Data security processing method, device, terminal, medium and system

Abstract

The present invention relates to the field of data security technology, and specifically discloses a data security processing method, device, terminal, medium and system. The method is applied to a trusted execution environment; the method includes: obtaining a function file sent by a function provider, a task file sent by a task initiator, privacy data sent by a data provider, and path information sent by a result receiver; wherein the function file, the privacy data and the path information are all bound and matched with the task file; after receiving the task start instruction sent by the task initiator, the function file is used to process the privacy data to obtain result data; and the result data is sent to the result receiver according to the path information. Compared with the prior art, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the cost of algorithm expansion on the basis of ensuring that the data is available and invisible.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data security technology, and in particular to a data security processing method, device, terminal, medium and system. Background Art

[0002] With the integration of enterprises and the increasing demand for cross-industry and cross-domain data sharing and application, more and more business scenarios require multi-party data sharing to unlock the application value of data. Existing data fusion computing, such as joint modeling and joint statistical analysis, requires data demanders to provide data partners with data requirements. Data partners are then required to directly provide plaintext or desensitized data to the data demanders, which cannot guarantee data privacy.

[0003] Existing methods for addressing data security include secure multi-party computing (SMC) and federated learning. SMC leverages cryptographic techniques such as obfuscated circuits, secret sharing, oblivious transfer, and homomorphic encryption to exchange intermediate computation results without leaving the original data locally, enabling multi-party data fusion computation. Federated learning primarily addresses joint modeling without leaving the original data domain. Using cryptographic techniques such as homomorphic encryption, it exchanges non-original data such as intermediate model results and gradients for iterative model training. SMC and federated learning involve data encryption and decryption, and the resulting data expansion requires increased computing and transmission resources and time, resulting in lower overall operational efficiency. Furthermore, the algorithmic scaling costs for SMC and federated learning are high. Each algorithm requires separate design, cryptographic data computation and interaction adaptation, and consideration of whether the exchanged data could potentially leak privacy. Summary of the Invention

[0004] The present invention provides a data security processing method, device, terminal, medium and system to ensure that data is available but not visible, improve the operating efficiency of data security processing, and reduce the cost of algorithm expansion.

[0005] In a first aspect, an embodiment of the present invention provides a data security processing method, which is applied to a trusted execution environment; the method includes:

[0006] Obtaining a function file sent by a function provider, a task file sent by a task initiator, private data sent by a data provider, and path information sent by a result receiver; wherein the function file, the private data, and the path information are all bound and matched with the task file;

[0007] After receiving the task start instruction sent by the task initiator, the function file is used to process the private data to obtain result data;

[0008] The result data is sent to the result receiver according to the path information.

[0009] In a second aspect, an embodiment of the present invention provides a data security processing device, which is applied to a trusted execution environment; the device includes:

[0010] A data acquisition module, configured to acquire a function file sent by a function provider, a task file sent by a task initiator, private data sent by a data provider, and path information sent by a result receiver; wherein the function file, private data, and path information are all bound and matched to the task file;

[0011] a data processing module configured to, after receiving the task approval instructions sent by the data provider and the result recipient, and the task start instruction sent by the task initiator, process the private data using the function file to obtain result data;

[0012] A data sending module is used to send the result data to the result receiver according to the path information.

[0013] In a third aspect, an embodiment of the present invention provides a data security processing method, which is applied to a function provider; the method includes:

[0014] Get the data dictionary of the data provider;

[0015] Create a function file based on the function definition and the data dictionary;

[0016] Send the function file to the trusted execution environment.

[0017] In a fourth aspect, an embodiment of the present invention provides a data security processing device, which is applied to a function provider; the device includes:

[0018] A data dictionary acquisition module is used to obtain the data dictionary of the data provider;

[0019] A function creation module, used for creating a function file according to the function definition and the data dictionary;

[0020] The function sending module is used to send the function file to the trusted execution environment.

[0021] In a fifth aspect, an embodiment of the present invention provides a data security processing method, which is applied to a data provider; the method includes:

[0022] After encrypting the private data, send it to the trusted execution environment;

[0023] Obtaining a first data number returned by the trusted execution environment;

[0024] Bind the first data number to the input parameter of the function corresponding to the task number.

[0025] In a sixth aspect, an embodiment of the present invention provides a data security processing device, which is applied to a data provider; the device includes:

[0026] An encryption module, used to encrypt private data and send it to a trusted execution environment;

[0027] A first data number obtaining module, configured to obtain a first data number returned by the trusted execution environment;

[0028] An input parameter binding module is used to bind the first data number to the input parameter of the function corresponding to the task number.

[0029] In a seventh aspect, an embodiment of the present invention provides a data security processing method, which is applied to a result receiving party; the method includes:

[0030] Send path information and data receiving method to the trusted execution environment;

[0031] Obtaining a path number and a second data number returned by the trusted execution environment;

[0032] Binding the second data number to the output parameter of the function corresponding to the task number;

[0033] Receive result data sent by the trusted execution environment.

[0034] In an eighth aspect, an embodiment of the present invention provides a data security processing device, which is applied to a result receiving party; the device includes:

[0035] A path information sending module, configured to send path information and a data receiving mode to the trusted execution environment;

[0036] A second data number acquisition module, configured to acquire a path number and a second data number returned by the trusted execution environment;

[0037] an output parameter binding module, configured to bind the second data number to an output parameter of a function corresponding to the task number;

[0038] The result data receiving module is configured to receive the result data sent by the trusted execution environment.

[0039] In a ninth aspect, an embodiment of the present invention provides a data security processing method, which is applied to a task initiator; the method includes:

[0040] Creating a task file, and sending the task file to a trusted execution environment;

[0041] Obtaining a task number returned by the trusted execution environment;

[0042] Send a start task instruction to the trusted execution environment according to the task number.

