Data intersection method, apparatus and electronic device

Abstract

The application provides a data intersection method and device and electronic equipment, and relates to the technical field of big data processing. The method comprises the following steps: acquiring a plurality of ciphertext data, ensuring the security of the original data provided by a data party, then generating a first key-value pair of each ciphertext data, and regarding at least two ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data for the first key-value pairs with the same first attribute key. Since the data intersection is performed based on the first key-value pairs of the ciphertext data, the plaintext data corresponding to the ciphertext data cannot be obtained, the security of the original data in the intersection process is ensured, the intersection result is also ciphertext data, the intersection result cannot be exposed to a calculation party, and the security of the data in the data intersection process is fully ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data data processing, and particularly relates to a data intersection method and device and electronic equipment. BACKGROUND

[0002] Different institutions and platforms have a large amount of data, for example, a government platform has social security and qualification data covering individuals and enterprises, and banks, operators and Internet institutions have user financial, consumption, communication and social related data. By intersecting data between different institutions and platforms, more data value can be mined.

[0003] In related technologies, when intersecting multi-party data, the original data of the multi-party data and the intersection result of the data are exposed, and the data security cannot be guaranteed. Therefore, how to guarantee the data security in the process of intersecting multi-party data is a technical problem to be solved. SUMMARY

[0004] The present application provides a data intersection method, device and electronic equipment to guarantee the data security in the process of intersecting multi-party data.

[0005] An embodiment of the present application provides a data intersection method, including the following steps:

[0006] Obtain a plurality of ciphertext data;

[0007] Generate a first key-value pair of each piece of ciphertext data, wherein the first key-value pair includes a first attribute key and a first attribute value, the first attribute key is used to indicate the corresponding ciphertext data, and the first attribute value is used to indicate the data provider of the corresponding ciphertext data;

[0008] For the first key-value pairs with the same first attribute key, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data.

[0009] Another embodiment of the present application provides a data intersection method, executed by a first data provider in a plurality of data providers, including the following steps:

[0010] Read at least one piece of plaintext data to be processed;

[0011] Encrypt the at least one piece of plaintext data to obtain ciphertext data corresponding to each piece of plaintext data, and store the correspondence between the plaintext data and the ciphertext data;

[0012] Send at least one piece of ciphertext data to a data processing party, so that the data processing party uses the method of the aforementioned aspect to obtain intersection ciphertext data;

[0013] According to the intersection ciphertext data and the correspondence, intersection plaintext data corresponding to the intersection ciphertext data is obtained. An embodiment of another aspect of the present application provides a data intersection device, comprising:

[0014] An acquisition module is configured to acquire a plurality of ciphertext data.

[0015] A generation module is configured to generate a first key-value pair of each piece of the ciphertext data, wherein the first key-value pair comprises a first attribute key and a first attribute value, the first attribute key is used to indicate corresponding ciphertext data, and the first attribute value is used to indicate a data provider of the corresponding ciphertext data.

[0016] A processing module is configured to, for the first key-value pairs with the same first attribute key, take at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data.

[0017] An embodiment of another aspect of the present application provides a data intersection device, executed by a first data provider in a plurality of data providers, comprising:

[0018] A reading module is configured to read at least one piece of plaintext data to be processed.

[0019] An encryption module is configured to encrypt the at least one piece of plaintext data to obtain ciphertext data corresponding to each piece of the plaintext data, and store a correspondence between the plaintext data and the ciphertext data.

[0020] A sending module is configured to send at least one piece of the ciphertext data to a data processing party, so that the data processing party obtains intersection ciphertext data by using the method in the foregoing aspect.

[0021] A processing module is configured to obtain intersection plaintext data corresponding to the intersection ciphertext data according to the intersection ciphertext data and the correspondence.

[0022] An embodiment of another aspect of the present application provides an electronic device, comprising a processor and a memory storing processor-executable instructions, wherein the processor is configured to execute the instructions to implement the data intersection method in the foregoing aspect, or implement the data intersection method in the foregoing aspect.

