A file encryption storage access method and system under a multi-party secure computing platform

Abstract

An aspect of the present disclosure relates to a method for file encryption storage access under a multi-party secure computing platform, comprising: pulling, by a framework API on a platform side, a path acquisition job on a path acquisition module on a user side to request a file encryption storage module on the user side to dynamically open an object storage interface by the path acquisition module, and returning object storage interface configuration parameters returned by the file encryption storage module to the framework API on the platform side; and pulling, by the framework API, a training job on a training job module on the user side and providing the object storage interface configuration parameters to the training job module to perform file encryption storage access by the training job module through the opened object storage interface. Other aspects of the present disclosure also relate to corresponding platforms and devices.

Description

Technical Field

[0001] This application generally relates to multi-party secure computation (MPC), and more particularly to methods and systems for accessing encrypted file storage under a multi-party secure computation platform. Background Technology

[0002] Secure multi-party computation (MPC) involves multiple, untrusted parties, each possessing their own private data, computing a result for a common function without revealing their individual private data. At the end of the computation, only the result is known to each party, and none of the parties know any of the other parties' data or the intermediate data used in the computation.

[0003] An MPC platform enables untrusted parties to correctly compute any function while ensuring the confidentiality of their input and output information. The MPC platform can be considered a trusted third party. Ideally, this trusted third party obtains secret input information from each party, computes the function, and then securely returns the result to all parties.

[0004] In existing technologies, customer training data is typically encrypted and stored by a file encryption storage module on the access side (i.e., the user side). Since the encrypted information storage module is deployed on a multi-party secure computing access side, it cannot be directly accessed via external requests. Therefore, it is not convenient to directly obtain dynamically generated object storage interface configuration parameters through the user interface center. A mechanism is needed to call the file encryption storage module provided by the user side to dynamically obtain the object storage interface configuration parameters.

[0005] When an MPC platform needs to obtain confidential input information from multiple parties, including the client, for training, it can typically verify the correctness of the feature service by accessing a specific whitelist provided by the access party. Alternatively, it can request the object storage address from the access party's file encryption storage module API through the user-side training module before training. Another option is to maintain communication with the access party's file encryption storage module through the user-side file encryption storage module's management service to request the object storage address. However, these conventional solutions either have security risks, require separate customization and / or maintenance of corresponding modules on the user side, and lack unified platform management.

[0006] Therefore, there is a need in this field for more universal and secure methods and systems for accessing encrypted file storage under the MPC platform. Summary of the Invention

[0007] One aspect of this disclosure relates to a method for accessing encrypted file storage under a multi-party secure computing platform, comprising: initiating a path acquisition job on a user-side path acquisition module via a platform-side framework API, wherein the path acquisition module requests the user-side encrypted file storage module to dynamically enable an object storage interface, and returning the object storage interface configuration parameters returned by the encrypted file storage module to the platform-side framework API; and initiating a training job on a user-side training module via the framework API and providing the object storage interface configuration parameters to the training module so that the training module can access encrypted file storage via the enabled object storage interface.

[0008] According to some exemplary embodiments, the object storage interface configuration parameters include an object storage service path, wherein the object storage service path includes at least one of the following: a read path or a storage path.

[0009] According to some exemplary embodiments, accessing encrypted file storage via the enabled object storage interface through the training module includes writing storage data into the encrypted file storage module via the enabled object storage interface through the training module.

[0010] According to a further embodiment, the stored data is encrypted via the object storage interface and then written into the file encryption storage module.

[0011] According to some exemplary embodiments, accessing encrypted file storage via the activated object storage interface through the training module includes reading encrypted storage data in the encrypted file storage module via the activated object storage interface through the training module.

[0012] According to a further embodiment, the encrypted storage data is provided to the training module for use in the training process after being decrypted by the object storage interface.

[0013] According to a further embodiment, the training process generates training results, and the access to encrypted file storage via the enabled object storage interface through the training process module further includes encrypting the training results and writing them into the encrypted file storage module through the enabled object storage interface of the training process module.

[0014] According to a further embodiment, the object storage interface configuration parameters returned by the file encryption storage module include a path for reading the stored data and a path for writing the training results.

[0015] Another aspect of this disclosure relates to a multi-party secure computing platform, including a path acquisition module deployed on the user side, configured to request the dynamic activation of an object storage interface from the file encryption storage module on the user side when running a path acquisition job, and to receive object storage interface configuration parameters returned by the file encryption storage module; and a framework API module deployed on the platform side, configured to launch the path acquisition job on the path acquisition module, wherein the path acquisition module is further configured to return the received object storage interface configuration parameters to the framework API module when the running path acquisition job is launched by the framework API module on the platform side.

[0016] According to some exemplary embodiments, the object storage interface configuration parameters include an object storage service path, wherein the object storage service path includes at least one of the following: a read path or a storage path.

[0017] According to some exemplary embodiments, the multi-party secure computing platform further includes a training module deployed on the user side, used to access the file encryption storage module via the opened object storage interface when running the training job, wherein the framework API module is further used to launch the training job on the user-side training module and provide the object storage interface configuration parameters to the training module for use by the training module for the file encryption storage access when receiving the object storage interface configuration parameters returned by the path acquisition module.

[0018] According to a further embodiment, the training module is used to access the file encryption storage module via the enabled object storage interface, including the training module encrypting the stored data and writing it into the file encryption storage module via the enabled object storage interface.

[0019] According to some exemplary embodiments, the training module is used to access the file encryption storage module via the enabled object storage interface, including the training module being used to read and decrypt encrypted storage data in the file encryption storage module via the enabled object storage interface.

[0020] According to some exemplary embodiments, the training process generates training results, and the training module is used to access the file encryption storage module via the enabled object storage interface, including the training module further being used to encrypt the training results and write them into the file encryption storage module via the enabled object storage interface.

[0021] According to a further embodiment, the object storage interface configuration parameters returned by the file encryption storage module include a path for reading the stored data and a path for writing the training results.

[0022] Another aspect of this disclosure relates to a method for accessing encrypted file storage under a multi-party secure computing platform. The method is implemented by a framework API module deployed on the platform side. The method includes receiving a path acquisition process initiated by the multi-party secure computing platform; initiating a job on the user side to launch a path acquisition process on the user-side path acquisition module; obtaining object storage interface configuration parameters from the user-side path acquisition module for accessing the encrypted file storage module; initiating a job on the user side to launch a training job on the user-side training job module; and providing the object storage interface configuration parameters to the user-side training job module so that the training job module can access the data stored in the encrypted file storage module.

