A method and system for data privacy protection

Abstract

Embodiments of the present specification disclose a data privacy protection method and system. A first trusted area application of a certain data processing party can receive encrypted to-be-processed data, the to-be-processed data including original data from a data providing party or result data from another data processing party. The first trusted area application can decrypt the encrypted to-be-processed data based on at least a local key to obtain the to-be-processed data. Further, the first trusted area application can process the to-be-processed data to obtain first result data, a receiver of the first result data, and generate encrypted information of the first result data based on at least a key of the receiver and send the encrypted information to the receiver. The first trusted area application can be determined based on the encrypted to-be-processed data or based on an identification of a target trusted area application received from the data providing party or the other data processing party.

Description

Technical Field

[0001] This specification relates to the field of information technology, and in particular to a data privacy protection method and system. Background Technology

[0002] In today's world, with increasingly refined division of labor, the application of multi-platform models is very popular. A multi-platform model refers to multiple service providers (platforms) each offering segmented services to deliver a complete solution to the customer. However, data security faces greater challenges under this model. Summary of the Invention

[0003] One embodiment of this specification provides a data privacy protection method, executed by a first trusted zone application of a data processing party, comprising: receiving encrypted data to be processed, the data to be processed including raw data from a data provider or result data from another data processing party; decrypting the encrypted data to be processed based at least on a key of the first trusted zone application to obtain the data to be processed; processing the data to be processed to obtain first result data and its recipient; generating encrypted information of the first result data based at least on a key of the recipient, and sending the encrypted information to the recipient. The first trusted zone application determines the target trusted zone application based on the encrypted data to be processed or based on an identifier received from the data provider or the other data processing party.

[0004] One embodiment of this specification provides a data privacy protection system implemented in a first trusted zone of a data processing party. The system includes: a receiving module for receiving encrypted data to be processed, the data to be processed including raw data from a data provider or result data from another data processing party; a decryption module for decrypting the encrypted data to be processed based at least on a key of the first trusted zone application to obtain the data to be processed; a processing module for processing the data to be processed to obtain first result data and its recipient; and an output module for generating encrypted information of the first result data based at least on the key of the recipient, and sending the encrypted information to the recipient. The first trusted zone application is determined based on the encrypted data to be processed or based on an identifier of a target trusted zone application received from the data provider or the other data processing party.

[0005] One embodiment of this specification provides a data privacy protection device, including a processor and a storage device, wherein the storage device is used to store instructions, wherein when the processor executes the instructions, it implements the data privacy protection method as described in any embodiment of this specification. Attached Figure Description

[0006] This specification will be further described by way of exemplary embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting; in these embodiments, the same reference numerals denote the same structures, wherein:

[0007] Figure 1 These are schematic diagrams illustrating application scenarios for data privacy protection based on some embodiments of this specification;

[0008] Figure 2 This is an exemplary flowchart of a data privacy protection method according to some embodiments of this specification;

[0009] Figure 3 This is a schematic diagram illustrating the encryption and decryption of data to be processed using asymmetric encryption, according to some embodiments of this specification.

[0010] Figure 4 This is a schematic diagram illustrating the encryption and decryption of data to be processed using a combination of asymmetric and symmetric encryption, as shown in some embodiments of this specification.

[0011] Figure 5 This is an exemplary block diagram of a data privacy protection system according to some embodiments of this specification. Detailed Implementation

[0012] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are merely some examples or embodiments of this specification. For those skilled in the art, these drawings can be applied to other similar scenarios without creative effort. Unless obvious from the context or otherwise specified, the same reference numerals in the drawings represent the same structures or operations.

[0013] It should be understood that the terms “system,” “device,” “unit,” and / or “module” used herein are one way to distinguish different components, elements, parts, sections, or assemblies at different levels. However, if other terms can achieve the same purpose, they may be replaced by other expressions.

[0014] As indicated in this specification, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of expressly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0015] Flowcharts are used in this specification to illustrate the operations performed by the system according to embodiments of this specification. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0016] Figure 1 This is a schematic diagram illustrating an application scenario for data privacy protection based on some embodiments of this specification. Scenario 100 may include one or more user terminals 110, one or more server terminals 120, and a network 130.

