Data processing method, electronic device, and computer storage medium

Abstract

The present disclosure provides a data processing method, applied to a trusted computing platform, the method comprising: receiving a data use request of a data demander, generating a platform key pair; wherein the platform key pair comprises a platform private key and a platform public key; issuing the platform key pair to a data provider; wherein the platform public key is used by the data provider to encrypt original data, and the platform private key is used by the data provider to sign the original data; receiving a demander public key generated by the data demander; receiving an encrypted original data packet obtained by the data provider using the platform public key; performing data processing on the original data in the encrypted original data packet to generate a target data packet; encrypting the target data packet using the demander public key to obtain an encrypted target data packet; and sending the encrypted target data packet to the data demander; and performing transaction data processing through the trusted computing platform, thereby improving the security and trustworthiness in the data interaction process.

Description

Technical Field

[0001] The present disclosure relates to the field of network technology, and in particular to a data processing method, an electronic device, and a computer storage medium. Background Art

[0002] Since data demanders and data suppliers need a highly trusted and secure data exchange method, the traditional data exchange method is to directly send data through a specific API for data exchange, but this may lead to the leakage or loss of key data due to insecure communication.

[0003] Therefore, there is a need for a device that can improve the security of the transaction data exchange process. Summary of the Invention

[0004] The present disclosure provides a data processing method and device, an electronic device, and a computer storage medium.

[0005] A first aspect of the present disclosure provides a data processing method, which is applied to a trusted computing platform, and the method includes: receiving a data use request from a data demander, and generating a platform key pair; wherein the platform key pair includes: a platform private key and a platform public key; issuing the platform key pair to the data provider; wherein the platform public key is used by the data provider to encrypt original data, and the platform private key is used by the data provider to sign the original data; receiving a demander public key generated by the data demander; receiving an encrypted original data packet from the data provider encrypted using the platform public key; performing data processing on the original data in the encrypted original data to generate a target data packet; encrypting the target data packet using the demander public key to obtain an encrypted target data packet; and sending the encrypted target data packet to the data demander.

[0006] Optionally, the encrypted original data packet includes at least one of the following: encrypted original data; a signature of the original data; a first hash value of the original data; or a processing algorithm code for the original data.

[0007] Optionally, the data processing of the original data in the encrypted original data packet to generate a target data packet includes: verifying the encrypted original data packet using the platform public key; if the verification passes, decrypting the encrypted original data packet using the platform private key to obtain the original data; calculating a second hash value of the decrypted original data, comparing the first hash value and the second hash value, and if the first hash value and the second hash value meet a consistency condition, desensitizing the original data to generate a target data packet.

[0008] Optionally, the data processing of the original data in the encrypted original data packet to generate a target data packet includes: verifying the integrity of the original data; if the original data meets the integrity condition, deleting sensitive information of the original data according to the processing algorithm code about the original code to generate target data; and packaging the target data to generate a target data packet.

[0009] Optionally, after sending the encrypted target data packet to the data requester, the method further includes: receiving the target data obtained by the data requester decrypting the encrypted target data packet; sending the first hash value of the target data to the data requester; wherein the first hash value of the target data is used for comparison and verification with the second hash value of the target data calculated by the data requester.

[0010] A second aspect of the present disclosure provides a data processing method, which is applied to a data provider. The method includes: receiving a platform key pair issued by a trusted computing platform; wherein the platform key pair includes: a platform private key and a platform public key; encrypting the original data using the platform public key, signing the original data using the platform private key, and generating an encrypted original data packet; sending the encrypted original data packet to the trusted computing platform, where the encrypted original data packet is used by the trusted computing platform to encrypt and generate a target data packet, and sending the target data packet to the data demander.

[0011] Optionally, the encrypted original data packet includes at least one of the following: encrypted original data; a signature of the original data; a first hash value of the original data; or a processing algorithm code for the original data.

[0012] The third aspect of the present disclosure provides a data processing method, which is applied to a data demander, and the method includes: sending a data usage request to a trusted computing platform; generating a public key and a private key of the demander; sending the public key of the demander to the trusted computing platform; and receiving an encrypted target data packet generated by the trusted computing platform based on the public key of the demander.

[0013] Optionally, after receiving the encrypted target data packet generated by the trusted computing platform according to the public key of the demander, the method further includes: decrypting the encrypted target data packet using the private key of the demander to obtain target data; obtaining the first hash value of the target data calculated by the trusted computing platform; calculating the second hash value of the target data, and comparing the first hash value of the target data with the second hash value of the target data; if the first hash value of the target data and the second hash value of the target data meet the consistency condition, the target data passes the verification; and storing the target data.

[0014] A fourth aspect of the present disclosure provides a data processing device, the device comprising:

[0015] The first generating module is used to receive a data usage request from a data demander and generate a platform key pair; wherein, the platform key pair includes: a platform private key and a platform public key; the issuing module is used to issue the platform key pair to the data provider; wherein, the platform public key is used by the data provider to encrypt the original data, and the platform private key is used by the data provider to sign the original data; the first receiving module is used to receive the demander public key generated by the data demander; the second receiving module is used to receive the encrypted original data packet encrypted by the data provider using the platform public key; the second generating module is used to process the original data in the encrypted original data and generate a target data packet; the first determining module is used to encrypt the target data packet using the demander public key to obtain an encrypted target data packet; the first sending module is used to send the encrypted target data packet to the data demander.