[0023] Another aspect of this disclosure relates to a method for accessing encrypted file storage under a multi-party secure computing platform. The method is implemented by a path acquisition module deployed on the user side. The method includes receiving a request to launch a path acquisition process from the framework API on the platform side; running the path acquisition request, including requesting the file encrypted storage module on the user side to dynamically enable the object storage interface; receiving object storage interface configuration parameters returned by the file encrypted storage module; and returning the received object storage interface configuration parameters to the framework API on the platform side.

[0024] Another aspect of this disclosure relates to a method for accessing encrypted file storage under a multi-party secure computing platform. The method is implemented by a training module deployed on the user side. The method includes receiving a request to start a training session from a framework API on the platform side; receiving object storage interface configuration parameters for accessing the encrypted file storage module from the framework API; and running the training session, including using the object storage interface configuration parameters to access the encrypted file storage via the enabled object storage interface.

[0025] Other aspects of this disclosure include corresponding apparatus, devices, and computer-readable media. Attached Figure Description

[0026] Figure 1 A block diagram of a file encryption storage module according to one aspect of this disclosure is shown.

[0027] Figure 2 A schematic diagram of a file encryption storage access system under a multi-party secure computing (MPC) platform according to one aspect of this disclosure is shown.

[0028] Figure 3A system flow diagram of a file encryption storage access system under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown.

[0029] Figure 4 A system flow diagram of a file encryption storage access system under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown.

[0030] Figure 5 A flowchart is shown of a method for accessing encrypted file storage on a multi-party secure computation (MPC) platform according to one aspect of this disclosure.

[0031] Figure 6 A flowchart is shown of a method for accessing encrypted file storage on a multi-party secure computation (MPC) platform according to one aspect of this disclosure.

[0032] Figure 7 A flowchart is shown of a method for accessing encrypted file storage on a multi-party secure computation (MPC) platform according to one aspect of this disclosure.

[0033] Figure 8 A flowchart is shown of a method for accessing encrypted file storage on a multi-party secure computation (MPC) platform according to one aspect of this disclosure.

[0034] Figure 9 A flowchart is shown of a method for accessing encrypted file storage on a multi-party secure computation (MPC) platform according to one aspect of this disclosure. Detailed Implementation

[0035] Figure 1 A block diagram of a file encryption storage module 100 according to one aspect of this disclosure is shown. Figure 1 As shown, the file encryption storage module 100 according to this disclosure may include a module API interface 102, an object storage interface 104, and an object storage service module 106. The client's training data is encrypted and stored in the object storage service module 106. The file encryption storage module is a service module deployed on a multi-party secure computing access platform, used to provide the necessary input training data for its own model training service, and dynamically decrypting the training data for the training module to access during each training process.

[0036] According to an exemplary embodiment, accessing (e.g., reading and / or writing) data in a file encrypted storage module can be divided into two stages.

[0037] According to an exemplary embodiment, in the first stage, a requester (not shown) sends a request to the encrypted storage module API interface 102 to enable storage services. The encrypted storage module API interface 102 receives the request and verifies it. If the verification passes, the encrypted storage module API interface 102 dynamically enables the object storage interface 104, for example, by providing a dynamic enable command to the object storage interface 104 or using other similar means, and returns object storage interface configuration parameters (e.g., OSS path) to the requester. If the verification fails, the encrypted storage module API interface 102 rejects the request to enable storage services from the requester.

[0038] According to an exemplary embodiment, in the second stage, the requester connects to the object storage interface 104 by providing the obtained object storage interface configuration parameters to the object storage interface 104. With the encrypted storage module API interface 102 enabled, the object storage interface 104 accesses the stored data in the object storage service module 106 based on the object storage interface configuration parameters provided by the requester. Accessing the stored data in the object storage service module 106 may include, for example, reading encrypted stored data in the object storage service module 106, and / or writing stored data to the object storage service module 106.

[0039] According to the exemplary embodiment, when reading encrypted storage data in the object storage service module 106, the object storage interface 104 further decrypts the acquired encrypted storage data using the object storage interface configuration parameters, while the encrypted storage module API interface 102 is enabled, to obtain the decrypted storage data.

[0040] According to the exemplary embodiment, when writing storage data to the object storage service module 106, the object storage interface 104 further encrypts the data to be stored and stores it in the object storage service module 106 using the object storage interface configuration parameters, while the encrypted storage module API interface 102 is enabled.

[0041] According to at least some exemplary embodiments, the opening of the object storage interface 104 can be controlled by a timeout value, so that the object storage interface 104 is closed when the timeout value is reached and the object storage interface 104 has not been accessed by the requesting party. In this case, the requesting party needs to make a new request to the encrypted storage module API interface 102.

[0042] If the requesting party provides the obtained object storage interface configuration parameters to the object storage interface 104, and the object storage interface 104 is not in a state where the encrypted storage module API interface 102 is open, then the object storage interface 104 will not access the object storage service module 106, thereby protecting the security of the user's training data file.

[0043] The object storage interface 104 may have security auditing and logging functions. For example, according to an exemplary embodiment, the object storage interface 104 may perform security auditing and logging on dynamic start commands from the encrypted storage module API interface 102, the start and end times of its own start, the time and source of receiving object storage interface configuration parameters, the time of requesting encrypted storage data from the object storage service module, and the results of decrypting the encrypted storage data (e.g., whether decryption was successful, verification, etc.).

[0044] Because the generation of object storage interface configuration parameters and the activation of the object storage interface are dynamic, the file encryption storage module 100 uniformly manages sensitive user data, ensuring that user data is subject to security auditing and recording during each training process, and is encrypted during storage, thus protecting the security of sensitive data. This significantly improves overall security.

[0045] Figure 2 A schematic diagram of a file encryption storage access system 200 under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. As shown in the figure, Figure 2 The file encryption storage access system 200 under the MPC platform can be divided into the upper central side 210 and the lower user side 220 by the dotted line.

[0046] The central side 210 may be, for example, the center of an MPC system framework. According to an exemplary embodiment, the central side 210 may include or be located at a central node. This central node may be responsible for managing, scheduling, and coordinating the resources and status of the entire cluster. According to an exemplary embodiment, the central side 210 may include a framework API module 212.