[0017] User terminal 110 can be a device of the data provider, server terminal 120 can be a device of the data processor, and network 130 can facilitate information transmission between user terminal 110 and server terminal 120.

[0018] In a multi-platform model, data tasks are divided into multiple sub-services, each provided by a dedicated data processing provider. Specifically, a data task can be further subdivided into multiple sequential sub-tasks. For example, a data analysis task can be divided into three sub-tasks: data preprocessing, data analysis, and result visualization. Similarly, a machine learning task can be divided into three sub-tasks: data fusion, model training, and model distribution. After task subdivision, each sub-task can be completed by a single data processing provider. For instance, a data task can be divided into n sequential sub-tasks. First, one or more data providers can transmit their raw data to the data processing provider responsible for the first sub-task (referred to as the first party). Then, the first party processes the raw data, obtains the result data, and transmits it to the data processing provider responsible for the next sub-task (referred to as the second party). Next, the second party processes the result data from the first party, obtains new result data, and transmits it to the data processing provider responsible for the next sub-task. This process continues until the data processing provider responsible for the last sub-task obtains and outputs the target data.

[0019] Multi-platform models rely on the flow of data (such as raw data and result data) between different service providers (platforms). If the data involves user privacy, potential data security issues need to be considered, such as privacy leaks during data transmission and processing. This specification provides a data privacy protection method applicable to multi-platform models; for details, please refer to [link / reference]. Figure 3 And its related descriptions.

[0020] In some embodiments, the server 120 may have a Trusted Execution Environment (TEE). The TEE is a secure environment isolated from the operating system (OS), providing confidentiality and immutability for code execution and data storage. Specifically, each application running in the TEE (referred to as a Trusted Zone Application or TAPP / TA) corresponds to a pair of public and private keys, referred to as the TAPP's public and private keys. The TAPP can use its local private key to decrypt input data, which is obtained by encrypting plaintext data using the TAPP's public key. The TAPP can encrypt data before outputting it and output the encrypted data. It can be understood that all data entering and leaving the TEE is encrypted to ensure data security.

[0021] In some embodiments, the client 110 / server 120 may include various computing devices, such as smartphones, tablets, laptops, desktop computers, workstations, servers, etc. The server may be a standalone server or a group of servers, which may be centralized or distributed. In some embodiments, the server may be regional or remote. In some embodiments, the server may run on a cloud platform. For example, the cloud platform may include one or any combination of private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, internal cloud, etc.

[0022] Network 130 connects the various components of the system, enabling communication between them. The network between the components can include wired and / or wireless networks. For example, network 130 can include cable networks, wired networks, fiber optic networks, telecommunications networks, internal networks, the Internet, local area networks (LANs), wide area networks (WANs), wireless local area networks (WLANs), metropolitan area networks (MANs), public switched telephone networks (PSTNs), Bluetooth networks, ZigBee networks, near field communication (NFC), internal device buses, internal device wiring, cable connections, etc., or any combination thereof. Network connections between any two components can employ one or more of these methods.

[0023] Figure 2 This is an exemplary flowchart illustrating a data privacy protection method according to some embodiments of this specification. Flow 200 can be performed by a data processing party (such as...) Figure 1 The first party or the second party, etc., are denoted as S. i ) Execution, such as Figure 2 As shown, process 200 may include the following steps.

[0024] Step 210: Receive the encrypted data to be processed.

[0025] For ease of distinction, the following will refer to data processing method S i The received encrypted data to be processed is denoted as X′. i And the corresponding plaintext, that is, the data to be processed in plaintext form, is denoted as X. i Additionally, S i The subscript can reflect that the data processing party is responsible for the i-th subtask out of n subtasks, that is, the data task can be assigned by data processing parties S1 to S2. n To complete it together.

[0026] In some embodiments, the data to be processed X1 may include raw data (denoted as X0) from a data provider (S0). Accordingly, the data processor S1 may receive the data to be encrypted X′1 from the data provider S0. In some embodiments, the data to be processed X... i This may include data from other data processing parties S i-1 The result data (denoted as Y) i-1 Correspondingly, the data processing party S i From data provider S i-1 Receive encrypted data X′ to be processed. i .