[0016] The fifth aspect of the present disclosure provides a data processing device, which includes: a third receiving module, used to receive a platform key pair issued by a trusted computing platform; wherein the platform key pair includes: a platform private key and a platform public key; a third generating module, used to encrypt the original data using the platform public key, sign the original data using the platform private key, and generate an encrypted original data packet; a first sending module, used to send the encrypted original data packet to the trusted computing platform, the encrypted original data packet is used by the trusted computing platform to encrypt and generate a target data packet, and the target data packet is sent to the data demander.

[0017] The sixth aspect of the present disclosure provides a data processing device, which includes: a second sending module for sending a data usage request to a trusted computing platform; a fourth generating module for generating a public key and a private key of the demander; a third sending module for sending the public key of the demander to the trusted computing platform; and a fourth receiving module for receiving an encrypted target data packet generated by the trusted computing platform based on the public key of the demander.

[0018] A seventh aspect of the present disclosure provides an electronic device, comprising:

[0019] processor;

[0020] A memory for storing a computer program that can be run on a processor; wherein, when the processor is used to run the computer program, it executes the steps of the data processing method described in any one of the first aspect, the second aspect or the third aspect.

[0021] An eighth aspect of the present disclosure provides a computer storage medium storing computer-executable instructions; the computer-executable instructions are executed by a processor to implement the steps of the data processing method as described in any one of the first, second or third aspects above.

[0022] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: the embodiments of the present disclosure disclose receiving an encrypted original data packet obtained by encrypting the data provider using the platform public key; performing data processing on the original data in the encrypted original data to generate a target data packet; encrypting the target data packet using the public key of the demander to obtain an encrypted target data packet; and sending the encrypted target data packet to the data demander. Compared with the prior art in which the task of processing data is not delivered to a trusted computing platform, resulting in insecurity and distrust between the data provider and the data demander, the present application improves the security of data exchange and enhances the mutual trust between the data provider and the data demander.

[0023] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a data processing method is shown as an exemplary embodiment;

[0025] Figure 2 A flowchart of a data processing method is shown as an exemplary embodiment;

[0026] Figure 3 A flowchart of a data processing method is shown as an exemplary embodiment;

[0027] Figure 4 A flowchart of a data processing method is shown as an exemplary embodiment;

[0028] Figure 5 A flowchart of a data processing method is shown as an exemplary embodiment;

[0029] Figure 6 A flowchart of a data processing method is shown as an exemplary embodiment;

[0030] Figure 7 A flowchart of a data processing method is shown as an exemplary embodiment;

[0031] Figure 8 A flowchart of a data processing method is shown as an exemplary embodiment;

[0032] Figure 9A flowchart of a data processing method is shown as an exemplary embodiment;

[0033] Figure 10 This is a schematic structural diagram of a data processing device according to an exemplary embodiment;

[0034] Figure 11 This is a schematic structural diagram of a data processing device according to an exemplary embodiment;

[0035] Figure 12 This is a schematic structural diagram of a data processing device according to an exemplary embodiment;

[0036] Figure 13 The figure is a schematic structural diagram of a data processing device according to an exemplary embodiment. DETAILED DESCRIPTION

[0037] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible implementations consistent with the present disclosure. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present disclosure, as detailed in the accompanying application documents.

[0038] In the embodiment of the present disclosure, Figure 1 as well as Figure 2 As shown, a data processing method is provided, which is applied to a trusted computing platform, and the method includes:

[0039] Step S101: Receive a data usage request from a data requester and generate a platform key pair; wherein the platform key pair includes: a platform private key and a platform public key;

[0040] Step S102: Send the platform key pair to the data provider; wherein the platform public key is used by the data provider to encrypt the original data, and the platform private key is used by the data provider to sign the original data;

[0041] Step S103, receiving the public key of the data requester generated by the data requester;

[0042] Step S104, receiving the encrypted original data packet encrypted by the platform public key from the data provider;

[0043] Step S105, performing data processing on the original data in the encrypted original data to generate a target data packet;

[0044] Step S106, encrypting the target data packet using the public key of the demander to obtain an encrypted target data packet;

[0045] Step S107: sending the encrypted target data packet to the data requester.

[0046] In the embodiment of the present disclosure, the trusted computing platform is used to act as a third party between the data provider and the data demander, and is connected to the database of the data provider and the database of the data demander. Data is uniformly encrypted and exchanged on the trusted computing platform.

[0047] In the embodiments of the present disclosure, the trusted computing platform is constructed based on trusted computing technology.

[0048] In the embodiment of the present disclosure, in step S101, the platform private key is PK 可信 Indicates that the platform public key is SK 可信 Indicates that the platform public key is used for encryption and the platform private key is used for decryption.

[0049] In the embodiment of the present disclosure, in step S102, the platform key pair is sent to the data provider. The data provider receives the platform public key PK of the platform key pair. 可信 Then, it is used to encrypt the original data Data: encry = encrypt (Data, PK 可信 ), and the platform private key SK 可信 It is used by the data provider to sign the original data after completing the encryption of the original data.