[0043] In a tenth aspect, an embodiment of the present invention provides a data security processing device, which is applied to a task initiator; the device includes:

[0044] A task creation and sending module, used for creating a task file and sending the task file to the trusted execution environment;

[0045] A task number acquisition module, configured to acquire the task number returned by the trusted execution environment;

[0046] A startup instruction sending module is used to send a startup task instruction to the trusted execution environment according to the task number.

[0047] In an eleventh aspect, an embodiment of the present invention provides a data security processing method, including:

[0048] The function provider sends a function file to the trusted execution environment, the task initiator sends a task file to the trusted execution environment, the data provider sends private data to the trusted execution environment, and the result receiver sends path information to the trusted execution environment; wherein the function file, the private data, and the path information are all bound and matched with the task file;

[0049] After receiving the task start instruction sent by the task initiator, the trusted execution environment uses the function file to process the private data to obtain result data, and sends the result data to the result receiver;

[0050] The result receiver receives the result data.

[0051] In a twelfth aspect, an embodiment of the present invention provides a data security processing device, including:

[0052] Function provider, used to send function files to the trusted execution environment;

[0053] A task initiator, configured to send a task file to the trusted execution environment;

[0054] A data provider, configured to send private data to the trusted execution environment;

[0055] A result receiver is configured to send path information to the trusted execution environment; wherein the function file, the private data, and the path information are all bound and matched with the task file;

[0056] The trusted execution environment is configured to, after receiving the task start instruction sent by the task initiator, use the function file to process the private data to obtain result data, and send the result data to the result receiver;

[0057] The result receiver is used to receive the result data.

[0058] In the thirteenth aspect, an embodiment of the present invention provides a terminal, a memory, a processor, and a computer program stored in the memory and runnable on the processor, wherein when the processor executes the program, it implements any data security processing method as described in the present invention.

[0059] In a fourteenth aspect, an embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the data security processing method as described in any embodiment of the present invention is implemented.

[0060] In a fifteenth aspect, an embodiment of the present invention provides a data security processing system, comprising: a function provider terminal, a task initiator terminal, a data provider terminal, a result receiver terminal, and a trusted execution environment terminal;

[0061] The trusted execution environment terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data security processing method according to any one of the first aspects is implemented;

[0062] The function provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data security processing method according to any one of the third aspects is implemented;

[0063] The data provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data security processing method according to any one of the fifth aspects is implemented;

[0064] The result receiving terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data security processing method according to any one of the seventh aspects is implemented;

[0065] The task initiator terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method as described in any one of the ninth aspects is implemented.

[0066] The embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment. For the trusted execution environment, the function file sent by the function provider, the task file sent by the task initiator, the privacy data sent by the data provider, and the path information sent by the result receiver are obtained; after receiving the task start instruction sent by the task initiator, the function file is used to process the privacy data to obtain the result data; the result data is sent to the result receiver according to the path information. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Because the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 A flowchart of a data security processing method provided by an embodiment of the present invention;

[0068] Figure 2 A schematic structural diagram of a data security processing device provided by an embodiment of the present invention;

[0069] Figure 3 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0070] Figure 4 A schematic structural diagram of another data security processing device provided by an embodiment of the present invention;

[0071] Figure 5 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0072] Figure 6 A schematic structural diagram of another data security processing device provided by an embodiment of the present invention;

[0073] Figure 7 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0074] Figure 8 A schematic structural diagram of another data security processing device provided by an embodiment of the present invention;

[0075] Figure 9 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0076] Figure 10 A schematic structural diagram of another data security processing device provided by an embodiment of the present invention;

[0077] Figure 11 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0078] Figure 12 A flowchart of another data security processing method provided by an embodiment of the present invention;

[0079] Figure 13 A schematic structural diagram of another data security processing device provided by an embodiment of the present invention;

[0080] Figure 14 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0081] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0082] An embodiment of the present invention provides a data security processing method suitable for multi-party data collaboration tasks (including joint modeling, joint statistical analysis, etc.). The method is executed by a data security processing device, which can be implemented by software and / or hardware. The method defines data processing parties such as a trusted execution environment, a function provider, a data provider, a result receiver, and a task initiator. The following first describes each party as a separate execution entity.

[0083] It should be noted that in the embodiments of the present invention, the acquisition, storage and / or processing of the privacy data involved complies with the relevant provisions of national laws and regulations and does not violate public order and good morals.

[0084] Figure 1This is a flow chart of a data security processing method provided by an embodiment of the present invention. The method is applied to a trusted execution environment. A trusted execution environment (TEE) is a secure area within the main processor. It ensures that the code and data loaded inside are protected in terms of confidentiality and integrity. As an independent execution environment, the trusted execution environment provides security features such as isolated execution, the integrity of applications executed with the trusted execution environment, and the confidentiality of their data. The trusted execution environment provides an execution space that provides a higher level of security for trusted applications running on the device than the operating system. See Figure 1 ,The data security processing method is applied to a trusted execution environment, comprising the following steps:

[0085] S110 , obtaining the function file sent by the function provider, the task file sent by the task initiator, the private data sent by the data provider, and the path information sent by the result receiver.

[0086] Function files, private data, and path information are all bound and matched to the task file to ensure the security and accuracy of data transmission and processing. For example, Bank A and Insurance Company B are collaborating and need to perform joint calculations, queries, and analyses on Bank A's private data with Insurance Company B's. This can help analyze conversion rates, marketability, table joins, and aggregate values. For example, a trusted execution environment can be established on computers at either Bank A or Insurance Company B.