[0047] The user-side 220 may include downstream nodes or be located at downstream nodes. One or more downstream nodes may be deployed at the main station and various partner institutions, responsible for performing offline training tasks, running online model services, etc.

[0048] User-side 220 may include file encryption storage module 230, such as the combination described above. Figure 1 The file encryption storage module 100 described herein. The user side 220 of the file encryption storage access system 200 under the MPC platform of this disclosure may further include a path acquisition module 224 and a training module 226.

[0049] According to some exemplary and non-limiting embodiments, Figure 2 The MPC system framework can be, for example, a cross-organizational Kubernetes cluster, whose central node may include a Kubernetes master, and downstream nodes may include one or more Kubernetes nodes located downstream of the central node.

[0050] According to an exemplary embodiment, when, for example, a user needs to provide the required input training data for their own model training service, they may need to access, for example, a file encryption storage module located at the user's institution to read stored data. To this end, the user may initiate a path retrieval task (e.g., an Object Storage Service (OSS) parameter request URL job) to the framework API 212 of the central side 210 via the MPC platform.

[0051] The framework API 212 of the central side 210 can initiate a job on the path acquisition module 224 by sending a request to the path acquisition module 224 of the user side 220.

[0052] The path acquisition module 224 receives the request from the framework API 212 from the central side 210, and combines it as described above. Figure 1 The first phase describes sending an enable storage service request to the encrypted storage module API interface 232 in the file encrypted storage module 230. The encrypted storage module API interface 302 receives the enable storage service request and verifies it. When the verification of the request is successful, the encrypted storage module API interface 232 dynamically enables the object storage interface 234, for example, by providing a dynamic enable command to the object storage interface 234 or other similar means, and returns object storage interface configuration parameters (e.g., OSS path) to the path acquisition module 224. When the verification of the request fails, the encrypted storage module API interface 232 rejects the enable storage service request from the path acquisition module 224.

[0053] After obtaining the object storage interface configuration parameters provided by the encrypted storage module API interface 232, the path acquisition module 224 forwards them to the framework API 212 of the central side 210.

[0054] According to at least some exemplary embodiments, the platform 210 may start polling the framework API 212 immediately after the path acquisition task is initiated or after a period of time to attempt to obtain the task running status, and obtain the object storage interface configuration parameters from the framework API 212 when the path acquisition module 224 reports the task running result along with the OSS path 317 to the framework API 212.

[0055] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0056] When the framework API 212 of the central side 210 obtains the object storage interface configuration parameters from the path acquisition module 224 of the user side 220, the framework API 212 launches the job on the training working module 226 by sending a request along with task parameters (including the path) to the training working module 226 of the user side 220. The task parameters may include the aforementioned object storage interface configuration parameters, etc.

[0057] Training module 226 receives a request from framework API 212 from the central side 210, along with task parameters (including the path), and combines them as described above. Figure 1 The second stage describes connecting to the object storage interface 234 by providing the acquired object storage interface configuration parameters to the object storage interface 234 in the file encryption storage module 230. With the encrypted storage module API interface 232 enabled, the object storage interface 234 obtains encrypted storage data from the object storage service module 236 based on the object storage interface configuration parameters provided by the training module 226. Further, with the encrypted storage module API interface 232 enabled, the object storage interface 234 uses the object storage interface configuration parameters to decrypt the obtained encrypted storage data to obtain the decrypted storage data.

[0058] According to at least some exemplary embodiments, the opening of the object storage interface 234 can be controlled by a timeout value, so that the object storage interface 234 is closed when the timeout value is reached and it has not been accessed by the requesting party. In this case, the framework API 212 needs to make a new request to the encrypted storage module API interface 232.

[0059] If the training module 226 provides the acquired object storage interface configuration parameters to the object storage interface 234, and the object storage interface 234 is not in a state where the encrypted storage module API interface 232 is open, then the object storage interface 234 will not access the object storage service module 236, thereby protecting the security of the user's training data files.

[0060] On the other hand, according to the exemplary embodiment, when it is necessary to store data to, for example, a file encryption storage module located at the user's facility, operations similar to those performed during the reading process described above can be performed. For example, a path retrieval task (e.g., an OSS parameter request URL job) can be initiated from the MPC platform to the framework API 212 of the central side 210.

[0061] The framework API 212 of the central side 210 can initiate a job on the path acquisition module 224 by sending a request to the path acquisition module 224 of the user side 220.

[0062] The path acquisition module 224 receives the request from the framework API 212 from the central side 210, and combines it as described above. Figure 1 The first phase describes sending an enable storage service request to the encrypted storage module API interface 232 in the file encrypted storage module 230. The encrypted storage module API interface 302 receives the enable storage service request and verifies it. When the verification of the request is successful, the encrypted storage module API interface 232 dynamically enables the object storage interface 234, for example, by providing a dynamic enable command to the object storage interface 234 or other similar means, and returns object storage interface configuration parameters (e.g., OSS path) to the path acquisition module 224. When the verification of the request fails, the encrypted storage module API interface 232 rejects the enable storage service request from the path acquisition module 224.

[0063] After obtaining the object storage interface configuration parameters provided by the encrypted storage module API interface 232, the path acquisition module 224 forwards them to the framework API 212 of the central side 210.

[0064] According to at least some exemplary embodiments, the platform 210 may start polling the framework API 212 immediately after the path acquisition task is initiated or after a period of time to attempt to obtain the task running status, and obtain the object storage interface configuration parameters from the framework API 212 when the path acquisition module 224 reports the task running result along with the OSS path 317 to the framework API 212.

[0065] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0066] When the framework API 212 of the central side 210 obtains the object storage interface configuration parameters from the path acquisition module 224 of the user side 220, the framework API 212 launches the job on the training working module 226 by sending a request along with task parameters (including the path) to the training working module 226 of the user side 220. The task parameters may include the aforementioned object storage interface configuration parameters, etc.

[0067] Training module 226 receives a request from framework API 212 from the central side 210, along with task parameters (including the path), and combines them as described above. Figure 1The second stage describes connecting to the object storage interface 234 by providing the acquired object storage interface configuration parameters to the object storage interface 234 in the file encryption storage module 230. With the encryption storage module API interface 232 enabled, the object storage interface 234 encrypts the data to be stored (e.g., training results) based on the object storage interface configuration parameters provided by the training module 226, and uses the object storage interface configuration parameters to store the encrypted data in the object storage service module 236.

