request and the second participant as the receiver of the data request as an example. In fact, in the federated learning network, any participant can send data requests to other participants as the sender of the data request. The specific implementation process is the same, which will not be repeated here.

[0153] Figure 5A structural diagram of a data processing device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the data processing device 500 of this embodiment may include: a receiving module 501 , a permission checking module 502 , and a request response module 503 .

[0154] The receiving module 501 is used to receive a data request sent by the second audit system deployed in the second participant, and the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content;

[0155] The permission verification module 502 is used to perform permission verification on the second party according to the attribute information of the data of the first party and the account information and request content of the second party in the data request, so as to determine whether the second party has the permission to obtain the data corresponding to the request content according to the permission verification result;

[0156] The request response module 503 is used to respond to the data request when the second party passes the authority verification.

[0157] Optionally, when the permission verification module 502 verifies the permission of the second party according to the attributes of the data of the first party and the account information and request content of the second party in the data request, it is specifically used to:

[0158] Performing identity verification on the second party based on the pre-stored account information and the account information of the second party in the data request;

[0159] If the identity verification of the second participant is successful, the authority of the second participant is verified based on the attributes of the data of the first participant and the account information and request content of the second participant in the data request.

[0160] Optionally, when responding to a data request, the request response module 503 is specifically configured to:

[0161] Determine data corresponding to the request content according to the request content in the data request;

[0162] The data corresponding to the request content is sent to the second audit system.

[0163] Optionally, when sending the data corresponding to the request content to the second audit system, the request response module 503 is specifically used to:

[0164] Encrypting data corresponding to the request content using the encryption token agreed upon by the first audit system and the second audit system;

[0165] The data corresponding to the encrypted request content is sent to the second audit system.

[0166] Optionally, before encrypting the data corresponding to the request content using the encryption token agreed upon by the first audit system and the second audit system, the request response module 503 is further used to:

[0167] Based on a random number, verifying the key stored by the first party and the key stored by the second party;

[0168] If it is verified that the key stored by the first party and the key stored by the second party are correct, an encrypted token is generated based on the random number.

[0169] Optionally, the device 500 also includes: a verification result sending module 504, which is used to send the permission verification result to the second audit system as a historical permission verification result, so that the second audit system performs a permission pre-verification on the data request based on the historical permission verification result, and when the permission pre-verification passes, sends the data request to the first audit system deployed on the first participant.

[0170] Optionally, the apparatus 500 further includes: an audit module 505, configured to record operations performed during data interaction with the second audit system to form an audit record;

[0171] Accordingly, the apparatus 500 further includes: a report generation module 506, configured to receive a report generation instruction, wherein the report generation instruction includes a record screening condition; generate a report for the audit records that meet the record screening condition according to the report generation instruction; and output the report;

[0172] The operations performed during the data interaction with the second audit system include at least one of the following:

[0173] receiving a data request sent by the second audit system;

[0174] Performing identity verification on the second party;

[0175] Performing authority verification on the second party;

[0176] Send the permission verification result to the second audit system;

[0177] respond to requests for data;

[0178] Sending data corresponding to the data request to the second audit system;

[0179] Encrypting data corresponding to the data request using an encryption token;

[0180] The key stored by the first party and the key stored by the second party are verified.

[0181] The device of this embodiment can be used to implement the corresponding data processing methods in the above embodiments to obtain the same technical effects, which will not be described in detail here.

[0182] Figure 6 A schematic diagram of the structure of another data processing device provided by an embodiment of the present invention is shown in FIG. Figure 6 As shown, the data processing device 600 of this embodiment may include: a request determination module 601 and a sending module 602 .

[0183] The request determination module 601 is used to determine a data request, which is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content;

[0184] The sending module 602 is used to send the data request to the first audit system deployed on the first participant, so that the first audit system receives the data request and performs permission verification on the second participant based on the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content based on the permission verification result; and respond to the data request when the second participant passes the permission verification.

[0185] Optionally, when sending the data request to the first audit system deployed at the first participant, the sending module 602 is specifically configured to:

[0186] Obtain historical permission verification results within a preset time period. The historical permission verification results are sent by the first audit system after performing permission verification on the second party.

[0187] Perform a pre-authorization check on data requests based on historical authority verification results;

[0188] If the permission pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

[0189] The device of this embodiment can be used to implement the corresponding data processing methods in the above embodiments to obtain the same technical effects, which will not be described in detail here.

[0190] In addition, the present invention also provides a data processing device, which can include Figure 5 and Figure 6 The module structure in the corresponding embodiment can achieve the same technical effect by implementing the method of the above embodiment.

[0191] Figure 7 A structural diagram of a data processing device provided by an embodiment of the present invention is shown in FIG. Figure 7 The data processing device 700 includes: a memory 701, a processor 702, and a data processing program stored in the memory and executable on the processor. When the data processing program is executed by the processor 702, the steps of the data processing method in the above-mentioned embodiment are implemented.

[0192] The present invention also provides a computer-readable storage medium, on which a data processing program is stored. When the data processing program is executed by a processor, the steps of the data processing method in the above embodiment are implemented.

[0193] The present invention also provides a computer program product, including a computer program / instruction, which implements the data processing method in the above embodiment when the computer program / instruction is executed by a processor.

[0194] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0195] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0196] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods of various embodiments of the present invention.