[0087] The function provider defines the processing logic according to the task. Specifically, the function provider can obtain the table structure of each data provider and provide a function file containing business logic based on the table structure. For example, the function provider can be established in the computer of Bank A or Insurance Company B. The task initiator creates a task file based on the specific task, thereby creating a task in a trusted execution environment. For example, the function provider or result receiver can be established in the computer of Bank A or Insurance Company B. The path information sent by the result receiver is a path on the computer where the result receiver is located, such as a URL (Uniform Resource Locator).

[0088] S120: After receiving the task start instruction sent by the task initiator, the private data is processed using the function file to obtain result data.

[0089] Among them, after receiving private data, the trusted execution environment also needs to receive a startup instruction before it can start data processing. This setting is conducive to improving the security of private data.

[0090] S130: Send the result data to the result receiver according to the path information.

[0091] Result data refers to the information needed for data collaboration, such as conversion rates, marketability, table joins, and summary values. In other words, after providing private data to the trusted execution environment, the trusted execution environment only outputs the final results, thus preventing the leakage of private data.

[0092] The embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment. For the trusted execution environment, the function file sent by the function provider, the task file sent by the task initiator, the privacy data sent by the data provider, and the path information sent by the result receiver are obtained; after receiving the task start instruction sent by the task initiator, the function file is used to process the privacy data to obtain the result data; the result data is sent to the result receiver according to the path information. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Because the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost.

[0093] Based on the above embodiments, optionally, after obtaining the function file sent by the function provider, the method further includes: numbering the function file to obtain a function number; and sending the function number to the function provider and the task initiator. The function number is the function ID, which identifies the function. This arrangement facilitates the subsequent binding and matching of the function ID with the task ID, thereby further enhancing the security of private data.

[0094] Based on the above embodiments, optionally, after obtaining the private data sent by the data provider, the process further includes: numbering the private data to obtain a first data number; and sending the first data number to the data provider. The first data number is the data ID, which identifies the private data. This arrangement facilitates subsequent binding and matching of the data ID with the task ID, thereby further enhancing the security of the private data.

[0095] Optionally, there are at least two data providers, and different data providers have different first data numbers. For example, Bank A and Insurance Company B are both data providers, and the data file sent by Bank A is marked as Data ID1, and the data file sent by Insurance Company B is marked as Data ID2.

[0096] Based on the above embodiments, optionally, after obtaining the path information sent by the result recipient, the method further includes: numbering the path information to obtain a path number; and sending the path number to the result recipient. The path number is the path ID, which identifies the path. This arrangement facilitates the subsequent binding and matching of the path ID with the task ID, further enhancing the security of private data.

[0097] Optionally, there are at least two result receivers, and different result receivers correspond to different path numbers. Bank A and Insurance Company B are both result receivers. The path information sent by Bank A is marked as path ID1, and the path information sent by Insurance Company B is marked as path ID2.

[0098] Based on the above embodiments, the method may optionally further include: obtaining a data receiving method sent by the result recipient; numbering the data receiving method to obtain a second data number; and sending the second data number to the result recipient. The second data number is a result data ID, or result data identifier. Exemplarily, the result data ID is bound to an output parameter of the function so that the result is sent based on the result data ID.

[0099] Optionally, the number of result receivers is at least two, and the second data numbers corresponding to the result receivers are the same. This arrangement can ensure that the result data received by the result receivers are the same.

[0100] Optionally, the task initiator, function provider, data provider, and result receiver send a function signature and generate a hash during the process of transferring file data to the trusted execution environment. Accordingly, the trusted execution environment returns the hash to each party, allowing each party to confirm that the file data has not been tampered with, further improving data security.

[0101] Based on the above embodiments, the data security processing method may optionally further include obtaining third-party authentication. The third party authenticates the security features of the trusted execution environment to ensure the secure storage and execution of data and code. For example, the third-party authentication of the trusted execution environment may support remote and offline authentication.

[0102] Based on the above embodiments, optionally, the private data is encrypted private data, and different data providers use different encryption methods, which further enhances the security of the private data.

[0103] Based on the above embodiments, optionally, before the result data is sent to the result recipient according to the path information, the method further includes: encrypting the result data and outputting the result through a secure transport layer protocol (TLS) trusted channel. Specifically, the private data is encrypted during transmission using a temporary key negotiated during the TLS handshake. This arrangement further enhances the security of the private data.

[0104] Based on the above embodiments, optionally, the data security processing method also includes: performing memory encryption on the trusted execution environment to form a memory isolation environment (enclave) protection, thereby ensuring the security of private data and code during storage and execution.

[0105] Based on the above embodiments, optionally, after the result data is sent to the result recipient according to the path information, the process further includes: executing a step of destroying the trusted execution environment. This configuration ensures that private data can only be used once, and the next use requires recreating the task and obtaining the consent of all parties, thereby ensuring that private data is not misused.

[0106] In summary, the embodiments of the present invention provide a method for private data collaboration based on a trusted execution environment (TEE). This method enables business processing using privacy-focused computing methods according to specific data collaboration processes, enabling multi-party data joint computing or modeling to fully explore and unlock the value of data. Because the TEE ensures the integrity and confidentiality of data and code, data remains available but invisible. Furthermore, the TEE offers high operational efficiency and low algorithm expansion costs. Therefore, the embodiments of the present invention improve the operational efficiency of data security processing and reduce algorithm expansion costs.

[0107] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 2 This is a schematic diagram of the structure of a data security processing device provided by an embodiment of the present invention. The device is applied to a trusted execution environment. Figure 2 The device includes: a data acquisition module 210, a data processing module 220 and a data sending module 230.

[0108] Among them, the data acquisition module 210 is used to obtain the function file sent by the function provider, the task file sent by the task initiator, the privacy data sent by the data provider, and the path information sent by the result receiver; among them, the function file, privacy data and path information are all bound and matched with the task file.

[0109] The data processing module 220 is used to process the private data using a function file to obtain result data after receiving the task approval instructions sent by the data provider and the result receiver, and the task start instruction sent by the task initiator.