[0068] According to at least some exemplary embodiments, the opening of the object storage interface 234 can be controlled by a timeout value, so that the object storage interface 234 is closed when the timeout value is reached and it has not been accessed by the requesting party. In this case, the framework API 212 needs to make a new request to the encrypted storage module API interface 232.

[0069] If the training module 226 provides the acquired object storage interface configuration parameters to the object storage interface 234, and the object storage interface 234 is not in a state where the encrypted storage module API interface 232 is open, then the object storage interface 234 will not access the object storage service module 236, thereby protecting the security of the data in the object storage service module 236.

[0070] On the other hand, when it is necessary to access, for example, a file encryption storage module located at a user's institution to read stored data, process that stored data (e.g., training), and store the results (e.g., training results) back to the file encryption storage module, the user can initiate a path retrieval task (e.g., an Object Storage Service (OSS) parameter request URL job) on the MPC platform to the framework API 212 of the central side 210. This path retrieval task involves retrieving at least two paths simultaneously: one is the data reading path, and the other is the data storage path.

[0071] The framework API 212 of the central side 210 can initiate a job on the path acquisition module 224 by sending a request to the path acquisition module 224 of the user side 220.

[0072] The path acquisition module 224 receives the request from the framework API 212 from the central side 210, and combines it as described above. Figure 1The first phase describes sending an enable storage service request to the encrypted storage module API interface 232 in the file encrypted storage module 230. The encrypted storage module API interface 302 receives the enable storage service request and verifies it. When the verification of the request is successful, the encrypted storage module API interface 232 dynamically enables the object storage interface 234, for example, by providing a dynamic enable command to the object storage interface 234 or other similar means, and returns object storage interface configuration parameters (e.g., OSS path) to the path acquisition module 224. When the verification of the request fails, the encrypted storage module API interface 232 rejects the enable storage service request from the path acquisition module 224.

[0073] After obtaining the object storage interface configuration parameters (e.g., including data read path and data storage path) provided by the encrypted storage module API interface 232, the path acquisition module 224 forwards them to the framework API 212 of the central side 210.

[0074] According to at least some exemplary embodiments, the platform 210 may start polling the framework API 212 immediately after the path acquisition task is initiated or after a period of time to attempt to obtain the task running status, and obtain the object storage interface configuration parameters from the framework API 212 when the path acquisition module 224 reports the task running result along with the OSS path 317 to the framework API 212.

[0075] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0076] When the framework API 212 of the central side 210 obtains the object storage interface configuration parameters from the path acquisition module 224 of the user side 220, the framework API 212 launches the job on the training working module 226 by sending a request along with task parameters to the training working module 226 of the user side 220. The task parameters may include or are based on the aforementioned object storage interface configuration parameters (e.g., including the aforementioned data read path and data storage path).

[0077] The training module 226 receives the request from the framework API 212 from the central side 210 along with the task parameters, and combines them as described above. Figure 1The second stage describes connecting the object storage interface 234 in the file encryption storage module 230 by providing training parameters (e.g., including the data read path) to the object storage interface 234. With the encryption storage module API interface 232 enabled, the object storage interface 234 retrieves encrypted storage data from the object storage service module 236 based on the training parameters provided by the training module 226. Further, with the encryption storage module API interface 232 enabled, the object storage interface 234 uses object storage interface configuration parameters to decrypt the retrieved encrypted storage data to obtain the decrypted storage data.

[0078] When the training module completes data processing (e.g., training) and needs to store the processing results (e.g., training results) in a file encryption storage module located at the user's facility, the training module 226 can connect to the object storage interface 234 by providing the acquired object storage interface configuration parameters (e.g., including the data storage path) to the object storage interface 234 in the file encryption storage module 230. With the encryption storage module API interface 232 enabled, the object storage interface 234 encrypts the data to be stored (e.g., training results) based on the object storage interface configuration parameters provided by the training module 226, and stores the encrypted data in the object storage service module 236 using the object storage interface configuration parameters.

[0079] According to at least some exemplary embodiments, the opening of the object storage interface 234 can be controlled by a timeout value, so that the object storage interface 234 is closed when the timeout value is reached and it has not been accessed by the requesting party. In this case, the framework API 212 needs to make a new request to the encrypted storage module API interface 232.

[0080] If the training module 226 provides the acquired object storage interface configuration parameters to the object storage interface 234, and the object storage interface 234 is not in a state where the encrypted storage module API interface 232 is open, then the object storage interface 234 will not access the object storage service module 236, thereby protecting the security of the data in the object storage service module 236.

[0081] Figure 3 System flow 300 of a file encryption storage access system under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. For example... Figure 3 As shown, platform 210, framework API 212, node 220, path acquisition module 224, training module 226, and file encryption storage module 230 can be combined as described above. Figure 2The file encryption storage access system 200 under the Multi-Party Secure Computation (MPC) platform describes the central side 210, framework API 212, user side 220, path acquisition module 224, training module 226 and file encryption storage module 230.

[0082] When it is necessary to read data from the file encryption storage module 230, such as Figure 3 As shown, in path acquisition process 310 (e.g., corresponding to combination) Figure 1 and 2 In the first phase described, platform 210 may initiate path retrieval task 311. For example, according to an exemplary embodiment, a user may initiate a path retrieval task (e.g., an OSS parameter request URL job) to framework API 212 at MPC platform 210.

[0083] The framework API 212 then responds to the path acquisition task 311 initiated by the platform 210 by sending a request 312 to the path acquisition module 224 of the node 220 to initiate a job. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job through the k8s node 220.

[0084] When an MPC job is started on node 220, node 220 will start the path acquisition process 313 on path acquisition module 224.

[0085] When the path acquisition process 313 is started on the path acquisition module 224, the path acquisition module 224 will then proceed as described above. Figure 1 The first stage and combination Figure 2 The description describes requesting object storage interface configuration parameters (e.g., including the OSS path) from the file encryption storage module 230 via a URL request 314.

[0086] When the file encryption storage module 230 receives a URL request from the path acquisition module 224, the file encryption storage module 230 returns object storage interface configuration parameters (e.g., including the OSS path) 315 to the path acquisition module 224. Then, the path acquisition module 224 reports the task execution result along with the object storage interface configuration parameters (e.g., including the OSS path) 317 to the framework API 212.