[0027] Step 220: Decrypt the encrypted data to be processed using at least a local key to obtain the data to be processed.

[0028] In some embodiments, encrypted data to be processed can be decrypted using asymmetric encryption and decryption methods. Figure 3 This is a schematic diagram illustrating the encryption and decryption of data to be processed using asymmetric encryption, according to some embodiments of this specification.

[0029] like Figure 3 As shown, in some embodiments, the data provider S0 can use the public key of the data processor S1 to encrypt the data to be processed X1, obtaining encrypted data to be processed X′1, and send it to the data processor S1. The data to be processed X1 includes the original data X0. Then, the data processor S1 can use its local private key to decrypt the encrypted data to be processed X′1, obtaining the data to be processed X1.

[0030] In yet other embodiments, the data processing unit S i-1 Data processing method S can be used i The public key is used to process data X i Encryption is performed to obtain encrypted data X′ to be processed. i Send it to data processing party S i Among them, the data to be processed X iIncluding data processing party S i-1 Data X to be processed i-1 The result data Y obtained after processing i-1 Thus, data processing party S i The encrypted data X′ can be processed using the local private key. i Decryption is performed to obtain the data X to be processed. i .

[0031] In some embodiments, encrypted data to be processed can be decrypted by combining asymmetric encryption and decryption methods with symmetric encryption and decryption methods. Figure 4 This is a schematic diagram illustrating the encryption and decryption of data to be processed using a combination of asymmetric and symmetric encryption, as shown in some embodiments of this specification.

[0032] like Figure 4 As shown, symmetric encryption can be applied to the data to be processed, and asymmetric encryption can be applied to the encryption key of the data to be processed. Specifically, in some embodiments, the data provider S0 can encrypt the data X1 to be encrypted using a symmetric key (denoted as k0) to obtain encrypted data X′1 to be processed, and then encrypt the symmetric key k0 using the public key of the data processor S1 to obtain an encrypted symmetric key (denoted as k′0). The data X1 to be processed includes the original data X0. The data provider S0 can send the encrypted data X′1 to be processed and the encrypted symmetric key k′0 to the data processor S1. That is, the data processor S1 can also receive the encrypted symmetric key k′0 from the data provider S0. Thus, the data processor S1 can decrypt the encrypted symmetric key k′0 using its local private key to obtain the symmetric key k0, and then use the symmetric key k0 to decrypt the encrypted data X′1 to obtain the data X1 to be processed.

[0033] In yet other embodiments, the data processing unit S i-1 A symmetric key (denoted as k) can be used i-1 Treating encrypted data X i Encryption is performed to obtain encrypted data X′ to be processed. i and utilize data processing method S i The public key to the symmetric key k i-1 Encryption is performed to obtain the encrypted symmetric key (denoted as k′). i-1 ), where the data to be processed is X i Including data processing party S i-1 Data X to be processed i-1 The result data Y obtained after processing i-1 Data processing party S i-1 The encrypted data X′ to be processed can be... iand the encrypted symmetric key k′ i-1 Send to data processing party S i That is, data processing party S i It can also be obtained from data processing S i-1 Receive the encrypted symmetric key k′ i-1 Thus, data processing party S i The local private key can be used to encrypt the symmetric key k′. i-1 Decryption is performed to obtain the symmetric key k. i-1 Then use the symmetric key k i-1 The encrypted data to be encrypted, X′ i Decryption is performed to obtain the data X to be processed. i .

[0034] Compared to adopting Figure 3 The encryption method shown uses Figure 4 The encryption method shown can sometimes save on encryption and decryption costs because the data volume (or length) of the data to be processed may be relatively large (long), resulting in high costs for asymmetric encryption of the data to be processed (and equally high decryption costs), while the data volume (or length) of the key is relatively small (short). Thus, symmetric encryption of the large data volume of the data to be processed and asymmetric encryption of the small data volume of the symmetric key can save on encryption and decryption costs.