[0023] An embodiment of another aspect of the present application provides a computer-readable storage medium, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the data intersection method in the foregoing aspect, or execute the data intersection method in the foregoing aspect.

[0024] Another aspect of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the data intersection method according to the preceding aspect, or implements the data intersection method according to the preceding another aspect.

[0025] The data intersection method, device, electronic device and storage medium provided by the present application obtain a plurality of ciphertext data, thereby ensuring the security of the original data provided by the data party, and then generate a first key-value pair of each ciphertext data, and for the first key-value pairs having the same first attribute key, at least two ciphertext data having different first attribute values and the same first attribute key are taken as intersection ciphertext data. Since the data intersection is performed based on the first key-value pairs of the ciphertext data, the plaintext data corresponding to the ciphertext data cannot be obtained, thereby ensuring the security of the original data in the intersection process. Meanwhile, the intersection result is also ciphertext data, so that the intersection result cannot be exposed to the computing party, thereby fully ensuring the security of the data in the data intersection process.

[0026] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0027] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the accompanying drawings, wherein:

[0028] Figure 1 is a flowchart of the data intersection method according to the first embodiment of the present application;

[0029] Figure 2 is a flowchart of the data intersection method according to the second embodiment of the present application;

[0030] Figure 3 is a flowchart of the data intersection method according to the third embodiment of the present application;

[0031] Figure 4 is a flowchart of the data intersection method according to the fourth embodiment of the present application;

[0032] Figure 5 is a flowchart of the data intersection method according to the fifth embodiment of the present application;

[0033] Figure 6 is a schematic diagram of the ciphertext data encryption process according to the sixth embodiment of the present application;

[0034] Figure 7 is a schematic diagram of the decryption process of the intersection ciphertext data according to the seventh embodiment of the present application;

[0035] Figure 8 is a structural schematic diagram of a data intersection device shown in an eighth embodiment of the present application.

[0036] Figure 9 is a structural schematic diagram of a data intersection device shown in a ninth embodiment of the present application.

[0037] Figure 10 a block diagram of an electronic device provided by an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0038] Embodiments of the present application are described in detail below with reference to the accompanying drawings, in which the same or similar notations used throughout the drawings and the specific descriptions denote the same or similar elements or elements having the same or similar functions. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as a limitation of the present application.

[0039] The data intersection method, device and electronic device of the embodiments of the present application are described below with reference to the accompanying drawings.

[0040] In the related art, when data provided by each data provider is intersected, the data is only encrypted in the data transmission process, and after the data transmission is successful, the data is decrypted, and then the data provided by each data provider is intersected in the form of plaintext, and the calculation result of the data intersection also exists in the form of plaintext in the data intersection calculation party. Such a method will expose the original data of each data provider and the calculation result of the data intersection to the data intersection calculation party, and when the data is private data or confidential data, the data security cannot be guaranteed, and it does not meet the requirements. As an example, in a scenario, a bank wants to verify whether the identity card and the reserved number of a customer are counterfeit, it needs to obtain the identity two elements and the mobile phone three elements information from the relevant departments and the telecom operators respectively, that is, there is a need for data intersection, and in the intersection process, user privacy leakage needs to be placed.

[0041] Therefore, the present application proposes a data intersection method, which realizes data intersection of the data intersection calculation party to the data provided by each data provider in an encrypted and non-transparent state, and guarantees the security of the original data and the data intersection calculation process for data intersection.

[0042] Figure 1 is a flowchart of a data intersection method shown in a first embodiment of the present application.

[0043] As shown in Figure 1 , the method comprises the following steps:

[0044] Step 101, obtaining a plurality of ciphertext data.

[0045] The execution subject of the embodiment of the present application is a data processing party, wherein the data processing party can also serve as a data providing party, for providing ciphertext data to perform data intersection with ciphertext data provided by other data providing parties, wherein the data intersection is to find the intersection of data provided by multiple data providing parties.

[0046] The data providing party can be an institution or a platform, wherein the institution includes banks, operators, the Internet, etc. The platform includes a government affairs platform, etc. For example, the data providing party is a bank, and the provided data includes consumption data; the data providing party is an operator, and the provided data includes communication data; the data providing party is a government affairs platform, and the provided data includes social security data, qualification data, etc.