[0087] According to at least some exemplary embodiments, platform 210 may start polling immediately after initiating path acquisition task 311 or after a period of time to attempt to acquire task running status 316, and obtain object storage interface configuration parameters (e.g., converted OSS path) 318 from framework API 212 when path acquisition module 224 reports task running results together with object storage interface configuration parameters (e.g., including OSS path) 317 to framework API 212.

[0088] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0089] At this point, the first stage, namely path acquisition process 310, is complete.

[0090] like Figure 3 As shown, after platform 210 obtains the converted OSS path 318 from framework API 212, the read process 320 (e.g., corresponding to the combination) Figure 1 and 2 The second phase (described) can then begin. The reading process 320 can be automatically initiated in response to platform 210 obtaining the task execution results of the first phase. At this time, platform 210 can initiate reading task 321. For example, according to an exemplary embodiment, a user can initiate a reading task to framework API 212 at MPC platform 210.

[0091] The framework API 212 then responds to the read task 321 initiated by the platform 210 by sending a request to the node 220 to initiate an MPC job 322. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job 322 through the k8s node 220.

[0092] When an MPC job is started on node 220, node 220 will start the reading job 323 on training module 226.

[0093] When a read job 323 is launched on the training module 226, the training module 226 requests read parameters 324 from the framework API 212. In response, the framework API 212 sends read parameters 325 to the training module 226. The read parameters can be configured based on object storage interface parameters, such as including OSS paths.

[0094] Although this description uses the example of training job 226 requesting read parameters from framework API 212 after a read job is started on node 220, this disclosure is not limited thereto. For example, this disclosure may also include various embodiments in which framework API 212 provides read parameters to node 220 at the same time as, before, or after initiating MPC job 322, and node 220 provides read parameters to training job 226 spontaneously or in response to a request from training job 226.

[0095] When the training module 226 receives read data 325 from the framework API 212, the training module 226 uses read parameters (including the OSS path) to access the encrypted storage data 326 in the file encryption storage module 230.

[0096] In response, the file encryption storage module 230 combines the above-mentioned methods. Figure 1 and Figure 2 The described method provides decrypted stored data 327 to the training module 226 for local reading on the user side. This completes the second phase, the reading process 320. Since the stored data is sensitive data and does not leave the user side, data security is protected.

[0097] Figure 4 The system flow 400 of a file encryption storage access system under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. For example... Figure 4 As shown, platform 210, framework API 212, node 220, path acquisition module 224, training module 226, and file encryption storage module 230 can be combined as described above. Figure 2 The file encryption storage access system 200 under the Multi-Party Secure Computation (MPC) platform describes the central side 210, framework API 212, user side 220, path acquisition module 224, training module 226 and file encryption storage module 230.

[0098] When data needs to be stored, such as Figure 4 As shown, in path acquisition process 410 (e.g., corresponding to combination) Figure 1 and 2 In the first phase described, platform 210 may initiate path retrieval task 411. For example, according to an exemplary embodiment, a user may initiate a path retrieval task (e.g., an OSS parameter request URL job) to framework API 212 at MPC platform 210.

[0099] The framework API 212 then responds to the path acquisition task 411 initiated by the platform 210 by sending a request 412 to the path acquisition module 224 of the node 220 to launch the job on the path acquisition module 224. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job through the k8s node 220.

[0100] When an MPC job is started on node 220, node 220 will start the path acquisition process 413 on path acquisition module 224.

[0101] When the path acquisition process 413 is started on the path acquisition module 224, the path acquisition module 224 will then proceed as described above. Figure 1 The first stage and combination Figure 2 The description describes requesting object storage interface configuration parameters (e.g., including the OSS path) from the file encryption storage module 230 via a URL request 414.

[0102] When the file encryption storage module 230 receives a request 414 from the path acquisition module 224, the file encryption storage module 230 returns object storage interface configuration parameters (e.g., including the OSS path) 415 to the path acquisition module 224. Then, the path acquisition module 224 reports the task execution result along with the object storage interface configuration parameters (e.g., the OSS path) 417 to the framework API 212.

[0103] According to at least some exemplary embodiments, platform 210 may start polling immediately after initiating path acquisition task 411 or after a period of time to attempt to acquire task running status 416, and obtain object storage interface configuration parameters (e.g., including the converted OSS path) 418 from framework API 212 when path acquisition module 224 reports task running results along with OSS path 417 to framework API 212.

[0104] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0105] At this point, the first stage, namely the path acquisition process 410, is complete.

[0106] like Figure 4 As shown, after platform 210 obtains the transformed OSS path 418 from framework API 212, storage process 420 (e.g., corresponding to the combination) Figure 1 and 2 The second phase (described) can then begin. Storage process 420 can be automatically initiated in response to platform 210 obtaining the task execution results of the first phase. At this time, platform 210 can initiate storage task 421. For example, according to an exemplary embodiment, a user can initiate a storage task to framework API 212 at MPC platform 210.

[0107] The framework API 212 then responds to the storage task 421 initiated by the platform 210 by sending a request to the node 220 to initiate an MPC job 422. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job 422 through the Kubernetes node 220.

[0108] When an MPC job is started on node 220, node 220 also starts storage job 423 on training job module 226.

[0109] When a storage job 423 is launched on the training job module 226, the training job module 226 requests storage parameters 424 from the framework API 212. In response, the framework API 212 sends storage parameters (including the OSS path) 425 to the training job module 226.

[0110] Although this description uses the example of training job 226 requesting storage parameters from framework API 212 after a storage job is launched on node 220, this disclosure is not limited thereto. For example, this disclosure may also include various embodiments in which framework API 212 provides storage parameters to node 220 at the same time as, before, or after initiating MPC job 322, and where node 220 provides storage parameters to training job 226 spontaneously or in response to a request from training job 226.

[0111] When the training module 226 receives the storage data 425 from the framework API 212, the training module 226 uses the storage parameters to encrypt the data to be stored and pushes the encrypted data to the file encryption storage module 230 for storage 426.

[0112] In response, the file encryption storage module 230 combines the above-mentioned methods. Figure 1 and Figure 2 The described method involves encrypting and storing the data. This completes the second phase, storage process 420.

[0113] Compared to existing technologies that require users to customize and / or maintain corresponding modules separately, this disclosure manages file encryption storage access under a multi-party secure computing platform through a unified API interface in the platform center. As a result, each user only needs to retain a simple path acquisition module and a training module.