[0110] The data sending module 230 is used to send the result data to the result receiver according to the path information.

[0111] An embodiment of the present invention provides a data security processing device for use in a trusted execution environment, comprising a data acquisition module, a data processing module, and a data transmission module. This embodiment of the present invention can perform business processing in accordance with a specific data collaboration process using privacy computing, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment ensures the integrity and confidentiality of data and code, data is available but invisible. Furthermore, the trusted execution environment offers high operational efficiency and low algorithm expansion costs. Therefore, this embodiment of the present invention improves the operational efficiency of data security processing and reduces algorithm expansion costs.

[0112] Based on the above embodiments, optionally, the data acquisition module is further configured to, after acquiring the function file sent by the function provider, number the function file to obtain a function number; and send the function number to the function provider and the task initiator.

[0113] Based on the above embodiments, optionally, the data acquisition module is further configured to, after acquiring the private data sent by the data provider, number the private data to obtain a first data number; and send the first data number to the data provider.

[0114] Based on the above embodiments, optionally, the number of data providers is at least two. Accordingly, the data acquisition module is further configured to assign different first data numbers to different data providers.

[0115] On the basis of the above embodiments, optionally, the data acquisition module is further configured to, after acquiring the path information sent by the result receiver, number the path information to obtain a path number; and send the path number to the result receiver.

[0116] Based on the above embodiments, optionally, the number of result receivers is at least two. Accordingly, the data acquisition module is further configured to assign different path numbers to different result receivers.

[0117] Based on the above embodiments, optionally, the data security processing device also includes: a receiving method acquisition module, used to obtain the data receiving method sent by the result receiver; number the data receiving method to obtain a second data number; and send the second data number to the result receiver.

[0118] Based on the above embodiments, optionally, the number of result receivers is at least two. Accordingly, the receiving mode acquisition module is further configured to make each result receiver correspond to the same second data number.

[0119] Based on the above embodiments, optionally, the data security processing device further includes: an authentication module, which is used to obtain authentication from a third party.

[0120] Based on the above embodiments, optionally, the private data is encrypted private data, and the encryption methods of different data providers are not exactly the same.

[0121] Based on the above embodiments, optionally, the data sending module is further configured to encrypt the result data before sending the result data to the result recipient according to the path information, and output the result through a secure transport layer protocol trusted channel.

[0122] Based on the above embodiments, optionally, the data security processing device further includes: a memory encryption module, which is used to perform memory encryption on the trusted execution environment.

[0123] Based on the above embodiments, optionally, the data security processing device further includes: a destruction module, configured to execute the step of destroying the trusted execution environment after sending the result data to the result receiver according to the path information.

[0124] Figure 3 This is a flow chart of another data security processing method provided by an embodiment of the present invention. This method is applied to the function provider. Figure 3 , the data security processing method includes the following steps:

[0125] S310: Obtain the data dictionary of the data provider.

[0126] A data dictionary defines and describes data items, data structures, data flows, data storage, and / or processing logic. In other words, a data dictionary is a collection of information describing the data. Function providers need to create functions based on tasks. Therefore, they have access to the data dictionaries of various data providers to build functions.

[0127] S320. Create a function file based on the function definition and the data dictionary.

[0128] The process of creating a function can use an input device to obtain software code typed by a programmer, or it can automatically generate a function file based on the function definition and data dictionary.

[0129] S330: Send the function file to the trusted execution environment.

[0130] An embodiment of the present invention provides a privacy data collaboration method based on a trusted execution environment. For a function provider, a function file is created and sent to the trusted execution environment so that the trusted execution environment can process data and output results. The embodiment of the present invention can perform business processing in accordance with a certain data collaboration process in a privacy computing manner, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the cost of algorithm expansion.

[0131] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 4 This is a structural diagram of another data security processing device provided by an embodiment of the present invention, which is applied to a function provider. Figure 4 The device includes: a data dictionary acquisition module 410, a function creation module 420, and a function sending module 430. The data dictionary acquisition module 410 is used to obtain the data dictionary of the data provider; the function creation module 420 is used to create a function file based on the function definition and the data dictionary; and the function sending module 430 is used to send the function file to the trusted execution environment.

[0132] An embodiment of the present invention provides a data security processing device for a function provider, including a data dictionary acquisition module 410, a function creation module 420, and a function sending module 430. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment ensures the integrity and confidentiality of data and code, it ensures that data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the cost of algorithm expansion.

[0133] Figure 5 A flow chart of another data security processing method provided by an embodiment of the present invention. This method is applied to the data provider. Figure 5 , the data security processing method includes the following steps:

[0134] S510: Encrypt the private data and send it to the trusted execution environment.

[0135] The data encryption method can be symmetric or asymmetric, which is not limited in this invention. Furthermore, the encrypted private data is transmitted to the trusted execution environment via the Transport Layer Security protocol. That is, the private data is encrypted during transmission using a temporary key negotiated during the TLS handshake, further enhancing the security of the private data.

[0136] S520: Obtain the first data number returned by the trusted execution environment.

[0137] The first data number is the data ID, which identifies the private data. This setting facilitates the subsequent binding and matching of the data ID with the task ID, thereby further improving the security of the private data.

[0138] S530: Bind the first data number to the input parameter of the function corresponding to the task number.

[0139] This setting defines the application scope of private data, which is only used as an input parameter of the function and not for other purposes.

[0140] An embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment. For the data provider, the encrypted privacy data is sent to the trusted execution environment, and the first data number is bound to the input parameter of the function corresponding to the task number. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in the form of privacy computing, perform multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the cost of algorithm expansion.

[0141] Optionally, the data security processing method further includes: sending an approval task instruction to the task initiator according to the task number. This arrangement allows the trusted execution environment to execute only after receiving approval from the data provider, thereby further improving the security of data processing.