[0047] In the technical solution of the present application, the acquisition, storage and application of the ciphertext data comply with relevant laws and regulations and do not violate public order and good customs.

[0048] In the embodiment of the present application, the multiple pieces of ciphertext data can be provided by one data providing party or multiple data providing parties, and the ciphertext data provided by each data providing party can be one or more. At least one piece of ciphertext data provided by each data providing party is obtained by encrypting corresponding plaintext data at least once, thereby ensuring the security of the ciphertext data provided by each data providing party. The encryption algorithm uses at least one of the following encryption algorithms:

[0049] The first encryption algorithm is used to divide the product of the data to be encrypted and r e by N, and the remainder is taken as the encrypted ciphertext data, wherein r is a random number, e and N are set public key parameters;

[0050] The second encryption algorithm is used to divide the dth power of the data to be encrypted by N', and the remainder is taken as the encrypted ciphertext data, wherein d and N' are set private key parameters;

[0051] The third encryption algorithm is used to divide the product of the data to be encrypted and the modular inverse of r by N, and the remainder is taken as the encrypted ciphertext data, wherein r is a random number, and N is a set public key parameter.

[0052] As an example, the ciphertext data of the data providing party A is obtained by encrypting the corresponding plaintext data using the second encryption algorithm, wherein d and N' in the second encryption algorithm are set private key parameters in accordance with the asymmetric encryption algorithm RSA. Specifically, the dth power of the plaintext data provided by the data providing party A is divided by N', and the remainder is taken as the encrypted ciphertext data.

[0053] It should be noted that other schemes of generating ciphertext data by using at least one of the first encryption algorithm, the second encryption algorithm and the third encryption algorithm are not listed one by one in the embodiment.

[0054] In step 102, a first key-value pair of each piece of ciphertext data is generated.

[0055] The first key-value pair includes a first attribute key and a first attribute value. The first attribute key is used to indicate the corresponding ciphertext data, and the first attribute value is used to indicate the data provider of the corresponding ciphertext data.

[0056] In the embodiment of the application, for each piece of ciphertext data, the data identifier of the ciphertext data is taken as the first attribute key, and the data source of the ciphertext data, i.e., the data provider, is taken as the first attribute value. The first key-value pair of the ciphertext data is generated according to the first attribute key and the first attribute value of the ciphertext data. Similarly, the first key-value pairs of other pieces of ciphertext data can be generated.

[0057] In step 103, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data for the first key-value pairs with the same first attribute key.

[0058] In the embodiment of the application, the first key-value pairs of the ciphertext data are pushed to the processing nodes in the distributed cluster, so that the first key-value pairs with the same first attribute key are pushed to the same processing node. For the first key-value pairs pushed to the same processing node, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data. The processing node is used to traverse a plurality of key-value pairs to determine at least two first key-value pairs with different first attribute values and the same first attribute key.

[0059] Specifically, for the first key-value pairs pushed to the same processing node, the first attribute keys of each first key-value pair and the first attribute values of each first key-value pair are compared to determine at least two first key-value pairs with different first attribute values and the same first attribute key. The ciphertext data corresponding to the determined at least two first key-value pairs is taken as intersection ciphertext data. That is, the intersection ciphertext data includes at least two pieces of ciphertext data, and there is an intersection between the at least two pieces of ciphertext data. The first attribute values of the ciphertext data in the intersection ciphertext data are different, but the first attribute keys are the same. The intersection of a plurality of ciphertext data is obtained, and the security of the ciphertext data is ensured.

[0060] In the data intersection method of the embodiment, the plurality of ciphertext data is obtained, so that the security of the original data provided by the data party is ensured. Then, the first key-value pair of each ciphertext data is generated. For the first key-value pairs with the same first attribute key, at least two ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data. Since the data intersection is based on the first key-value pair of the ciphertext data, the plaintext data corresponding to the ciphertext data cannot be obtained, so that the security of the original data in the intersection process is ensured. Meanwhile, the result of the intersection is also ciphertext data, so that the result of the intersection cannot be exposed to the computing party, and the security of the data in the data intersection process is fully ensured.