[0050] In the disclosed embodiment, after the data supplier completes the encryption and signing of the original data using the platform public key, it will upload the encrypted original data packet consisting of the encrypted original data, the signature of the original data, and the hash value and algorithm code of the original data to the trusted computing platform.

[0051] In this disclosed embodiment, in step S103, a public key generated by the data requester is received. The data requester generates a pair of keys, including a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt data. Here, the trusted computing platform receives the public key and uses it to encrypt the target data.

[0052] In the disclosed embodiment, in step S104, the trusted computing platform receives the encrypted original data packet from the data provider, which is encrypted using the platform public key. Upon receiving the encrypted original data packet, the trusted computing platform verifies the signature of the original data using the platform public key. Once the signature is verified, the trusted computing platform decrypts the data using the platform private key to obtain the original data.

[0053] In the disclosed embodiment, in step S105, after the trusted computing platform obtains the decrypted original data, it processes the original data to generate target data. Here, step S105 includes but is not limited to: recalculating and comparing hash values ​​to verify data integrity, processing the original data using algorithm code, and desensitizing the original data to obtain the target data.

[0054] In the disclosed embodiment, the algorithm code is a code based on the data desensitization algorithm and rules, for example, the same language used in the data processing rules formulated by the trusted computing platform, including but not limited to: SQL language, C / C++ language, JAVA language, etc.

[0055] In the embodiment of the present disclosure, the data provider sends the original data and the processing logic written in the same language as that used by the trusted computing platform to the trusted computing platform.

[0056] In one embodiment, the processing logic includes but is not limited to: deleting certain user names in the original data, such as real names and / or users whose names are marked as not willing to be used publicly; deleting user identity information data, such as ID card number, detailed address of residence or delivery, age information, height information, etc.; merging certain data information, such as data information of the same type of goods purchased on the same e-commerce website or in the same online store, where the data information is relatively scattered, but can be classified into one category.

[0057] In one embodiment, the trusted computing platform calls a processing module, which is written in the same language as the algorithm code. The processing module executes processing logic to process the original data and generate a target data packet.

[0058] In the embodiment of the present disclosure, in step S106, the public key PK of the demander is used 需求方 Encrypt the target data packet to obtain encrypted target data res=encrypt(result,PK 需求方 ). At the same time, the trusted computing platform records the data of each node in the transaction process.

[0059] In the embodiment of the present disclosure, in step S107, the encrypted target data packet is sent to the data requester. 需求方 ) will use its own demander private key SK 需求方 Decryption res = encrypt (result, PK 需求方 ) to obtain the decrypted target data.

[0060] In the embodiment of the present disclosure, since a trusted computing platform is introduced between the data provider and the data demander, a secure exchange environment is provided for data exchange. After the data provider and the data demander negotiate and initiate data exchange, the trusted computing platform will use a specific algorithm to process the original information of the data provider, such as deleting user information and some sensitive information. The use of a trusted computing platform can reduce errors that occur in the information processing process and provide data security and reliability during the data exchange process.

[0061] In the disclosed embodiment, the encrypted original data packet includes at least one of the following: encrypted original data; a signature of the original data; a first hash value of the original data; and a processing algorithm code for the original data.

[0062] In the embodiment of the present disclosure, the original data includes but is not limited to: user operation behavior data, user sensitive information, etc.

[0063] In the embodiments of the present disclosure, the user's operation behavior data includes but is not limited to one or a combination of the following: user click behavior data; user purchase behavior data; user collection behavior data; user add to cart behavior data; user comment behavior data; user blocking behavior data; user browsing time; user video viewing history data; user unfollowing or unsubscribing behavior data.

[0064] In the disclosed embodiment, the signature of the original data is a cryptographic transformation performed on the original data unit to allow the trusted computing platform to confirm the source and integrity of the original data and prevent forgery.

[0065] In the embodiment of the present disclosure, the first hash value of the original data is calculated by the data provider and is used to compare and verify the original data.

[0066] In the embodiment of the present disclosure, regarding the processing algorithm code of the original data, the algorithm code is used for the trusted computing platform to process the original data based on the algorithm code to obtain the target data, including but not limited to: deleting certain user names in the original data, such as users whose names are marked as not willing to be used publicly, etc.; deleting user identity information data, such as ID card number, detailed address of residence or delivery, age information, gender information, height information, etc.; merging certain data information, such as data information of the same type of goods purchased on the same e-commerce website or in the same online store. The data information here is relatively scattered, but can be classified into one category.

[0067] In the disclosed embodiment, the encrypted data packet generated by the data provider is sent to the trusted computing platform for desensitization processing. The encrypted original data can improve the confidentiality of the original data, the signature of the original data can reduce the possibility of the original data being forged, the first hash value of the original data can be used to verify the original data, and the algorithm code of the original data facilitates the trusted computing platform to process the original data. In this way, the security of the original data transmission can be improved, and the trusted computing platform can facilitate the processing of the original data.

[0068] In the embodiment of the present disclosure, Figure 3 As shown, step S105, processing the original data in the encrypted original data packet to generate a target data packet, includes:

[0069] Step S1051, verifying the encrypted original data packet using the platform public key;

[0070] Step S1052: If the verification is successful, decrypt the encrypted original data packet using the platform private key to obtain the original data;

[0071] Step S1053: Calculate the second hash value of the decrypted original data, and compare the first hash value of the original data with the second hash value of the original data.