[0197] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data processing method, characterized in that: Applied to a first audit system, where the first audit system is deployed in a first participant in federated learning, the method includes: Based on a random number, verifying the key stored by the first party and the key stored by the second party; If it is verified that the key stored by the first participant and the key stored by the second participant are correct, generating an encrypted token according to the random number; Receiving a data request sent by a second audit system deployed in a second participant, the data request being used to initiate a cooperation request to the first participant; the data request including account information of the second participant and request content; Performing a permission check on the second party according to the attribute information of the data of the first party and the account information and request content of the second party in the data request, so as to determine whether the second party has the permission to obtain the data corresponding to the request content according to the permission check result; If the second participant passes the authority verification, determining the data corresponding to the request content according to the request content in the data request; Encrypting data corresponding to the request content using an encryption token agreed upon by the first audit system and the second audit system; The encrypted data corresponding to the request content is sent to the second audit system.

2. The method according to claim 1, characterized in that The step of performing permission verification on the second participant according to the attribute of the data of the first participant and the account information and request content of the second participant in the data request includes: Performing identity verification on the second party according to the pre-stored account information and the account information of the second party in the data request; If the identity verification of the second participant is successful, the authority of the second participant is verified according to the attributes of the data of the first participant and the account information and request content of the second participant in the data request.

3. The method according to claim 1 or 2, characterized in that: Also includes: The permission verification result is sent to the second audit system as a historical permission verification result, so that the second audit system performs a permission pre-verification on the data request according to the historical permission verification result, and when the permission pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

4. The method according to claim 3, characterized in that Also includes: Recording operations performed during data interaction with the second audit system to form an audit record; Correspondingly, it also includes: receiving a report generation instruction, wherein the report generation instruction includes a record screening condition; According to the report generation instruction, a report is generated for the audit records that meet the record screening conditions; outputting the report; The operations performed during the data interaction with the second audit system include at least one of the following: receiving a data request sent by the second audit system; Performing identity verification on the second party; Performing authority verification on the second party; Send the permission verification result to the second audit system; respond to requests for data; Sending data corresponding to the data request to the second audit system; Encrypting data corresponding to the data request using an encryption token; A key stored by the first party and a key stored by the second party are verified.

5. A data processing method, characterized in that: Applied to a second audit system, where the second audit system is deployed in a second participant in federated learning, the method includes: Determine a data request, wherein the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content; The data request is sent to a first audit system deployed on the first participant, so that the first audit system receives the data request, and performs permission verification on the second participant according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission verification result; and when the second participant passes the permission verification, the data corresponding to the request content is determined according to the request content in the data request; the data corresponding to the request content is encrypting by using the encryption token agreed upon by the first audit system and the second audit system; and the encrypted data corresponding to the request content is sent to the second audit system; wherein the encryption token is generated according to a random number based on the verification that the key stored by the first participant and the key stored by the second participant are correct.

6. The method according to claim 5, characterized in that The sending the data request to a first audit system deployed at the first participant includes: Obtaining historical permission verification results within a preset time, where the historical permission verification results are sent by the first audit system after performing permission verification on the second party; Performing a permission pre-verification on the data request according to the historical permission verification result; If the authority pre-verification passes, the data request is sent to the first audit system deployed on the first participant.

7. A data processing device, characterized in that: include: A receiving module, used to receive a data request sent by a second audit system deployed in a second participant, wherein the data request is used to initiate a cooperation request to the first participant; the data request includes the account information of the second participant and the request content; an authority verification module, configured to perform an authority verification on the second party according to the attribute information of the data of the first party and the account information and request content of the second party in the data request, so as to determine whether the second party has the authority to obtain the data corresponding to the request content according to the authority verification result; A request response module, configured to determine data corresponding to the request content according to the request content in the data request when the second participant passes the authority verification; Encrypting data corresponding to the request content using an encryption token agreed upon by the first audit system and the second audit system; Sending the encrypted data corresponding to the request content to the second audit system; Before encrypting the data corresponding to the request content using the encryption token agreed upon by the first audit system and the second audit system, the request response module is further used to: Verifying the key stored by the first party and the key stored by the second party based on a random number; If it is verified that the key stored by the first participant and the key stored by the second participant are correct, an encrypted token is generated according to the random number.

8. A data processing device, characterized in that: include: A request determination module, used to determine a data request, wherein the data request is used to initiate a cooperation request to the first participant; The data request includes the account information of the second party and the request content; a sending module, configured to send the data request to a first audit system deployed on the first participant, so that the first audit system receives the data request, and performs a permission check on the second participant according to the attribute information of the data of the first participant and the account information and request content of the second participant in the data request, so as to determine whether the second participant has the permission to obtain the data corresponding to the request content according to the permission check result; and when the second participant passes the authority verification, determining the data corresponding to the request content according to the request content in the data request; The data corresponding to the request content is encrypted using an encryption token agreed upon by the first audit system and the second audit system; the encrypted data corresponding to the request content is sent to the second audit system; wherein the encryption token is generated based on a random number after verifying that the key stored by the first participant and the key stored by the second participant are correct.

9. A data processing device, characterized in that: The data processing device comprises: a memory, a processor, and a data processing program stored in the memory and executable on the processor, wherein the data processing program implements the steps of the data processing method according to any one of claims 1 to 6 when executed by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a data processing program, and when the data processing program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 6 are implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 6 is implemented.

Images