[0061] Based on the previous embodiment, Figure 2 is a flowchart of the data intersection method shown in the second embodiment of the application.

[0062] As Figure 2 shown, the method can include the following steps:

[0063] In step 201, a plurality of ciphertext data is obtained.

[0064] In the embodiment, the data processing party obtains the plurality of ciphertext data provided by the plurality of data providing parties from the distributed file system. To improve the security in the transmission process of the plurality of obtained ciphertext data, as an implementation manner, the HTTPS protocol is used to realize the transmission of the data in the process of transmitting the plurality of ciphertext data from the distributed file system to the data processing party. The Advanced Encryption Standard (AES) algorithm is used to encrypt the transmitted plurality of ciphertext data. Specifically, for each data providing party, the data providing party generates an AES secret key and saves the AES secret key. Then, the AES secret key is used to encrypt the ciphertext data to be transmitted. The RSA public key is used to encrypt the AES secret key. Finally, the encrypted AES secret key and the encrypted ciphertext data are sent to the data processing party together. After receiving the AES secret key and the ciphertext data, the data processing party first decrypts the AES secret key using the RSA private key, then decrypts the encrypted ciphertext data using the decrypted AES secret key, and finally sends a data acquisition success response to the data providing party. Similarly, the plurality of ciphertext data can be obtained from other data providing parties.

[0065] As an implementation manner, the data computing module is arranged in the data processing party, and the data computing module is implemented based on the Hive of the Hadoop framework. The data computing module obtains the ciphertext data provided by each data providing party in the map stage.

[0066] In step 202, the first key-value pair of each ciphertext data is generated.

[0067] In an implementation form of the application, the data calculation module generates, in the map stage, a first key-value pair for each piece of ciphertext data provided by each data provider.

[0068] The first key-value pair includes a first attribute key and a first attribute value. The first attribute key is used to indicate the corresponding ciphertext data, and the first attribute value is used to indicate the data provider of the corresponding ciphertext data.

[0069] As an example, Table 1 shows the identification of each piece of ciphertext data provided by each data provider.

[0070] Data provider Ciphertext data identifier A aaaaa A bbbbb A ccccc B bbbbb B ccccc B ddddd

[0071] Table 1

[0072] Further, for each piece of ciphertext data provided by each data provider, the identification of the ciphertext data is taken as the first attribute key, and the provider to which the ciphertext data belongs is taken as the first attribute value, to generate the key-value pair corresponding to the piece of ciphertext data, as shown in Table 2.

[0073] Table 2

[0074]

[0075]

[0076] In step 203, the first key-value pairs of the plurality of pieces of ciphertext data are sorted.

[0077] In an implementation form of the embodiment of the application, in the map stage, the first attribute keys in the first key-value pairs of the plurality of pieces of ciphertext data are sorted according to the first attribute keys, for example, the first attribute keys are sorted in ascending or descending order based on the number of characters contained in the first attribute keys, or the first attribute keys are sorted according to the first characters in the characters contained in the first attribute keys, to obtain the sorting result of the first key-value pairs of the plurality of pieces of ciphertext data, so that the same first attribute keys are gathered together.

[0078] In step 204, according to the sorting, the first attribute keys of the first key-value pairs of the plurality of pieces of ciphertext data are subjected to hash calculation, to obtain the hash values of the first attribute keys of the plurality of pieces of ciphertext data.

[0079] In step 205, according to the hash values, the first key-value pairs of the plurality of pieces of ciphertext data are pushed to a processing node corresponding to the hash value in the distributed cluster.

[0080] The distributed cluster refers to the advantages of both cluster and distribution, which realizes the separation of business and improves the processing capacity of the server. The distributed cluster includes a plurality of processing nodes, and the plurality of processing nodes cooperate to realize the processing of business data.