[0142] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 6 This is a structural diagram of another data security processing device provided by an embodiment of the present invention, which is applied to a data provider. Figure 6The device includes: an encryption module 610, a first data number acquisition module 620, and an input parameter binding module 630. The encryption module 610 is used to encrypt the private data and send it to the trusted execution environment; the first data number acquisition module 620 is used to obtain the first data number returned by the trusted execution environment; and the input parameter binding module 630 is used to bind the first data number to the input parameter of the function corresponding to the task number.

[0143] An embodiment of the present invention provides a data security processing device for a data provider, comprising an encryption module 610, a first data number acquisition module 620, and an input parameter binding module 630. This embodiment of the present invention can perform business processing in accordance with a specific data collaboration process using privacy computing, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment ensures the integrity and confidentiality of data and code, data is available but invisible. Furthermore, the trusted execution environment has high operational efficiency and low algorithm expansion costs. Therefore, this embodiment of the present invention improves the operational efficiency of data security processing and reduces algorithm expansion costs.

[0144] Figure 7 A flowchart of another data security processing method provided by an embodiment of the present invention. This method is applied to the result receiving party. Figure 7 , the data security processing method includes the following steps:

[0145] S710: Send path information and data receiving mode to the trusted execution environment.

[0146] S720: Obtain the path number and the second data number returned by the trusted execution environment.

[0147] The path number is the path ID, which is the identifier of the path, and the second data number is the result data ID, which is the identifier of the result data.

[0148] S730: Bind the second data number to the output parameter of the function corresponding to the task number.

[0149] The result data ID is bound to the output parameter of the function so that the result is sent according to the result data ID.

[0150] S740: Receive result data sent by the trusted execution environment.

[0151] Among them, the result recipient only receives the final result output by the trusted execution environment and does not receive private data, thereby avoiding the leakage of private data.

[0152] The embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment. For the result recipient, the path information and data receiving method are sent to the trusted execution environment; the path number and second data number returned by the trusted execution environment are obtained; the second data number is bound to the output parameter of the function corresponding to the task number; and the result data sent by the trusted execution environment is received. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Since the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost.

[0153] Based on the above embodiments, the method for processing private data may optionally further include: sending a task approval instruction to the task initiator based on the task number. This configuration allows the trusted execution environment to execute only after receiving approval from the result recipient, further enhancing the security of data processing.

[0154] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 8 This is a structural diagram of another data security processing device provided by an embodiment of the present invention, which is applied to the result receiving party. Figure 8 The device includes: a path information sending module 810, a second data number acquisition module 820, an output parameter binding module 830, and a result data receiving module 840. The path information sending module 810 is used to send path information and a data receiving method to the trusted execution environment; the second data number acquisition module 820 is used to obtain the path number and second data number returned by the trusted execution environment; the output parameter binding module 830 is used to bind the second data number to the output parameter of the function corresponding to the task number; and the result data receiving module 840 is used to receive the result data sent by the trusted execution environment.

[0155] An embodiment of the present invention provides a data security processing device for a result recipient, comprising a path information sending module 810, a second data number acquisition module 820, an output parameter binding module 830, and a result data receiving module 840. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy-preserving manner, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment ensures the integrity and confidentiality of data and code, it ensures that data is available but invisible. Furthermore, the trusted execution environment has high operating efficiency and low algorithm expansion costs. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces algorithm expansion costs.

[0156] Figure 9 A flowchart of another data security processing method provided by an embodiment of the present invention. This method is applied to the task initiator. Figure 9 , the data security processing method includes the following steps:

[0157] S910: Create a task file and send the task file to the trusted execution environment.

[0158] The process of creating a task can use an input device to obtain software code typed by a programmer, or can automatically generate a task file based on task attributes.

[0159] S920: Obtain the task number returned by the trusted execution environment.

[0160] The task number is the task ID, or task identifier. The function ID, data ID, path ID, and / or result data ID all need to be bound to the task ID.

[0161] S930: Send a start task instruction to the trusted execution environment according to the task number.

[0162] Optionally, after receiving the task approval instruction from the function provider, a start task instruction is sent to the trusted execution environment. This setting is equivalent to the user authorizing the use of data and code, allowing the trusted execution environment to ensure the integrity and confidentiality of data and code, ensuring that data is available but not visible.

[0163] An embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment. For the task initiator, a task file is created and sent to the trusted execution environment; the task number returned by the trusted execution environment is obtained; and a start-task instruction is sent to the trusted execution environment according to the task number. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Since the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost.

[0164] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 10 This is a structural diagram of another data security processing device provided by an embodiment of the present invention, which is applied to the task initiator. Figure 10The device includes a task creation and sending module A10, a task number acquisition module A20, and a start instruction sending module A30. The task creation and sending module A10 is used to create a task file and send it to a trusted execution environment; the task number acquisition module A20 is used to obtain a task number returned by the trusted execution environment; and the start instruction sending module A30 is used to send a start task instruction to the trusted execution environment based on the task number.

[0165] An embodiment of the present invention provides a data security processing device for a task initiator, comprising a task creation and sending module A10, a task number acquisition module A20, and a start instruction sending module A30. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, conduct multi-party data joint computing or modeling, and fully explore and release the value of data. Because the trusted execution environment ensures the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the cost of algorithm expansion.

[0166] Figure 11 A flowchart of another data security processing method provided by an embodiment of the present invention. Figure 11 , the data security processing method includes the following steps:

[0167] SB10. The function provider sends the function file to the trusted execution environment.

[0168] SB20: The task initiator sends the task file to the trusted execution environment.

[0169] SB30. The data provider sends private data to the trusted execution environment.

[0170] SB40: The result receiving direction sends the path information to the trusted execution environment.