[0035] In some embodiments, the data processing party S i It can have a Trusted Execution Environment (TEE), and process 200 can be handled by data processing party S. i The first trusted area application (denoted as TAPP_i) is executed. Accordingly, the local private key used to decrypt and obtain the data to be processed or the symmetric key in the foregoing embodiments can refer to the private key corresponding to TAPP_i. When process 200 is executed by TAPP running in the TEE, the plaintext data to be processed is protected from leakage by the TEE, ensuring data security during the data processing process. In some embodiments, the data processing party S... i Multiple TAPPs are deployed in the trusted execution environment. TAPP_i, used to execute process 200, can be based on encrypted data X′ to be processed. iDetermined or determined based on the identity of the target trusted area application received from the data provider or the other data processing party. Specifically, the TAPP_i can be determined by a dedicated TAPP running in the TEE or a program (hereinafter collectively referred to as the TAPP determination module) running in the OS (in a non-trusted execution environment). That is, the data distribution can be performed by the TAPP determination module (the dedicated TAPP or the program), and the received encrypted data to be processed is further distributed to the target TAPP (or the above-mentioned TAPP_i) for execution. In some embodiments, the TAPP determination module can determine the content or type of the encrypted data to be processed, and determine the current subtask according to the content or type of the encrypted data to be processed. Furthermore, the TAPP determination module can determine the TAPP_i from multiple candidate TAPPs according to the current subtask. Only as an example, the data task is a machine learning task, which is divided into three subtasks: data fusion, model training, and model distribution. Taking the data processing party S2 responsible for the model training subtask as an example, the TAPP determination module in the data processing party S2 determines that the encrypted data to be processed X′2 is a training sample set. Correspondingly, the current subtask can be determined to be model training, and then a TAPP with model training function can be determined from multiple TAPPs as the TAPP_i. In some other embodiments, the data processing party S i While obtaining the encrypted data to be processed X′ from the data provider or other data processing parties i , the identity of the target trusted area application is also received. This identity directly indicates which TAPP of the data processing party S i will perform data processing. Therefore, the TAPP determination module can directly send the encrypted data to be processed to the target trusted area application (such as TAPP_i) for decryption and data processing according to this identity. Continuing with the machine learning task as an example, while the data provider sends the encrypted data to be processed to S1, it also sends the identity of the target trusted area application (such as TAPP_1 with data fusion function, assuming that each party knows the identities and functions of the TAPPs related to the data task of other parties). Then, after receiving the encrypted data to be processed, the data processing party S1 can directly send the data to be processed to TAPP_1 in its trusted execution area for decryption and subsequent processing based on the identity of the target trusted area application.

[0036] Step 230, process the data to be processed to obtain the first result data and its recipient.

[0037] It can be understood that depending on the execution order of the subtasks responsible for the data processing party S i , the first result data may refer to intermediate result data or target data. Specifically, when i < n, the data processing party S iThe first result data obtained can be regarded as intermediate result data; when i=n, ​​the data processing method S n The first result data obtained can be regarded as the target data.

[0038] In addition to obtaining the first result data, the data processing party S i Dynamic data routing can also be achieved by processing the data to be processed to determine the recipient of the first result data. In some embodiments, the data processing party S i The task progress can be determined based on the content or type of the first result data. The task progress can reflect the next subtask or whether a complete data task has been completed. Furthermore, the data processing party S... i The receiver can be determined from multiple candidates based on the task progress. For example, the data task is a machine learning task, which is divided into three sub-tasks: data fusion, model training, and model distribution. Data processor S1 processes the data to be processed X1 (such as the original data from the data provider) to obtain the result data Y1, which is the training sample set after preprocessing and normalization of the original data. Data processor S1 can determine that the task progress is to perform model training, and thus can determine the data processor that can provide model training services from multiple candidates as the receiver (i.e., S2). Data processor S2 processes the data to be processed X2 to obtain the result data Y2, which is the complete model. Data processor S2 can determine that the task progress is to perform model distribution, and thus can determine the data processor that can provide model distribution services from multiple candidates as the receiver (i.e., S3). Data processor S3 processes the data to be processed X3 to obtain the result data Y3, which is the fragmented model (or sub-model) after splitting the complete model. Then, data processor S3 can determine that the task progress is that the complete data task has been completed, and then can determine the user of the target data as the receiver (i.e., S4) from multiple candidate parties.