[0081] In an implementation form of the embodiment of the application, the data calculation module further comprises a shuffle stage. In the shuffle stage, the first key-value pair of the plurality of ciphertext data is subjected to hash calculation of the first attribute key according to the sorting, to obtain the hash value of the first attribute key of each ciphertext data, wherein the hash value indicates a processing node in the distributed cluster, and thus the first key-value pair of each ciphertext data is pushed to the processing node corresponding to the hash value in the distributed cluster according to the hash value, so that the first key-value pairs with the same first attribute key are pushed to the same processing node.

[0082] As an example, based on the key-value pairs in Table 2, the first key-value pairs with the same first attribute key are pushed to the same processing node, and the key-value pairs pushed to two processing nodes are obtained, referred to as a first processing node and a second processing node. The key-value pairs contained in the first processing node are shown in Table 3:

[0083] Table 3

[0084] First attribute key Key First attribute value Value aaaaa A bbbbb A bbbbb B

[0085] The key-value pairs contained in the second processing node are shown in Table 4:

[0086] Table 4

[0087] First attribute key Key First attribute value Value ccccc A ccccc B ddddd B

[0088] In step 206, for the first key-value pairs pushed to the same processing node, at least two ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data.

[0089] In the embodiment of the application, for the first key-value pairs pushed to the same processing node, the first attribute key and the first attribute value are compared to take at least two ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data.

[0090] As an example, each processing node can perform a reduce stage. In the reduce stage, for the first key-value pairs pushed to the same processing node, the first attribute key between the first key-value pairs and the first attribute value between the first key-value pairs are compared to take at least two ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data.

[0091] As an example, according to the key-value pairs in Table 3, it can be determined that there is an intersection between the key-value pairs [bbbbb, A] and [bbbbb, B] by taking at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data, and then taking the ciphertext data bbbbb as the intersection ciphertext data. According to the key-value pairs in Table 4, it can be determined that there is an intersection between the key-value pairs [ccccc, A] and [ccccc, B] by taking at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data, and then taking the ciphertext data ccccc as the intersection ciphertext data.

[0092] The data intersection method of the embodiment of the present application obtains multiple pieces of ciphertext data, ensures the security of the original data provided by the data party, and then generates the first key-value pairs of each piece of ciphertext data. For the first key-value pairs with the same first attribute key, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data. Since the data intersection is based on the first key-value pairs of the ciphertext data, the plaintext data corresponding to the ciphertext data cannot be obtained, which ensures the security of the original data in the intersection process. At the same time, the result of the intersection is also ciphertext data, so that the result of the intersection cannot be exposed to the computing party, and the security of the data in the data intersection process is fully ensured.

[0093] Based on the above embodiment, Figure 3 is a flowchart of the data intersection method shown in the third embodiment of the present application.

[0094] As Figure 3 shown, the method can include the following steps:

[0095] Step 301, obtaining multiple pieces of ciphertext data.

[0096] Step 302, generating the first key-value pairs of each piece of ciphertext data.

[0097] Step 303, sorting the first key-value pairs of the multiple pieces of ciphertext data.

[0098] Step 304, according to the sorting, performing hash calculation on the first attribute key of the first key-value pairs of the multiple pieces of ciphertext data to obtain the hash values of the first attribute keys of each piece of ciphertext data.

[0099] Step 305, according to the hash values, pushing the first key-value pairs of each piece of ciphertext data to a processing node corresponding to the hash value in the distributed cluster.

[0100] Step 306, for the first key-value pairs pushed to the same processing node, taking at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data.

[0101] The steps 301-306 can refer to the above-mentioned explanations, and the principles are the same, and thus will not be repeated here.

[0102] In step 307, the data provider to which the intersection ciphertext data belongs is determined according to the first attribute value of the intersection ciphertext data.

[0103] As an example, based on Table 3, it is determined that the intersection ciphertext data is ciphertext data 1 corresponding to the key-value pair [bbbbb, A] and ciphertext data 2 corresponding to the key-value pair [bbbbb, B], according to the first attribute value A of the ciphertext data 1, it is determined that the data provider to which the ciphertext data 1 belongs is A, and according to the first attribute value B of the ciphertext data 1, it is determined that the data provider to which the ciphertext data 2 belongs is B, that is, the data provider to which the intersection ciphertext data belongs includes A and B.