[0072] Step S1054: If the first hash value of the original data and the second hash value of the original data meet the consistency condition, desensitization processing is performed on the original data to generate a target data packet.

[0073] In the embodiment of the present disclosure, regarding step S1051 and step S1052, since the encrypted original data in the encrypted original data packet is encrypted by the data provider using the platform private key issued to the data provider by the trusted computing platform before the data provider sends it to the trusted computing platform, the trusted computing platform can use its own platform public key to verify and decrypt the original data after receiving the encrypted original data packet.

[0074] In the embodiment of the present disclosure, in step S1053, the trusted computing platform recalculates the second hash value of the decrypted original data for comparison with the first hash value of the original data. If the comparison is consistent, step S1054 is executed.

[0075] In the disclosed embodiment, the trusted computing platform may generate a hash key pair after receiving a data use request from a data demander, the hash key pair including a hash private key and a hash public key, and send the hash key pair to the data provider. The data provider encrypts the first hash value of the original data using the hash private key. After receiving the encrypted original data packet sent by the data provider, the trusted computing platform decrypts the first hash value of the original data using the hash public key. In this way, the possibility of the original data being tampered with can be reduced. However, the first hash value of the original data is not changed, resulting in the first hash value of the original data being consistent with the second hash value of the original data, but the original data has actually been tampered with or destroyed.

[0076] In the embodiment of the present disclosure, by comparing the first hash value of the original data with the second hash value of the original data to meet the consistency condition, it can be determined that the message digest and signature of the original data of the trusted computing platform are consistent and the original data is complete.

[0077] In the embodiment of the present disclosure, Figure 4 As shown, in step S1054, the data processing of the original data in the encrypted original data packet to generate a target data packet includes:

[0078] Step S10541, verifying the integrity of the original data;

[0079] Step S10542: If the original data meets the integrity condition, sensitive information of the original data is deleted according to the processing algorithm code of the original code to generate target data;

[0080] Step S10543: Pack the target data to generate a target data packet.

[0081] In the embodiment of the present disclosure, in step S10541, the integrity of the original data can be verified by comparing whether the second hash value of the original data calculated by the trusted computing platform is consistent with the first hash value of the original data calculated by the data provider.

[0082] In the disclosed embodiment, the hash algorithm used by the data provider to calculate the first hash value of the original data must be consistent with the hash algorithm used by the trusted computing platform to calculate the second hash value of the original data. This ensures that the first hash value of the original data and the second hash value of the original data are consistent as much as possible.

[0083] In the embodiments of the present disclosure, the hash algorithms used in the integrity check of the original data include, but are not limited to, MD5 (MD5 Message-Digest Algorithm) algorithm and SHA (Secure Hash Algorithm) algorithm.

[0084] In the embodiment of the present disclosure, in the integrity check of the original data, if the first hash value of the original data is consistent with the second hash value of the original data, it means that the original data has not been tampered with, and the original data of the data provider and the original data of the trusted computing platform are complete and consistent.

[0085] In the embodiment of the present disclosure, in step S10542, if the original data meets the integrity condition, it means that the original data has not been damaged or deleted during the transmission process. Therefore, the sensitive information of the original data can be deleted according to the processing algorithm code of the original code, including but not limited to one of the following or a combination: the user's real name; the user's ID number; the user's detailed address of residence and / or delivery; the user's age information; the user's gender information; the user's height information.

[0086] In the embodiment of the present disclosure, in step S10543, the target data needs to be encrypted using the public key of the requester, and the target data is packaged and sent to the data requester.

[0087] In the disclosed embodiments, in data exchange scenarios, when user data is not processed by a trusted third party, data leakage may occur. For example, a large amount of user data has been accumulated during the operation of a certain online e-commerce platform, and needs to be sold to a certain data analysis operation company. The operation company analyzes user characteristics through data and needs to desensitize the data first, such as deleting the user's identity information and retaining key analysis data before selling it to the analysis company. If the data desensitization operation is performed by a data provider such as an e-commerce company, the data demander such as a data analysis company will worry that the data provider has deleted or tampered with part of the original data; if the data desensitization operation is performed by a data demander, the data provider will worry that the data demander will obtain sensitive information. Therefore, the trusted computing platform desensitizes the original data, which can gain the trust of the data provider and the data demander and improve the security of the data.

[0088] In the embodiment of the present disclosure, Figure 5 As shown, in step S107, after sending the encrypted target data packet to the data requester, the method further includes:

[0089] Step S108, receiving the target data obtained by the data requester decrypting the encrypted target data packet;

[0090] Step S109 , sending the first hash value of the target data to the data requester; wherein the first hash value of the target data is used for comparison and verification with the second hash value of the target data calculated by the data requester.

[0091] In the disclosed embodiment, regarding step S108, after receiving the encrypted target data packet, the data requester uses the requester's private key to decrypt the encrypted target data packet and obtain the decrypted target data. The data requester then sends the decrypted target data to the trusted computing platform. The trusted computing platform calculates a first hash value for the target data and sends the first hash value to the data requester.

[0092] In the embodiment of the present disclosure, the data demander will calculate the second hash value of the target data to compare with the received first hash value to see if they are consistent. If the first hash value of the target data is consistent with the second hash value of the target data, it means that the target data is complete and has passed the verification.