[0114] In the file encryption storage access system under the Multi-Party Secure Computation (MPC) platform according to this disclosure, all system verification logic is completed on the user side, and only the dynamically generated interface configuration parameters after startup are sent back to the platform, thus avoiding the security risks caused by opening the encryption storage service interface to the public network.

[0115] The solution disclosed herein adds a separate encrypted file storage interface configuration parameter acquisition process before initiating the call, which avoids intrusion into the main storage process, decouples the modules, improves system uniformity, and makes the system easier to maintain.

[0116] By leveraging service modules within a Kubernetes-like system framework, the encrypted storage module and management module are prevented from directly maintaining and managing interface configuration parameters in real time, thus decoupling the system and enhancing its robustness.

[0117] Figure 5 A system flow 500 of a file encryption storage access system under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. System flow 500 is substantially similar to a combination of... Figure 3 and / or Figure 4 The system flow diagram described differs in that... Figure 5 In system flow 500, it is necessary to access, for example, a file encryption storage module located at a user institution to read stored data from it, process the stored data (e.g., train it), and store the results (e.g., training results) back to the file encryption storage module.

[0118] like Figure 5 As shown, platform 210, framework API 212, node 220, path acquisition module 224, training module 226, and file encryption storage module 230 can be combined as described above. Figure 2 The file encryption storage access system 200 under the Multi-Party Secure Computation (MPC) platform describes the central side 210, framework API 212, user side 220, path acquisition module 224, training module 226 and file encryption storage module 230.

[0119] When it is necessary to access, for example, a file encryption storage module located at a user institution to read stored data from it, process that stored data (e.g., training), and store the results (e.g., training results) back to the file encryption storage module, such as... Figure 5 As shown, in path acquisition process 510 (e.g., corresponding to combination) Figure 1 and 2 In the first phase described, platform 210 may initiate path retrieval task 511. For example, according to an exemplary embodiment, a user may initiate a path retrieval task (e.g., an OSS parameter request URL job) to framework API 212 at MPC platform 210.

[0120] The framework API 212 then responds to the path acquisition task 511 initiated by the platform 210 by sending a request 512 to the path acquisition module 224 of the node 220 to initiate a job. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job through the k8s node 220.

[0121] When an MPC job is started on node 220, node 220 will start the path acquisition process 513 on path acquisition module 224.

[0122] When the path acquisition process 513 is started on the path acquisition module 224, the path acquisition module 224 will then proceed as described above. Figure 1 The first stage and combination Figure 2 The description describes requesting object storage interface configuration parameters (e.g., including data read path and data storage path) from file encryption storage module 230 via a URL request 514.

[0123] When the file encryption storage module 230 receives a URL request from the path acquisition module 224, the file encryption storage module 230 returns object storage interface configuration parameters (e.g., including the data read path and data storage path) 515 to the path acquisition module 224. Then, the path acquisition module 224 reports the task execution result along with the object storage interface configuration parameters (e.g., including the data read path and data storage path) 517 to the framework API 212.

[0124] According to at least some exemplary embodiments, platform 210 may start polling immediately after initiating path acquisition task 511 or after a period of time to attempt to acquire task running status 516, and obtain the converted OSS path 518 from framework API 212 when path acquisition module 224 reports task running results along with object storage interface configuration parameters (e.g., including data read path and data storage path) 517 to framework API 212.

[0125] According to at least some other exemplary embodiments, instead of the platform 210 polling the framework API 212 to obtain the task execution results, the framework API 212 may provide the task execution results to the platform 210 when the path acquisition module 224 reports the task execution results.

[0126] At this point, the first stage, namely the path acquisition process 510, is complete.

[0127] like Figure 5 As shown, after platform 210 obtains the converted OSS path 518 from framework API 212, training process 520 (e.g., corresponding to combining...) Figure 1 and 2 The second phase (described) can then begin. Training process 520 can be automatically initiated in response to platform 210 obtaining the task execution results of the first phase. At this time, platform 210 can initiate training task 521. For example, according to an exemplary embodiment, a user can initiate a training task to framework API 212 at MPC platform 210.

[0128] The framework API 212 then responds to the training task 521 initiated by the platform 210 by sending a request to the node 220 to initiate an MPC job 322. For example, according to an exemplary embodiment, the framework API 212 can initiate an MPC job 522 via the k8s node 220.

[0129] When an MPC job is started on node 220, node 220 will start training job 523 on training job module 226.

[0130] When the training module 226 is launched for reading (523), it requests training parameters (524) from the framework API 212. In response, the framework API 212 sends training parameters (525) to the training module 226. These training parameters can be configured based on the object storage interface, including, for example, the data read path and data storage path.

[0131] Although this description uses the example of training job 226 requesting read parameters from framework API 212 after a read job is started on node 220, this disclosure is not limited thereto. For example, this disclosure may also include various embodiments in which framework API 212 provides read parameters to node 220 at the same time as, before, or after initiating MPC job 322, and node 220 provides read parameters to training job 226 spontaneously or in response to a request from training job 226.

[0132] When the training module 226 receives read data 525 from the framework API 212, the training module 226 uses the training parameters (including the data read path) to access the encrypted storage data 526 in the file encryption storage module 230.

[0133] In response, the file encryption storage module 230 combines the above-mentioned methods. Figure 1 and Figure 2 The described method provides decrypted storage data 527 to the training module 226 for local reading on the user side of the training module 226.

[0134] The training module 226 uses the obtained stored data 527 to perform training 528, and pushes the training results to the file encryption storage module 230 for encrypted storage based on the training parameters (including the data storage path).

[0135] This completes the second phase, training process 520. Since the stored data is considered sensitive data and does not leave the user's side, data security is protected.

[0136] Figure 6A flowchart of a file encryption storage access method 600 under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. Method 600 can be derived from, for example, the combination of the above. Figure 1 The described file encryption storage module 100, or in combination with Figure 2 or Figure 3 The file encryption storage module 230 described herein is used to implement this, wherein the file encryption storage module 100 or 230 resides on the user side.

[0137] In box 602, method 600 may include receiving a request to enable storage service from a path residing on the user side via a module API interface.

[0138] In box 604, method 600 may include obtaining the object storage interface configuration parameters returned by the module from the path via the module API interface, and dynamically enabling the object storage interface.

[0139] In box 606, method 600 may include receiving training parameters from a training working module residing on the user side via an object storage interface.

[0140] In box 608, method 600 may include obtaining encrypted storage data from a file encryption storage module based on training parameters using an object storage interface.