[0104] In step 308, the intersection ciphertext data is sent to the data provider to which the intersection ciphertext data belongs.

[0105] Further, the intersection ciphertext data is sent to the data providers A and B. As an implementation manner, in order to ensure the security of the transmission process, the intersection ciphertext data can be encrypted by AES when the intersection ciphertext data is sent to the data provider to which the intersection ciphertext data belongs, so as to further improve the reliability in the transmission process. The specific encryption manner can refer to the above-mentioned explanations, and the principles are the same, and thus will not be repeated here.

[0106] The data intersection method of the embodiment of the application acquires a plurality of ciphertext data, ensures the security of the original data provided by the plurality of data providers, further generates the first key-value pair of each ciphertext data, pushes the first key-value pairs with the same first attribute key to the same processing node according to the first key-value pair of each ciphertext data, compares the first attribute keys of the first key-value pairs for the same processing node, and compares the first attribute values of the first key-value pairs, so as to take at least two ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data. Since the data intersection is based on the first key-value pair of the ciphertext data, the security of the original data in the intersection process is ensured, and at the same time, the intersection result will not be exposed to the calculation party, so as to fully ensure the security of the data in the data intersection process.

[0107] Based on the above embodiment, Figure 4 is a flowchart of the data intersection method shown in the fourth embodiment of the application.

[0108] As Figure 4 shown, the method includes the following steps:

[0109] In step 401, at least one plaintext data to be processed is read.

[0110] The execution subject of the embodiment of the application is a first data provider in multiple data providers, and the first data provider is configured to provide multiple pieces of civilized data to be processed.

[0111] The plaintext data is the unencrypted data to be processed.

[0112] In an implementation manner of the embodiment of the application, the at least one piece of plaintext data to be processed can be stored in a set storage unit in advance, and the storage mechanism of the set storage unit can be implemented according to HDFS of the Hadoop framework. The HDFS cuts each piece of plaintext data to be processed into a plurality of data blocks, and each data block stores a plurality of backups, for example, three copies, in the data nodes of the HDFS. The data node positions of the data blocks and the mapping relationship between the data blocks are stored in the metadata nodes of the HDFS. When the plaintext data to be processed is obtained from the distributed file system, the data node positions of the data blocks of the plaintext data to be processed and the mapping relationship are obtained through the metadata nodes of the HDFS, and then each data block is combined to restore the unencrypted plaintext data to be processed.

[0113] In step 402, the at least one piece of plaintext data is encrypted to obtain the ciphertext data corresponding to each piece of plaintext data, and the corresponding relationship between each piece of plaintext data and the corresponding ciphertext data is stored.

[0114] In the embodiment of the application, each piece of plaintext data is encrypted at least once to obtain each piece of ciphertext data, wherein at least one encryption algorithm in the following is used for encryption:

[0115] The first encryption algorithm is configured to divide the product of the data to be encrypted and r e by N, and the remainder is taken as the encrypted ciphertext data, r is a random number, e and N are set public key parameters;

[0116] The second encryption algorithm is configured to divide the d-th power of the data to be encrypted by N', and the remainder is taken as the encrypted ciphertext data, d and N' are set private key parameters;

[0117] The third encryption algorithm is configured to divide the product of the data to be encrypted and the modular inverse of r by N, and the remainder is taken as the encrypted ciphertext data, r is a random number, and N is a set public key parameter.

[0118] In step 403, the at least one piece of ciphertext data is sent to the data processing party.

[0119] In an implementation manner of the embodiment of the application, in order to further guarantee the security of the plurality of pieces of ciphertext data, at least one piece of ciphertext data can be re-encrypted and then sent to the data processing party through the transmission module, as an implementation manner, the encryption can be performed through the AES encryption algorithm to ensure the security in the transmission process, and the specific implementation can refer to the explanation in step 201, and the principle is the same, which will not be described here.