[0093] In the disclosed embodiment, the data requester obtains the target data, and the processing and exchange of the original data are completed through the trusted computing platform. The decryption of the original data and the encryption of the target data can only be completed on the trusted computing platform. Even if data is leaked during data communication, the original data cannot be restored. This also reduces the possibility of data mistrust between the data provider and the data requester during the data processing process.

[0094] In the embodiment of the present disclosure, Figure 6 As shown, a data processing method is provided, which is applied to a data provider, and the method includes:

[0095] Step S201: receiving a platform key pair issued by a trusted computing platform; wherein the platform key pair includes: a platform private key and a platform public key;

[0096] Step S202: encrypt the original data using the platform public key, sign the original data using the platform private key, and generate an encrypted original data packet;

[0097] Step S203: Send the encrypted original data packet to the trusted computing platform. The encrypted original data packet is used by the trusted computing platform to encrypt and generate a target data packet, and the target data packet is sent to the data demander.

[0098] In the embodiment of the present disclosure, the data provider may be the party providing data, including but not limited to one or a combination of the following: an online e-commerce platform; an online media platform; an online social platform; or an online video platform.

[0099] In the embodiments of the present disclosure, the data demander is a party that needs data, including but not limited to: a data analysis company.

[0100] In the disclosed embodiment, in step S202, the data provider signs the original data using the platform public key to generate an encrypted original data packet. Here, the data provider encrypts the original data using the platform public key so that the trusted computing platform can subsequently decrypt the original data using the platform private key after receiving the encrypted original data.

[0101] In the disclosed embodiment, in step S203, the data provider sends the encrypted original data packet to the trusted computing platform, which encrypts and generates a target data packet, and sends the target data packet to the data demander.

[0102] In the embodiment of the present disclosure, the data provider is used to provide original data, and the original data may include but is not limited to: user operation behavior data, user sensitive information, etc.

[0103] In the disclosed embodiments, data providers can reliably encrypt and send original data to a trusted computing platform. The trusted computing platform can then generate target data and send it to the data requester. This desensitization of data by the trusted computing platform can improve data security and the level of trust between the data provider and the data requester. In particular, the authenticity of the original data can be guaranteed for the data provider, and the data requester's trust in the authenticity of the original data can be gained.

[0104] In the disclosed embodiment, the encrypted original data packet includes at least one of the following: encrypted original data; a signature of the original data; a first hash value of the original data; and a processing algorithm code for the original data.

[0105] In the embodiment of the present disclosure, the original data includes but is not limited to: user operation behavior data, user personal information, user sensitive information, etc.

[0106] In the disclosed embodiment, the signature of the original data is a cryptographic transformation performed on the original data unit to allow the trusted computing platform to confirm the source and integrity of the original data and prevent forgery.

[0107] In the embodiment of the present disclosure, the first hash value of the original data is calculated by the data provider and is used to compare and verify the original data.

[0108] In the embodiment of the present disclosure, regarding the processing algorithm code of the original data, the algorithm code is used for the trusted computing platform to process the original data based on the algorithm code to obtain the target data, including but not limited to: deleting certain user names in the original data, such as users whose names are marked as not willing to be used publicly, etc.); deleting user identity information data, such as ID card number, detailed address of residence or delivery, age information, gender information, height information, etc.; merging certain data information, such as data information of the same type of goods purchased on the same e-commerce website or in the same online store. The data information here is relatively scattered, but can be classified into one category.

[0109] In the disclosed embodiment, the encrypted data packet generated by the data provider is sent to the trusted computing platform for desensitization processing. The encrypted original data can improve the confidentiality of the original data, the signature of the original data can reduce the possibility of the original data being forged, the first hash value of the original data can be used to verify the original data, and the algorithm code of the original data facilitates the trusted computing platform to process the original data. In this way, the security of the original data transmission can be improved, and the trusted computing platform can facilitate the processing of the original data.

[0110] In the embodiment of the present disclosure, Figure 7 As shown, a data processing method is provided, which is applied to a data demander, and the method includes:

[0111] Step S301: Sending a data usage request to a trusted computing platform;

[0112] Step S302: Generate the demander's public key and the demander's private key;

[0113] Step S303: Send the public key of the demander to the trusted computing platform;

[0114] Step S304: Receive the encrypted target data packet generated by the trusted computing platform according to the public key of the demander.

[0115] In the embodiment of the present disclosure, in step S301, the data demander includes but is not limited to: a data analysis platform.

[0116] In the embodiment of the present disclosure, in step S302, the data demander generates a public key PK 需求方 and the demander's private key SK 需求方 ,The public key of the demander is used by the trusted computing platform to encrypt the target data, and the private key of the demander is used by the data demander to decrypt the target data.

[0117] In the disclosed embodiment, in step S304, the received encrypted target data packet is of the data type required by the data requester, and sensitive information, including but not limited to user operation behavior data, has been removed. In the disclosed embodiment, the data requester receives encrypted target data generated by the trusted computing platform. Encrypting the target data can improve the security of the target data. Furthermore, since the encrypted target data generated by the trusted computing platform does not include sensitive information, the data requester does not obtain sensitive user information, thereby improving the security of the data exchange process.