[0171] Among them, the function file, private data and path information are all bound and matched with the task file.

[0172] SB50. After receiving the task start instruction sent by the task initiator, the trusted execution environment uses the function file to process the private data, obtains the result data, and sends the result data to the result receiver.

[0173] SB60. The result receiver receives the result data.

[0174] The embodiment of the present invention provides a privacy data cooperation method based on a trusted execution environment, which defines multiple roles in data cooperation tasks, including: data provider, result receiver, function provider, task initiator and trusted execution environment. A set of data cooperation processes, in which all parties work together to complete a data cooperation task (including joint modeling, joint statistical analysis, etc.) and ensure the confidentiality and integrity of their respective codes and data; and a security demonstration is made on how to protect data codes during data and code upload, transmission, storage and execution. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Since the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost.

[0175] Figure 12 A flowchart of another data security processing method provided by an embodiment of the present invention. Figure 12 Based on the above embodiments, optionally, the data security processing method includes the following steps:

[0176] The task initiator formulates the task and requests the function; after the function provider user logs in, he uploads the function and passes the function ID; after the task initiator user logs in, he submits the task and passes the task ID; after the data provider user logs in, he registers the data and binds the ID; after the result receiver user logs in, he registers the path and binds the ID; the data provider and result receiver approve the task; the task initiator starts the task; the trusted execution environment processes the data; and the result receiver receives the data.

[0177] The task initiator, function provider, data provider, and result receiver all need to log in and obtain the appropriate permissions. Function providers must also create functions based on the task initiator's request before uploading them. Data providers register data with the trusted execution environment, and ID binding binds the data ID to the task ID. Result receivers register paths with the trusted execution environment, and ID binding binds the result data ID to the task ID.

[0178] An embodiment of the present invention further provides a data security processing device, which can be implemented by software and / or hardware. Figure 13 This is a structural diagram of another data security processing device provided by an embodiment of the present invention. Figure 13The device includes: a function provider D10, a task initiator D20, a data provider D30, a result receiver D40, and a trusted execution environment D50. The function provider D10 is used to send a function file to the trusted execution environment; the task initiator D20 is used to send a task file to the trusted execution environment; the data provider D30 is used to send private data to the trusted execution environment; and the result receiver D40 is used to send path information to the trusted execution environment. The function file, private data, and path information are all bound and matched with the task file. After receiving the task start instruction sent by the task initiator, the trusted execution environment D50 uses the function file to process the private data, obtain result data, and send the result data to the result receiver. The result receiver D40 is also used to receive the result data. There can be multiple data providers and result receivers.

[0179] The embodiment of the present invention provides a privacy data cooperation device based on a trusted execution environment, which defines multiple roles of data cooperation tasks, including: data provider, result receiver, function provider, task initiator and trusted execution environment. A set of data cooperation processes, in which all parties work together to complete a data cooperation task (including joint modeling, joint statistical analysis, etc.) and ensure the confidentiality and integrity of their respective codes and data; and a security demonstration is made on how to protect data codes during data and code upload, transmission, storage and execution. The embodiment of the present invention can perform business processing in accordance with a certain data cooperation process in a privacy computing manner, perform multi-party data joint calculation or modeling, and fully explore and release the value of data. Since the trusted execution environment guarantees the integrity and confidentiality of data and code, it ensures that the data is available but invisible. In addition, the trusted execution environment has high operating efficiency and low algorithm expansion cost. Therefore, the embodiment of the present invention improves the operating efficiency of data security processing and reduces the algorithm expansion cost.

[0180] Figure 14 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention is shown in FIG. Figure 14 As shown, the terminal includes a processor E0, a memory E1, an input device E2 and an output device E3; the number of processors E0 in the terminal can be one or more. Figure 14 In the example, a processor E0 is used; the processor E0, the memory E1, the input device E2 and the output device E3 in the terminal can be connected by a bus or other means. Figure 14 The bus connection is taken as an example.

[0181] The memory E1, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as the program instructions / modules corresponding to the data security processing method in the embodiment of the present invention (for example, for a terminal in a trusted execution environment, the program instructions / module include a data acquisition module 210, a data processing module 220 and a data sending module 230; for a function provider terminal, the program instructions / module include a data dictionary acquisition module 410, a function creation module 420 and a function sending module 430; for a data provider terminal, the program instructions / module include an encryption module 610, a first data number acquisition module 620 and an input parameter binding module 630; for a result receiving terminal, the program instructions / module include a path information sending module 810, a second data number acquisition module 820, an output parameter binding module 830 and a result data receiving module 840; for a task initiator terminal, the program instructions / module include a task creation and sending module A10, a task number acquisition module A20 and a start instruction sending module A30). The processor E0 executes various functional applications and data processing of the terminal by running the software programs, instructions and modules stored in the memory E1, that is, implements the above-mentioned data security processing method.

[0182] Memory E1 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function; the data storage area may store data generated based on the use of the terminal. Furthermore, memory E1 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state memory device. In some instances, memory E1 may further include memory remotely located relative to processor E0, and these remote memories may be connected to the terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0183] The input device E2 can be used to receive input digital or character information and generate key signal input related to user settings and function control of the terminal. The output device E3 can include a display device such as a display screen.

[0184] It should be noted that the above terminals can be configured in one computer, or respectively configured in multiple computers. In actual applications, they can be set as needed, and the present invention does not limit this.

[0185] An embodiment of the present invention further provides a storage medium comprising computer-executable instructions, wherein the computer-executable instructions are used to execute any one of the data security processing methods when executed by a computer processor.

[0186] Of course, the storage medium containing computer-executable instructions provided in an embodiment of the present invention is not limited to the method operations described above, and can also execute related operations in the data security processing method provided in any embodiment of the present invention.