[0120] The at least one piece of ciphertext data is used to obtain intersection ciphertext data by using the data intersection method in the method embodiment.

[0121] The determination method of the intersection ciphertext data can refer to Figures 1-3 The principle of the data intersection method in the corresponding method embodiment is the same, which will not be described here.

[0122] In step 404, the intersection plaintext data corresponding to the intersection ciphertext data is obtained according to the intersection ciphertext data and the corresponding relationship.

[0123] In an implementation manner of the embodiment of the application, according to the intersection ciphertext data and the corresponding relationship between the ciphertext data and the corresponding plaintext data, the intersection plaintext data corresponding to the intersection ciphertext data can be determined, so that the first data provider determines the corresponding intersection plaintext data according to the obtained intersection ciphertext data and the corresponding relationship between the ciphertext data and the plaintext data stored by the first data provider, and the security of the plaintext data provided by the first data provider is ensured.

[0124] As an example, the intersection ciphertext data includes ciphertext data A, according to the corresponding relationship between the ciphertext data and the corresponding plaintext data, the plaintext data A' corresponding to the ciphertext data A can be found, so that the plaintext data A' corresponding to the ciphertext data A included in the intersection ciphertext data can be determined.

[0125] In another implementation manner of the embodiment of the application, the second key-value pair is generated according to the intersection ciphertext data and the set character, wherein the attribute key in the second key-value pair is the intersection ciphertext data, and the attribute value in the second key-value pair is the set character; the third key-value pair is generated according to the corresponding relationship, wherein the attribute key in the third key-value pair is the ciphertext data, and the attribute value in the third key-value pair is the plaintext data having the corresponding relationship; for the second key-value pair and the third key-value pair having the same attribute key, the intersection plaintext data corresponding to the intersection ciphertext data as the attribute key in the second key-value pair is determined according to the plaintext data as the attribute value in the third key-value pair.

[0126] In the data intersection method of the embodiments of the present application, the at least one plaintext data to be processed is encrypted to obtain the ciphertext data corresponding to each piece of plaintext data, and the correspondence between each piece of plaintext data and the corresponding ciphertext data is stored, and the at least one ciphertext data is sent to the data processing party. By encrypting the plaintext data, it is ensured that the data processing party cannot obtain the plaintext data, and the security of the plaintext data is ensured. Further, the intersection ciphertext data obtained by the data processing party using the data intersection method of the foregoing method embodiments is obtained, the intersection plaintext data corresponding to the intersection ciphertext data is obtained according to the intersection ciphertext data and the correspondence, the intersection ciphertext data obtained by the data processing party is obtained from the data processing party, the intersection plaintext data is determined at the first data providing party, the security of the plaintext data to be processed in the data intersection process is ensured, and the data intersection result, that is, the intersection ciphertext data, can only be decrypted by the first data providing party, and cannot be decrypted by the data processing party, so that information leakage is avoided, and the security of the data providing party information is ensured.

[0127] Based on the foregoing embodiment, Figure 5 FIG. 1 is a flowchart of a data intersection method according to a fifth embodiment of the present application.

[0128] As Figure 5 shown, the method comprises the following steps:

[0129] Step 501, reading at least one piece of plaintext data to be processed.

[0130] The execution subject of the embodiments of the present application is a first data providing party in a plurality of data providing parties, and the first data providing party is used to provide at least one piece of plaintext data to be processed.

[0131] The plaintext data is the unencrypted data to be processed.

[0132] The step 501 can refer to the explanation and description in the step, and the principle is the same, which will not be described here.

[0133] Step 502, encrypting the at least one piece of plaintext data to obtain the ciphertext data corresponding to each piece of plaintext data, and storing the correspondence between each piece of plaintext data and the corresponding ciphertext data.

[0134] In the embodiments of the present application, the first data providing party can use at least one of the first encryption algorithm, the second encryption algorithm and the third encryption algorithm to encrypt, as an example, the encryption mode can be determined according to whether the first data providing party has a private key or a public key of RSA, and the encryption flexibility is improved by different encryption modes.