[0118] In the embodiment of the present disclosure, Figure 8 As shown, in step S306, after receiving the encrypted target data packet generated by the trusted computing platform according to the public key of the demander, the method further includes:

[0119] Step S305, decrypting the encrypted target data packet using the demander's private key to obtain target data;

[0120] Step S306, obtaining a first hash value of the target data calculated by the trusted computing platform;

[0121] Step S307, calculating a second hash value of the target data, and comparing the first hash value of the target data with the second hash value of the target data;

[0122] Step S308: If the first hash value of the target data and the second hash value of the target data meet the consistency condition, the target data passes the verification;

[0123] Step S309: store the target data.

[0124] In the embodiment of the present disclosure, in step S305, the data demander uses the demander's private key SK 需求方 Decrypt the encrypted target data packet: res=encrypt(result, PK 需求方 ) to obtain the decrypted target data result.

[0125] In the embodiment of the present disclosure, in step S306, the trusted computing platform uses the demander's private key SK 需求方 The encrypted target data packet is decrypted and the first hash value of the target data result after decryption is calculated by the data demander. The data demander then obtains the first hash value of the target data calculated by the trusted computing platform.

[0126] In the embodiment of the present disclosure, in step S307, the data requester also calculates the second hash value of the target data and compares the first hash value of the target data with the second hash value of the target data.

[0127] In the embodiment of the present disclosure, in step S308 , if the first hash value of the target data is consistent with the second hash value of the target data, it indicates that the target data is complete.

[0128] In an embodiment of the present disclosure, in order to reduce the possibility of the first hash value of the target data being tampered with during transmission, the trusted computing platform can also generate a demander hash key pair, including: a demander hash private key and a demander hash public key, and send the demander hash private key to the data demander.

[0129] In the embodiment of the present disclosure, the trusted computing platform will use the demander's hash public key to encrypt the first hash value of the target data and transmit it to the data demander. The data demander will use the demander's hash private key to decrypt the first hash value of the target data to obtain a secure first hash value, and compare the first hash value of the target data with the second hash value of the target data.

[0130] In the embodiment of the present disclosure, if the target data passes the verification, it means that the target data is complete, and the data demander can store the target data.

[0131] In the disclosed embodiments, data requesters obtain the required data, and the data processing and exchange process is completed through a trusted computing platform. Data encryption and decryption can only be completed on this platform. Even if data is leaked during data communication, the original data cannot be restored. Furthermore, the data processing process is also completed within the platform, reducing the potential for mistrust during data processing.

[0132] In combination with the above embodiments, the present disclosure also provides the following examples:

[0133] Example 1, a data processing method.

[0134] In some application scenarios, data transactions are required, and data suppliers and demanders exchange data. Traditional databases record data, and databases exchange data directly via specific APIs. This process can generally complete the data exchange process, but this data exchange can be insecure, leading to the leakage or loss of critical data.

[0135] Trusted computing technology is a hardware-based data encryption and decryption technology that can encrypt, decrypt, and transmit data in a specified environment through cryptographic algorithms, and can provide trusted verification of the encryption process. This technology significantly improves the security of data interaction.

[0136] This solution addresses security issues in data transaction operations, introduces trusted computing technology to build a data transaction platform, and improves the security of existing data transaction exchange processes.

[0137] Existing transaction models often have shortcomings and are unable to meet the current data transaction requirements between data suppliers and demanders. Existing transaction platforms are unable to achieve full mutual trust between transaction parties and ensure the reliability and security of data.

[0138] Technical solution adopted by the present invention

[0139] The idea behind this solution is to build a data transaction platform based on trusted computing. This platform will act as a trusted third party in the transaction, connecting with the databases of both parties. Data will be encrypted and exchanged uniformly on this platform to ensure the security and reliability of the process.

[0140] This solution uses the blockchain database as an example to describe the data transaction process through the platform. Usually, when providing data, the data supplier needs to use a specific algorithm to process the original data, such as hiding specific user information and deleting some sensitive information. This solution prevents errors in the information processing process and places the original data processing process on a trusted third-party platform. Figure 9 As shown, the specific data transaction process is as follows:

[0141] Step S401: After negotiation, the data demander and the data supplier confirm to initiate the data exchange operation;

[0142] In step S402, after the data demander issues a data use request, the trusted computing environment generates a public-private key pair (public key PK is trusted, private key SK is trusted). The trusted computing platform sends the PK to the data provider. At the same time, each demander generates a pair of keys that can be used to encrypt and decrypt data. The data demander uploads the generated public key to the platform.

[0143] In step S403, after receiving the PK Trusted, the data provider uses the PK Trusted to encrypt the original data Data, encry = encrypt(Data, PK Trusted), and then uses its own private key to sign the encrypted data, signEncry = sign(SK Provider, encry). After completing the above processing, the data provider uploads the encrypted original data encry, the signature of the original data, the hash value of the original data, and the algorithm code related information to the platform. The algorithm code information is the code that can be executed by the trusted execution environment to convert the original data into the target data.

[0144] Step S404: After receiving the signed encrypted data, the trusted computing environment verifies the signature using the trusted public key on the chain. After verification, it decrypts the data using the trusted private key to obtain the original data.

[0145] Step S405: Calculate the hash value of the decrypted original data and compare it with the hash value provided by the data provider. Verify the data integrity. If the verification is successful, call the algorithm code provided by the data provider and process the data according to the rules to obtain the target data required by the data demander.