[0187] Through the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented with the help of software and necessary general-purpose hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0188] It is worth noting that in the embodiment of the above-mentioned data security processing device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0189] An embodiment of the present invention further provides a data security processing system, comprising: a function provider terminal, a task initiator terminal, a data provider terminal, a result receiver terminal and a trusted execution environment terminal.

[0190] A trusted execution environment terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, any one of the data security processing methods for a trusted execution environment provided in the embodiments of the present invention is implemented, including:

[0191] Obtain the function file sent by the function provider, the task file sent by the task initiator, the private data sent by the data provider, and the path information sent by the result receiver; the function file, private data, and path information are all bound and matched with the task file;

[0192] After receiving the task start instruction sent by the task initiator, the function file is used to process the private data to obtain the result data;

[0193] The result data is sent to the result receiver according to the path information.

[0194] The function provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method applied to the function provider as provided in any embodiment of the present invention is implemented, including:

[0195] Get the data dictionary of the data provider;

[0196] Create function files based on function definitions and data dictionaries;

[0197] Send the function file to the trusted execution environment.

[0198] The data provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method applied to the data provider as provided in any embodiment of the present invention is implemented, including:

[0199] After encrypting the private data, send it to the trusted execution environment;

[0200] Obtain the first data number returned by the trusted execution environment;

[0201] Bind the first data number to the input parameter of the function corresponding to the task number.

[0202] The result receiving terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method applied to the result receiving terminal provided in any embodiment of the present invention is implemented, including:

[0203] Send path information and data receiving method to the trusted execution environment;

[0204] Obtain the path number and second data number returned by the trusted execution environment;

[0205] Bind the second data number to the output parameter of the function corresponding to the task number;

[0206] Receive result data sent by the trusted execution environment.

[0207] The task initiator terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method for the task initiator provided in any embodiment of the present invention is implemented, including:

[0208] Create a task file and send the task file to the trusted execution environment;

[0209] Get the task number returned by the trusted execution environment;

[0210] Send a start task instruction to the trusted execution environment according to the task number.

[0211] Note that the above are only preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the concept of the present invention. The scope of the present invention is determined by the scope of the appended claims.

Claims

1. A data security processing method, characterized in that: The method is applied to a trusted execution environment; the method comprises: Obtaining a function file sent by a function provider, a task file sent by a task initiator, private data sent by a data provider, and path information sent by a result receiver; wherein the function file, the private data, and the path information are all bound and matched with the task file; After receiving the task start instruction sent by the task initiator, the function file is used to process the private data to obtain result data; Sending the result data to the result receiver according to the path information; The function provider defines processing logic according to the task, obtains the table structure of each data provider, and provides a function file containing business logic according to the table structure; the task initiator creates a task file according to the specific task and creates the task in the trusted execution environment; the path information sent by the result receiver is a path on the computer where the result receiver is located; The private data is encrypted private data, and the encryption methods used by different data providers are not exactly the same; The method further comprises: performing memory encryption on the trusted execution environment; After sending the result data to the result receiver according to the path information, the method further includes: executing a step of destroying the trusted execution environment.

2. The data security processing method according to claim 1, characterized in that: After obtaining the function file sent by the function provider, it also includes: Numbering the function files to obtain function numbers; The function number is sent to the function provider and the task initiator.

3. The data security processing method according to claim 1, characterized in that: After obtaining the private data sent by the data provider, it also includes: Numbering the private data to obtain a first data number; The first data number is sent to the data provider.

4. The data security processing method according to claim 3, characterized in that: The number of the data providers is at least two, and the first data numbers corresponding to different data providers are different.

5. The data security processing method according to claim 1, characterized in that: After obtaining the path information sent by the result recipient, it also includes: Numbering the path information to obtain a path number; The path number is sent to the result recipient.

6. The data security processing method according to claim 5, characterized in that: The number of the result receivers is at least two, and the path numbers corresponding to different result receivers are different.

7. The data security processing method according to claim 1, characterized in that: Also includes: Get the data receiving method sent by the result receiver; Numbering the data receiving mode to obtain a second data number; The second data number is sent to the result recipient.

8. The data security processing method according to claim 7, characterized in that: The number of the result receivers is at least two, and the second data numbers corresponding to the result receivers are the same.

9. The data security processing method according to claim 1, characterized in that: Also includes: Obtain third-party certification.

10. The data security processing method according to claim 1, characterized in that: Before sending the result data to the result receiver according to the path information, the method further includes: The result data is encrypted and outputted via a secure transport layer protocol trusted channel.

11. A data security processing device, characterized in that: The device is applied to a trusted execution environment; the device includes: A data acquisition module, configured to acquire a function file sent by a function provider, a task file sent by a task initiator, private data sent by a data provider, and path information sent by a result receiver; wherein the function file, private data, and path information are all bound and matched to the task file; a data processing module, configured to, after receiving the task approval instructions sent by the data provider and the result recipient, and the task start instruction sent by the task initiator, use the function file to process the private data to obtain result data; A data sending module, configured to send the result data to the result receiver according to the path information; The function provider defines processing logic according to the task, obtains the table structure of each data provider, and provides a function file containing business logic according to the table structure; the task initiator creates a task file according to the specific task and creates the task in the trusted execution environment; the path information sent by the result receiver is a path on the computer where the result receiver is located; The private data is encrypted private data, and the encryption methods used by different data providers are not exactly the same; Wherein, the data security processing device further includes: a memory encryption module for performing memory encryption on the trusted execution environment; The data security processing device further includes: a destruction module, which is used to execute the step of destroying the trusted execution environment after sending the result data to the result receiver according to the path information.

12. A data security processing method, characterized in that: The method is applied to the function provider according to any one of claims 1 to 10; the method comprises: Get the data dictionary of the data provider; Create a function file based on the function definition and the data dictionary; Send the function file to the trusted execution environment.