[0141] In box 610, method 600 may include decrypting encrypted stored data based on training parameters by an object storage interface and returning the decrypted stored data to the training module.

[0142] Figure 7 A flowchart of a file encryption storage access method 700 under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. Method 700 can be derived from, for example, the combination of the above. Figure 2 – 4 describes the implementation of the framework API 212, where the framework API 212 resides on the platform side.

[0143] In box 702, method 700 may include a path retrieval process initiated by the framework API receiving platform.

[0144] In box 704, method 700 may include initiating a job from the framework API to the user side to launch a path retrieval process on the user-side path retrieval module.

[0145] In box 706, method 700 may include obtaining the path retrieval task execution result from the path retrieval module on the user side via the framework API.

[0146] In box 708, method 700 may include initiating a job from the framework API to the user side to start a training job on the user-side training job module.

[0147] In block 710, method 700 may include providing training parameters from a framework API to a user-side training module so that the training module can access data stored in a file encrypted storage module based on the training parameters. According to at least some exemplary embodiments, accessing data stored in the file encrypted storage module may include, for example, reading data from the file encrypted storage module. According to at least some other exemplary embodiments, accessing data stored in the file encrypted storage module may include, for example, writing data to the file encrypted storage module. According to at least some further exemplary embodiments, accessing data stored in the file encrypted storage module may include, for example, reading training data from the file encrypted storage module, using the read training data for training by the training module, and pushing the training results to the file encrypted storage module for encrypted storage.

[0148] Figure 8 A flowchart of a file encryption storage access method 800 under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. Method 800 can be derived from, for example, the combination of the above. Figure 2 – 4 describes the path acquisition module 224, which resides on the user side.

[0149] In box 802, method 800 may include receiving a request from the path acquisition module to initiate a path acquisition process.

[0150] In box 804, method 800 may include the path acquisition module requesting a path from the file encryption storage module.

[0151] In box 806, method 800 may include receiving the path returned by the file encryption storage module from the path acquisition module and reporting it to the framework API residing on the platform side.

[0152] Figure 9 A flowchart of a file encryption storage access method 900 under a multi-party secure computation (MPC) platform according to one aspect of this disclosure is shown. Method 900 can be derived from, for example, the combination of the above. Figure 2 – 4 describes the implementation of the training module 226, which resides on the user side.

[0153] In box 902, method 900 may include receiving a request from the training job module to start a training job.

[0154] In box 904, method 900 may include obtaining training parameters from the platform-side framework API by the training working module.

[0155] In box 906, method 900 may include accessing the file encryption storage module by the training working module based on the acquired training parameters.

[0156] The above descriptions are merely exemplary embodiments of the present invention. However, the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

[0157] This disclosed solution leverages the capabilities of a special Kubernetes-like system framework to construct a loosely coupled encrypted file storage module access process. By using the framework to launch a dedicated storage parameter retrieval service component and an interface configuration parameter reporting mode, it avoids the encrypted storage module management module maintaining interface parameters, reducing service complexity and development and maintenance costs. Furthermore, by adding a separate encrypted file storage interface configuration parameter retrieval process before initiating the call, it avoids intrusion into the main training process, decoupling the modules, improving system uniformity, and facilitating system maintenance.

[0158] The various illustrative logic blocks, modules, and circuits described in this disclosure can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, the processor may be any commercially available processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0159] The steps of the methods or algorithms described in this disclosure can be implemented directly in hardware, in a software module executed by a processor, or in a combination of both. The software module can reside in any form of storage medium known in the art. Some examples of usable storage media include random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROMs, and so on. The software module can include a single instruction or many instructions, and can be distributed across several different code segments, across different programs, and across multiple storage media. The storage medium can be coupled to the processor so that the processor can read and write information from / to the storage medium. Alternatively, the storage medium can be integrated into the processor.

[0160] The methods disclosed herein include one or more steps or actions for achieving the described methods. These method steps and / or actions may be interchanged with each other without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and / or use of specific steps and / or actions may be modified without departing from the scope of the claims.

[0161] A processor can execute software stored on a machine-readable medium. The processor may be implemented using one or more general-purpose and / or special-purpose processors. Examples include microprocessors, microcontrollers, DSP processors, and other circuit systems capable of executing software. Software should be interpreted broadly as instructions, data, or any combination thereof, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. As examples, a machine-readable medium may include RAM (random access memory), flash memory, ROM (read-only memory), PROM (programmable read-only memory), EPROM (erasable programmable read-only memory), EEPROM (electrically erasable programmable read-only memory), registers, disks, optical disks, hard drives, or any other suitable storage medium, or any combination thereof. The machine-readable medium may be implemented in a computer program product. This computer program product may include packaging materials.

[0162] In hardware implementations, machine-readable media can be a separate part of the processing system from the processor. However, as those skilled in the art will readily appreciate, machine-readable media or any portion thereof can be external to the processing system. As examples, machine-readable media may include transmission lines, data-modulated carrier waves, and / or computer products separate from wireless nodes, all accessible to the processor via a bus interface. Alternatively or additionally, machine-readable media or any portion thereof may be integrated into the processor, such as caches and / or general-purpose register files.

[0163] The processing system can be configured as a general-purpose processing system having one or more microprocessors providing processor functionality, and external memory providing at least a portion of machine-readable medium, all linked to other supporting circuitry via an external bus architecture. Alternatively, the processing system can be implemented using an ASIC (Application-Specific Integrated Circuit) with a processor integrated on a single chip, a bus interface, a user interface (in the case of an access terminal), supporting circuitry, and at least a portion of machine-readable medium, or using one or more FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), controllers, state machines, gated logic, discrete hardware components, or any other suitable circuitry, or any combination of circuitry capable of performing the various functionalities described throughout this disclosure. Depending on the specific application and the overall design constraints imposed on the system, those skilled in the art will recognize how the functionality described regarding the processing system can be better implemented.

[0164] Machine-readable media may include several software modules. These software modules include instructions that, when executed by a device such as a processor, cause the processing system to perform various functions. These software modules may include transfer modules and receive modules. Each software module may reside in a single storage device or be distributed across multiple storage devices. As an example, when a trigger event occurs, a software module may be loaded from a hard drive into RAM. During the execution of a software module, the processor may load some instructions into a cache to improve access speed. One or more cache lines may subsequently be loaded into a general-purpose register file for processor execution. In the context of the functionality of the software module described below, it will be understood that such functionality is implemented by the processor when the processor executes the instructions from the software module.