[0146] Step S406: After the calculation is completed, the target data of the calculation result is encrypted, and the key used is the public key of the data requester. 需求方 ), and return the encrypted res to the data demander. The calculated hash value is transmitted to the data demander, and the platform records the data of each node in the transaction process;

[0147] In step S407, after the data demander obtains res, he uses his own private key to decrypt res to obtain the required target data result, verifies the data by comparing the hash of the result, and stores the result data at the same time.

[0148] After the above operations, the data demander obtains the required data, and the data processing and exchange process is completed through the trusted computing platform. Due to the technical characteristics of this platform, the data encryption and decryption process can only be completed on this platform. Even if the data is leaked during data communication, the original data cannot be restored. The data processing process is also completed within the platform, reducing the potential trust issues that may arise during data processing.

[0149] Technical effects of the present invention:

[0150] This solution uses a trusted computing platform to connect to the database and carry out a complete data exchange process. The entire process combines the key management technology of trusted computing to reduce the problems caused by data leakage during data communication, and also provides a trusted third-party platform for data transactions.

[0151] In the embodiment of the present disclosure, Figure 10 As shown, a data processing device 500 is provided, the device comprising:

[0152] The first generating module 501 is configured to receive a data usage request from a data demander and generate a platform key pair; wherein the platform key pair includes a platform private key and a platform public key;

[0153] The issuing module 502 is configured to issue the platform key pair to the data provider; wherein the platform public key is used by the data provider to encrypt the original data, and the platform private key is used by the data provider to sign the original data;

[0154] The first receiving module 503 is configured to receive a public key generated by the data requester;

[0155] The second receiving module 504 is configured to receive an encrypted original data packet from the data provider encrypted using the platform public key;

[0156] The second generating module 505 is used to process the original data in the encrypted original data to generate a target data packet;

[0157] A first determining module 506 is configured to encrypt the target data packet using the public key of the demander to obtain an encrypted target data packet;

[0158] The first sending module 507 is configured to send the encrypted target data packet to the data requester.

[0159] In the embodiment of the present disclosure, the encrypted original data packet includes at least one of the following:

[0160] Encrypted original data;

[0161] Signature of the original data;

[0162] The first hash value of the original data;

[0163] About the processing algorithm code of the original data.

[0164] In the embodiment of the present disclosure, the second generating module 505 is further configured to:

[0165] If the verification is successful, decrypt the encrypted original data packet using the platform private key to obtain the original data;

[0166] used to calculate the second hash value of the decrypted original data, and compare the first hash value of the original data with the second hash value of the original data,

[0167] If the first hash value of the original data and the second hash value of the original data meet a consistency condition, the original data is desensitized to generate a target data packet.

[0168] In the embodiment of the present disclosure, performing desensitization processing on the original data to generate a target data packet includes:

[0169] Verifying the integrity of the original data;

[0170] If the original data meets the integrity condition, the sensitive information of the original data is deleted according to the processing algorithm code of the original code to generate the target data;

[0171] The target data is packaged to generate a target data packet.

[0172] In the embodiment of the present disclosure, the apparatus 500 is further configured to:

[0173] Used to verify the encrypted original data packet using the platform public key;

[0174] Used to send the first hash value of the target data to the data requester; wherein the first hash value of the target data is used for comparison and verification with the second hash value of the target data calculated by the data requester.

[0175] In the embodiment of the present disclosure, Figure 11 As shown, a data processing device 600 is provided, and the device 600 includes:

[0176] The third receiving module 601 is configured to receive a platform key pair issued by a trusted computing platform; wherein the platform key pair includes a platform private key and a platform public key;

[0177] The third generating module 602 is configured to encrypt the original data using the platform public key and sign the original data using the platform private key to generate an encrypted original data packet;

[0178] The first sending module 603 is used to send the encrypted original data packet to the trusted computing platform. The encrypted original data packet is used by the trusted computing platform to encrypt and generate a target data packet, and the target data packet is sent to the data demander.

[0179] In the embodiment of the present disclosure, the encrypted original data packet includes at least one of the following:

[0180] Encrypted original data;

[0181] Signature of the original data;

[0182] The first hash value of the original data;

[0183] About the processing algorithm code of the original data.

[0184] In the embodiment of the present disclosure, Figure 12 As shown, a data processing device 700 is provided, and the device 700 includes:

[0185] The second sending module 701 is used to send a data use request to the trusted computing platform;

[0186] The fourth generating module 702 is used to generate a public key and a private key of the demander;

[0187] The third sending module 703 is used to send the public key of the demander to the trusted computing platform;

[0188] The fourth receiving module 704 is configured to receive an encrypted target data packet generated by the trusted computing platform according to the public key of the demander.

[0189] In the embodiment of the present disclosure, Figure 13 As shown, the data processing device 700 further includes:

[0190] The second determining module 705 is configured to decrypt the encrypted target data packet using the demander's private key to obtain target data;

[0191] An acquisition module 706 is configured to acquire a first hash value of the target data calculated by the trusted computing platform;

[0192] A calculation module 707 is configured to calculate a second hash value of the target data and compare the first hash value of the target data with the second hash value of the target data;

[0193] A verification module 708, configured to verify that the target data passes verification if the first hash value of the target data and the second hash value of the target data meet a consistency condition;

[0194] The storage module 709 is configured to store the target data.