[0039] In some other embodiments, a target trusted region application for further processing of the first result data can be further identified in the receiver. Then, while sending the encrypted information of the first result data in step 240, the identifier of the target trusted region application is sent to the receiver. For an example of determining the identifier of the target trusted region application in the receiver, please refer to step 220, which will not be repeated here.

[0040] It is understandable that the recipient of the first result data is determined while the current data processor is processing the data to be processed. This eliminates the need for the entire data task chain or cluster to be pre-configured based on the task to handle the processors or computing nodes for each subtask, thus enabling more flexible dynamic routing of data and making it applicable to a wider range of data processing scenarios.

[0041] Step 240: Generate encrypted information of the first result data based at least on the recipient's key, and send the encrypted information to the recipient.

[0042] In some embodiments, the data processing party S i The receiver (such as the data processor S) can be utilized i+1 The public key of ) to the first result data (i.e., result data Y) i The first result data is encrypted to obtain encrypted information. In some embodiments, the receiver may have a Trusted Execution Environment (TEE), and the receiver's public key may be the public key of a trusted application (denoted as TAPP_j) running in the TEE, so that the encrypted information of the first result data can be decrypted or processed by TAPP_j. In some embodiments, the identifier of TAPP_j may be sent to the receiver along with the encrypted information of the first result data, so that the receiver can clearly identify the TAPP used to execute process 200 (the receiver may have multiple TAPPs).

[0043] In some embodiments, the data processing party S i The receiver (such as the data processor S) can be utilized i+1 The symmetric key of the first result data (i.e., result data Y) i Encrypt the data to obtain the encrypted information of the first result data.

[0044] In some embodiments, the data processing party S i Alternatively, the first result data can be encrypted using its own symmetric key to obtain encryption result a, and the symmetric key can be encrypted using the receiver's public key to obtain encryption result b. Encryption result a and encryption result b together are used as the encryption information of the first result data.

[0045] It's understandable that the result data Y i The encrypted information can be processed by the data processing party S. i+1 Received encrypted data X′ to be processed i+1 Or, it could be encrypted target data received by the user of the target data.

[0046] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0047] Figure 5This is a block diagram of a data privacy protection system according to some embodiments of this specification. System 500 can be implemented in a data processing unit; in some embodiments, system 500 can be implemented in a first trusted region of said data processing unit. For example... Figure 5 As shown, system 500 may include receiving module 510, decryption module 520, processing module 530 and output module 540.

[0048] The receiving module 510 can be used to receive encrypted data to be processed, which includes raw data from a data provider or result data from other data processors.

[0049] The decryption module 520 can be used to decrypt the encrypted data to be processed based at least on a local key to obtain the data to be processed. In some embodiments, the decryption module 520 can be used to decrypt the encrypted data to be processed based at least on a key applied in the first trusted area to obtain the data to be processed.

[0050] The processing module 530 can be used to process the data to be processed to obtain the first result data and its receiver.

[0051] The output module 540 can be used to generate encrypted information of the first result data based at least on the key of the receiver, and send the encrypted information to the receiver.

[0052] For more details about System 500 and its modules, please refer to [link / reference]. Figure 2 And related descriptions. For example, the first trusted region application may be determined based on the encrypted data to be processed, or it may be determined based on the identifier of the target trusted region application received from the data provider or the other data processor.

[0053] It should be understood that Figure 5The systems and modules shown can be implemented in various ways. For example, in some embodiments, the systems and modules can be implemented by hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the methods and systems described above can be implemented using computer-executable instructions and / or included in processor control code, for example, on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The systems and modules of this specification can be implemented not only by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., but also by software, for example, executed by various types of processors, or by a combination of the aforementioned hardware circuits and software (e.g., firmware).

[0054] It should be noted that the above description of the system and its modules is for convenience only and should not be construed as limiting this specification to the embodiments described. It is understood that those skilled in the art, after understanding the system's principles, may arbitrarily combine the modules or construct subsystems connected to other modules without departing from these principles. For example, in some embodiments, the decryption module 520 and the processing module 530 may be two modules or combined into one module. Such modifications are all within the scope of this specification.