13. A data security processing device, characterized in that: The device is applied to the function provider according to any one of claims 1 to 10; the device comprises: A data dictionary acquisition module is used to obtain the data dictionary of the data provider; A function creation module, used for creating a function file according to the function definition and the data dictionary; The function sending module is used to send the function file to the trusted execution environment.

14. A data security processing method, characterized in that: The method is applied to the data provider according to any one of claims 1 to 10; the method comprises: After encrypting the private data, send it to the trusted execution environment; Obtaining a first data number returned by the trusted execution environment; Bind the first data number to the input parameter of the function corresponding to the task number.

15. The data security processing method according to claim 14, characterized in that: Also includes: According to the task number, send the task approval instruction to the task initiator.

16. The data security processing method according to claim 14, characterized in that: The encrypted private data is transmitted to the trusted execution environment via a secure transport layer protocol.

17. A data security processing device, characterized in that: The device is applied to the data provider according to any one of claims 1 to 10; the device includes: An encryption module, used to encrypt private data and send it to a trusted execution environment; A first data number obtaining module, configured to obtain a first data number returned by the trusted execution environment; An input parameter binding module is used to bind the first data number to the input parameter of the function corresponding to the task number.

18. A data security processing method, characterized in that: The method is applied to the result receiver according to any one of claims 1 to 10; the method comprises: Send path information and data receiving method to the trusted execution environment; Obtaining a path number and a second data number returned by the trusted execution environment; Binding the second data number to the output parameter of the function corresponding to the task number; Receive result data sent by the trusted execution environment.

19. The data security processing method according to claim 18, characterized in that: Also includes: According to the task number, send the task approval instruction to the task initiator.

20. A data security processing device, characterized in that: The device is applied to the result receiver according to any one of claims 1 to 10; the device includes: A path information sending module, used to send path information and data receiving mode to the trusted execution environment; A second data number acquisition module, configured to acquire a path number and a second data number returned by the trusted execution environment; an output parameter binding module, configured to bind the second data number to an output parameter of a function corresponding to the task number; The result data receiving module is configured to receive the result data sent by the trusted execution environment.

21. A data security processing method, characterized in that: The method is applied to the task initiator according to any one of claims 1 to 10; the method comprises: Creating a task file, and sending the task file to a trusted execution environment; Obtaining a task number returned by the trusted execution environment; Send a start task instruction to the trusted execution environment according to the task number.

22. The data security processing method according to claim 21, characterized in that: After receiving the task approval instruction sent by the function provider, the task start instruction is sent to the trusted execution environment.

23. A data security processing device, characterized in that: The device is applied to the task initiator according to any one of claims 1 to 10; the device includes: A task creation and sending module, used for creating a task file and sending the task file to the trusted execution environment; A task number acquisition module, configured to acquire the task number returned by the trusted execution environment; A startup instruction sending module is used to send a startup task instruction to the trusted execution environment according to the task number.

24. A data security processing method, characterized in that: include: The function provider sends a function file to the trusted execution environment, the task initiator sends a task file to the trusted execution environment, the data provider sends private data to the trusted execution environment, and the result receiver sends path information to the trusted execution environment; wherein the function file, the private data, and the path information are all bound and matched with the task file; After receiving the task start instruction sent by the task initiator, the trusted execution environment uses the function file to process the private data to obtain result data, and sends the result data to the result receiver; The result receiving party receives the result data; The function provider defines processing logic according to the task, obtains the table structure of each data provider, and provides a function file containing business logic according to the table structure; the task initiator creates a task file according to the specific task and creates the task in the trusted execution environment; the path information sent by the result receiver is a path on the computer where the result receiver is located; The private data is encrypted private data, and the encryption methods used by different data providers are not exactly the same; The method further comprises: performing memory encryption on the trusted execution environment; Wherein, after the result receiver receives the result data, the method further includes: executing the step of destroying the trusted execution environment.

25. A data security processing device, characterized in that: include: Function provider, used to send function files to the trusted execution environment; A task initiator, configured to send a task file to the trusted execution environment; A data provider, configured to send private data to the trusted execution environment; A result receiver is configured to send path information to the trusted execution environment; wherein the function file, the private data, and the path information are all bound and matched with the task file; The trusted execution environment is configured to, after receiving the task start instruction sent by the task initiator, use the function file to process the private data to obtain result data, and send the result data to the result receiver; The result receiver is used to receive the result data; The function provider defines processing logic according to the task, obtains the table structure of each data provider, and provides a function file containing business logic according to the table structure; the task initiator creates a task file according to the specific task and creates the task in the trusted execution environment; the path information sent by the result receiver is a path on the computer where the result receiver is located; The private data is encrypted private data, and the encryption methods used by different data providers are not exactly the same; Wherein, the data security processing device further includes: a memory encryption module, configured to perform memory encryption on the trusted execution environment; The data security processing device further includes: a destruction module, configured to execute a step of destroying the trusted execution environment after the result receiver receives the result data.

26. A terminal, a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the data security processing method as described in any one of claims 1-10, 12, 14-16, 18-19, 21-22, and 24 is implemented.

27. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data security processing method as described in any one of claims 1-10, 12, 14-16, 18-19, 21-22, and 24 is implemented.

28. A data security processing system, characterized in that: include: Function provider terminal, task initiator terminal, data provider terminal, result receiver terminal and trusted execution environment terminal; The trusted execution environment terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data security processing method according to any one of claims 1 to 10 when executing the program; The function provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data security processing method according to claim 12 when executing the program; The data provider terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data security processing method according to any one of claims 14 to 16 when executing the program; The result receiving terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data security processing method according to any one of claims 18 to 19 when executing the program; The task initiator terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the data security processing method according to any one of claims 21 to 22 is implemented.

Images