[0195] In an embodiment of the present disclosure, an electronic device is provided, comprising:

[0196] processor;

[0197] a memory for storing processor-executable instructions;

[0198] The processor is used to implement the steps of the above-mentioned data processing method when running the computer service.

[0199] Those skilled in the art will appreciate that all or part of the steps of the above-mentioned method embodiments may be implemented by hardware associated with program instructions, and the aforementioned program may be stored in a computer-readable storage medium. When the program is executed, the program executes the steps of the above-mentioned method embodiments. The aforementioned storage medium includes various media that can store program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0200] In an embodiment of the present disclosure, a storage medium is provided, wherein the storage medium contains computer-executable instructions, and the computer-executable instructions are executed by a processor to implement the steps in the data processing device described above.

[0201] Alternatively, if the above-mentioned integrated unit of the embodiment of the present invention is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks or optical disks.

[0202] The above description is merely a specific embodiment of the present disclosure, but the scope of protection of the present disclosure is not limited thereto. Any modifications or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this disclosure should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the application documents.

Claims

1. A data processing method, applied to a trusted computing platform, characterized in that: The method comprises: Receive a data use request from a data demander and generate a platform key pair; wherein the platform key pair includes: a platform private key and a platform public key; Send the platform key pair to the data provider; wherein the platform public key is used by the data provider to encrypt the original data, and the platform private key is used by the data provider to sign the original data; Receive the demander's public key generated by the data demander; Receiving an encrypted original data packet from the data provider encrypted using the platform public key; Processing the original data in the encrypted original data packet to generate a target data packet; the target data packet is obtained by desensitizing the original data using the processing algorithm code of the original data; the original data and the processing algorithm code of the original data are obtained by decrypting the encrypted original data packet; Encrypting the target data packet using the public key of the demander to obtain an encrypted target data packet; Sending the encrypted target data packet to the data requester; Receive target data obtained by decrypting the encrypted target data packet by the data demander; The first hash value of the target data is sent to the data requester; wherein the first hash value of the target data is used for comparison and verification with the second hash value of the target data calculated by the data requester.

2. The data processing method according to claim 1, wherein: The encrypted original data packet at least includes a signature of the original data and a first hash value of the original data.

3. The data processing method according to claim 2, characterized in that: The step of processing the original data in the encrypted original data packet to generate a target data packet includes: Verifying the encrypted original data packet using the platform public key; If the verification is successful, the encrypted original data packet is decrypted using the platform private key to obtain the original data; Calculate the second hash value of the decrypted original data, compare the first hash value of the original data with the second hash value of the original data, If the first hash value of the original data and the second hash value of the original data meet the consistency condition, the original data is desensitized to generate a target data packet.

4. A data processing method, applied to a data provider, characterized in that: The method comprises: Receive a platform key pair issued by a trusted computing platform; wherein the platform key pair includes: a platform private key and a platform public key; Encrypt the original data using the platform public key, sign the original data using the platform private key, and generate an encrypted original data packet; Sending an encrypted original data packet to a trusted computing platform; the encrypted original data packet is used by the trusted computing platform to encrypt and generate a target data packet, and the encrypted target data packet is sent to the data requester; the target data packet is obtained by desensitizing the original data using the original data processing algorithm code; the original data and the original data processing algorithm code are obtained by decrypting the encrypted original data packet; the encrypted target data packet is obtained by encrypting the target data packet using the requester's public key generated by the data requester; Among them, after the encrypted target data packet is sent to the data demander, the trusted computing platform is used to receive the target data obtained by the data demander by decrypting the encrypted target data packet; the trusted computing platform is also used to send the first hash value of the target data to the data demander; wherein, the first hash value of the target data is used to compare and verify with the second hash value of the target data calculated by the data demander.

5. The data processing method according to claim 4, characterized in that: The encrypted original data packet at least includes a signature of the original data and a first hash value of the original data.

6. A data processing method, applied to a data demander, characterized in that: The method comprises: Sending data usage request to the trusted computing platform; Generate the demander's public key and the demander's private key; Sending the demander's public key to the trusted computing platform; Receiving an encrypted target data packet generated by the trusted computing platform according to the public key of the demander; the target data packet is obtained by desensitizing the original data using the processing algorithm code of the original data; the original data and the processing algorithm code of the original data are obtained by decrypting and encrypting the original data packet; Decrypting the encrypted target data packet using the demander's private key to obtain target data; Obtaining a first hash value of the target data calculated by the trusted computing platform; Calculating a second hash value of the target data, and comparing the first hash value of the target data with the second hash value of the target data; If the first hash value of the target data and the second hash value of the target data meet the consistency condition, the target data passes the verification; The target data is stored.

7. An electronic device, characterized in that: The electronic device comprises: processor; A memory for storing a computer program that can be run on a processor; wherein, when the processor is used to run the computer program, it executes the steps of the data processing method according to any one of claims 1 to 3, 4 to 5 or 6.

8. A computer storage medium storing computer-executable instructions; the computer-executable instructions are executed by a processor to implement the data processing method according to any one of claims 1 to 3, 4 to 5 or 6.

Images