[0055] The beneficial effects that the embodiments of this specification may bring include, but are not limited to: (1) providing secure computation and dynamic routing of privacy data in a multi-platform mode; (2) saving encryption and decryption costs by combining asymmetric and symmetric encryption. It should be noted that different embodiments may produce different beneficial effects. In different embodiments, the beneficial effects that may be produced may be any one or a combination of the above, or any other possible beneficial effects.

[0056] The basic concepts have been described above. Obviously, for those skilled in the art, the detailed disclosure above is merely illustrative and does not constitute a limitation on the embodiments of this specification. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to the embodiments of this specification. Such modifications, improvements, and corrections are suggested in the embodiments of this specification, and therefore, such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this specification.

[0057] Furthermore, this specification uses specific terms to describe embodiments thereof. For example, "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of this specification. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Moreover, certain features, structures, or characteristics in one or more embodiments of this specification can be appropriately combined.

[0058] Furthermore, those skilled in the art will understand that various aspects of the embodiments of this specification can be described and illustrated through several patentable types or situations, including any new and useful combinations of processes, machines, products, or substances, or any new and useful improvements thereto. Accordingly, various aspects of the embodiments of this specification can be implemented entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. All of the above hardware or software may be referred to as a "data block," "module," "engine," "unit," "component," or "system." Furthermore, various aspects of the embodiments of this specification may be embodied as a computer product located on one or more computer-readable media, the product including computer-readable program code.

[0059] Computer storage media may contain a propagated data signal containing computer program code, for example, on baseband or as part of a carrier wave. This propagated signal may take various forms, including electromagnetic, optical, and suitable combinations thereof. Computer storage media can be any computer-readable medium other than a computer-readable storage medium, which can be connected to an instruction execution system, apparatus, or device to enable communication, propagation, or transmission of a program for use. The program code located on the computer storage medium can be propagated through any suitable medium, including radio, cable, fiber optic cable, RF, or similar media, or any combination of the above media.

[0060] The computer program code required for the operation of each part of the embodiments in this specification can be written in any one or more programming languages, including object-oriented programming languages ​​such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, C#, VB.NET, Python, etc., conventional procedural programming languages ​​such as C, Visual Basic, Fortran2003, Perl, COBOL2002, PHP, ABAP, dynamic programming languages ​​such as Python, Ruby, and Groovy, or other programming languages. This program code can run entirely on the user's computer, or as a standalone software package on the user's computer, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or processing device. In the latter case, the remote computer can be connected to the user's computer through any network, such as a local area network (LAN) or wide area network (WAN), or connected to an external computer (e.g., via the Internet), or in a cloud computing environment, or used as a service such as Software as a Service (SaaS).

[0061] Furthermore, unless expressly stated in the claims, the order of processing elements and sequences, the use of numbers and letters, or other names described in the embodiments of this specification are not intended to limit the order of the processes and methods of the embodiments of this specification. Although some inventive embodiments that are currently considered useful have been discussed by way of various examples in the foregoing disclosure, it should be understood that such details are for illustrative purposes only, and the appended claims are not limited to the disclosed embodiments. Rather, the claims are intended to cover all modifications and equivalent combinations that conform to the spirit and scope of the embodiments of this specification. For example, although the system components described above can be implemented by hardware devices, they can also be implemented solely by software solutions, such as installing the described system on existing processing devices or mobile devices.

[0062] Similarly, it should be noted that, in order to simplify the description of the embodiments disclosed in this specification and thereby aid in the understanding of one or more embodiments of the invention, the foregoing description of the embodiments in this specification may sometimes combine multiple features into a single embodiment, drawing, or description thereof. However, this method of disclosure does not imply that the objects of the embodiments in this specification require more features than those mentioned in the claims. In fact, the embodiments have fewer features than all the features of the single embodiments disclosed above.

[0063] For each patent, patent application, patent application publication, and other material, such as articles, books, specifications, publications, and documents, referenced in this specification, the entire contents of which are incorporated herein by reference. This excludes historical application documents that are inconsistent with or conflict with this specification, as well as documents that limit the broadest scope of the claims of this application (currently or subsequently appended to this application). It should be noted that in the event of any inconsistency or conflict between the descriptions, definitions, and / or terminology used in the supplementary materials to this specification and the content of this specification, the descriptions, definitions, and / or terminology used in this specification shall prevail.