[0165] If implemented in software, the functions can be stored or transmitted as one or more instructions or codes on or through a computer-readable medium. Computer-readable media includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. Storage media can be any available medium accessible to a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as computer-readable media. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared (IR), radio, and microwave), then that coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is included in the definition of medium. As used herein, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray® discs, where disks typically reproduce data magnetically, while discs optically reproduce data using lasers. Therefore, in some aspects, computer-readable media may include non-transient computer-readable media (e.g., tangible media). Additionally, in other aspects, computer-readable media may include transient computer-readable media (e.g., signals). Combinations of the above should also be included within the scope of computer-readable media.

[0166] Therefore, certain aspects may include computer program products for performing the operations set forth herein. For example, such computer program products may include computer-readable media on which instructions are stored (and / or encoded) that can be executed by one or more processors to perform the operations described herein. In some aspects, computer program products may include packaging materials.

[0167] It will be understood that the claims are not limited to the precise configurations and components described above. Various modifications, substitutions, and variations can be made to the layout, operation, and details of the methods and apparatus described above without departing from the scope of the claims.

Claims

1. A method for accessing encrypted file storage under a multi-party secure computing platform, applied to a file encrypted storage access system, the file encrypted storage access system comprising a platform side and a user side, the platform side comprising a framework API, the user side comprising a path acquisition module, a training module, and a file encrypted storage module, the file encrypted storage module comprising an object storage interface; the method comprising: The platform-side framework API initiates a path retrieval task on the user-side path retrieval module. The path acquisition module requests the file encryption storage module to dynamically enable the object storage interface, and returns the object storage interface configuration parameters returned by the file encryption storage module to the framework API. as well as The framework API initiates the training process on the user-side training module and provides the object storage interface configuration parameters to the training module. The training module connects to the object storage interface by providing the object storage interface configuration parameters to the object storage interface, and then uses the enabled object storage interface to access encrypted file storage.

2. The method as described in claim 1, wherein, The object storage interface configuration parameters include the object storage service path, wherein the object storage service path includes at least one of the following: read path or storage path.

3. The method as described in claim 1, wherein, Accessing encrypted file storage via the opened object storage interface includes: The opened object storage interface writes the stored data into the file encryption storage module.

4. The method of claim 3, wherein, The stored data is encrypted via the object storage interface and then written into the file encryption storage module.

5. The method of claim 1, wherein, Accessing encrypted file storage via the opened object storage interface includes: The encrypted storage data in the file encryption storage module is read through the opened object storage interface.

6. The method of claim 5, wherein, The encrypted stored data is provided to the training module for use in the training process after being decrypted by the object storage interface.

7. The method of claim 6, wherein, The training process generates training results, and the encrypted file storage access via the enabled object storage interface further includes: The activated object storage interface encrypts the training results and writes them into the file encryption storage module.

8. The method of claim 7, wherein, The object storage interface configuration parameters returned by the file encryption storage module include the path for reading the stored data and the path for writing the training results.

9. A multi-party secure computation platform, comprising a framework API module deployed on the platform side, and a path acquisition module, a training module, and a file encryption and storage module deployed on the user side, wherein the file encryption and storage module includes an object storage interface; wherein: The framework API module is used to launch the path retrieval job deployed on the path retrieval module on the user side; The path acquisition module deployed on the user side is used to request the file encryption storage module to dynamically enable the object storage interface when running the path acquisition job, receive the object storage interface configuration parameters returned by the file encryption storage module, and return the received object storage interface configuration parameters to the framework API module. The framework API module is also used to start the training work on the training work module and provide the object storage interface configuration parameters to the training work module when it receives the object storage interface configuration parameters returned by the path acquisition module. as well as The training module deployed on the user side is used to connect to the object storage interface by providing the object storage interface configuration parameters to the object storage interface, and to access encrypted file storage through the opened object storage interface.

10. The multi-party secure computing platform as described in claim 9, wherein, The object storage interface configuration parameters include the object storage service path, wherein the object storage service path includes at least one of the following: read path or storage path.

11. The multi-party secure computing platform as described in claim 10, wherein, The training module is specifically used for: The object storage interface that has been opened will encrypt the stored data and write it into the file encryption storage module.

12. The multi-party secure computing platform as described in claim 10, wherein, The training module is specifically used for: The encrypted storage data in the file encryption storage module is read and decrypted via the opened object storage interface.

13. The multi-party secure computing platform as described in claim 12, wherein, The training process generates training results, and the training module is specifically used for: The training results are encrypted and written to the file encryption storage module after being opened via the object storage interface.

14. The multi-party secure computing platform as described in claim 13, wherein, The object storage interface configuration parameters returned by the file encryption storage module include the path for reading the stored data and the path for writing the training results.

15. A method for accessing encrypted file storage under a multi-party secure computing platform, the method being implemented by a framework API module deployed on the platform side, the method comprising: Receive the path acquisition process initiated by the multi-party secure computing platform; A job is initiated on the user side to start the path acquisition process on the path acquisition module on the user side, so that the path acquisition module requests the file encryption storage module on the user side to dynamically open the object storage interface and receives the object storage interface configuration parameters returned by it. Obtain the object storage interface configuration parameters for accessing the file encryption storage module from the path acquisition module on the user side; Initiate a task to the user side to start the training task on the user side's training module; as well as The training module on the user side is provided with the object storage interface configuration parameters so that the training module can access the data stored in the file encryption storage module through the enabled object storage interface.

16. A method for accessing encrypted file storage under a multi-party secure computing platform, the method being executed on the user side, wherein the user side is equipped with a path acquisition module, a training module, and a file encrypted storage module, the file encrypted storage module including an object storage interface, and the method comprising: The path acquisition module receives a request to start the path acquisition process from the framework API on the platform side; Running the path acquisition request specifically includes: requesting the file encryption storage module on the user side to dynamically enable the object storage interface; and receiving the object storage interface configuration parameters returned by the file encryption storage module. The path acquisition module returns the received object storage interface configuration parameters to the framework API on the platform side; The training module receives a request to start the training process from the platform's framework API; receives object storage interface configuration parameters for accessing the file encryption storage module from the framework API; and runs the training process, specifically including: using the object storage interface configuration parameters to access the file encryption storage via the enabled object storage interface.

Images