[0064] Finally, it should be understood that the embodiments described in this specification are merely illustrative of the principles of the embodiments described herein. Other variations may also fall within the scope of the embodiments described herein. Therefore, alternative configurations of the embodiments described herein are intended to be illustrative rather than limiting, and should be considered consistent with the teachings of this specification. Accordingly, the embodiments described herein are not limited to those explicitly introduced and described herein.

Claims

1. A data privacy protection method, characterized in that, The data task is divided into multiple sequential subtasks, which are completed by multiple data processing parties, with each subtask processed by one of the data processing parties. The method is executed by a first trusted region application of one of the multiple data processing parties to complete the subtask corresponding to that data processing party, and includes: Receive encrypted data to be processed; the data to be processed includes raw data from a data provider or result data from other data processors; The encrypted data to be processed is decrypted based at least on the key of the first trusted region application to obtain the data to be processed; wherein the first trusted region application is determined based on the encrypted data to be processed or based on the identifier of the target trusted region application received from the data provider or the other data processor. The data to be processed is processed to obtain first result data, and the task progress is determined according to the content or type of the first result data. The receiver is determined from multiple candidate parties according to the task progress. The multiple candidate parties include other data processing parties and data users among the multiple data processing parties. Encrypted information of the first result data is generated based at least on the recipient's key, and the encrypted information is sent to the recipient.

2. The method as described in claim 1, wherein, The step of decrypting the encrypted data to be processed based at least on the key applied in the first trusted region to obtain the data to be processed includes: The encrypted data to be processed is decrypted using the private key of the first trusted area application to obtain the data to be processed.

3. The method as described in claim 1, wherein, It also includes: receiving an encrypted symmetric key from the data provider or the other data processor; The step of decrypting the encrypted data to be processed based at least on the key applied in the first trusted region to obtain the data to be processed includes: The encrypted symmetric key is decrypted using the private key of the first trusted area application to obtain the symmetric key; The encrypted data to be processed is decrypted using the symmetric key to obtain the data to be processed.

4. The method of claim 1, wherein, The step of generating encrypted information of the first result data based at least on the recipient's key includes: encrypting the first result data using the recipient's public key to obtain encrypted information of the first result data.

5. The method of claim 1, wherein, The encryption information used to generate the first result data based at least on the recipient's key includes: The first result data is encrypted using the symmetric key of the data processing party, and the symmetric key is encrypted using the public key of the receiver. Based on the two encryption results, the encrypted information of the first result data is obtained.

6. The method as described in claim 4 or 5, wherein, The receiver's public key is the public key corresponding to a trusted application of the receiver, so that the encrypted information of the first result data can be decrypted or processed by the trusted application.

7. The method of claim 6, wherein, Along with the encrypted information of the first result data, the identifier of the trusted region application of the recipient is also sent.

8. The method of claim 1, wherein, The step of generating encrypted information of the first result data based at least on the receiver's key includes: encrypting the first result data using the receiver's symmetric key to obtain encrypted information of the first result data.

9. A data privacy protection system, characterized in that, The data task is divided into multiple sequential subtasks, which are completed by multiple data processing parties, with each subtask being processed by one of the data processing parties. The system is implemented in a first trusted region of one of the multiple data processing parties to complete the subtask corresponding to that data processing party, which includes: A receiving module is used to receive encrypted data to be processed; the data to be processed includes raw data from a data provider or result data from other data processors. A decryption module is configured to decrypt the encrypted data to be processed based at least on the key of the first trusted region application to obtain the data to be processed; wherein the first trusted region application is determined based on the encrypted data to be processed or based on the identifier of the target trusted region application received from the data provider or the other data processor. The processing module is used to process the data to be processed to obtain first result data, and to determine the task progress based on the content or type of the first result data, and to determine the receiver from multiple candidate parties based on the task progress; the multiple candidate parties include other data processing parties and data users among the multiple data processing parties. An output module is configured to generate encrypted information of the first result data based at least on the receiver's key, and send the encrypted information to the receiver.

10. A data privacy protection device, comprising a processor and a storage device, wherein the storage device is used to store instructions, wherein... When the processor executes instructions, it implements the method as described in any one of claims 1 to 8.

Images