[0135] In the first scenario, the first data provider owns the private key of RSA, and the main encryption method, i.e., the second encryption algorithm, is used for encryption. Specifically, the set private key parameter d and N' of RSA are obtained, the d-th power of the plaintext data is divided by N', and the remainder obtained is used as the encrypted ciphertext data.

[0136] i.e., ciphertext data = plaintext data d mod N'.

[0137] In the second scenario, the first data provider owns the public key of RSA, and the from encryption method, i.e., the first encryption algorithm, the second encryption algorithm, and the third encryption algorithm, are used for encryption. Specifically:

[0138] For any one piece of plaintext data of the first data provider, the first encryption algorithm is used for encryption to obtain the first intermediate ciphertext, the first intermediate ciphertext is sent to the second data provider in the plurality of data providers, so that the second encryption algorithm is used to encrypt the first intermediate ciphertext to obtain the second intermediate ciphertext, and the third encryption algorithm is used to encrypt the second intermediate ciphertext to obtain the ciphertext data.

[0139] As an example, as shown in Figure 6 , the first data provider B owns the public key of RSA, i.e., the set public key parameter e, and FIG. 6 shows the process of encryption of the first data provider B using the from encryption method. Specifically, the first data provider B, for any one piece of plaintext data, uses the udf function, i.e., the confusion of the input plaintext data based on the MessageDigest class in Java, for example, the confusion algorithm is sha-256, and then uses the first encryption algorithm, i.e., the udaf function based on the BigInteger class in Java, to divide the product of the to-be-encrypted data and re by N according to the set public key parameter e and N of RSA and a random number r, and the remainder obtained is used as the encrypted first intermediate ciphertext.

[0140] i.e., first intermediate ciphertext = (to-be-encrypted data * r e ) mod N.

[0141] Then, the first data provider B sends the first intermediate ciphertext to the second data provider A in the plurality of data providers, and the second data provider A owns the private key of RSA, i.e., the set private key parameter d, so that the second data provider A uses the second encryption algorithm to encrypt the first intermediate ciphertext to obtain the second intermediate ciphertext. Specifically, the set private key parameter d and N' of RSA are obtained, the d-th power of the first intermediate ciphertext is divided by N', and the remainder obtained is used as the encrypted second intermediate ciphertext.

[0142] i.e., second intermediate ciphertext = first intermediate ciphertext d mod N'.

[0143] Finally, the first data provider B encrypts the second intermediate ciphertext by using a third encryption algorithm to obtain the ciphertext data. Specifically, the udaf function based on the BigInteger class in Java is used to encrypt the input second intermediate ciphertext, that is, a random number r is obtained, a public key parameter N is set, a product of the second intermediate ciphertext and a modular inverse of r is divided by N, and a remainder obtained is taken as the encrypted ciphertext data.

[0144] that is, the ciphertext data = (second intermediate ciphertext x r -1 modN) modN.

[0145] In step 503, at least one piece of ciphertext data is sent to the data processing party.

[0146] In the embodiment of the application, in order to further guarantee the security of the plurality of pieces of ciphertext data, at least one piece of ciphertext data can be re-encrypted and then sent to the data processing party. As an implementation manner, the encryption can be performed by using the AES encryption algorithm to ensure the security in the transmission process. Specifically, the explanation and description in step 201 can be referred to, and the principle is the same, which will not be described here.

[0147] In an implementation manner of the embodiment of the application, a decryption module is arranged in the first data provider, and the decryption module is implemented based on the Hive of the Hadoop framework. The decryption module obtains the intersection ciphertext data provided by the data processing party in the map stage.

[0148] Specifically, the explanation and description in the foregoing embodiment are also applicable to this embodiment, which will not be described here.

[0149] In step 504, a second key-value pair is generated according to the intersection ciphertext data and a set character.

[0150] The attribute key in the second key-value pair is the intersection ciphertext data, and the attribute value in the second key-value pair is the set character.

[0151] The set character can be any character set, for example, the character null.

[0152] In an implementation manner of the embodiment of the application, the decryption module takes, in the map stage, the identification of the ciphertext data determined by the intersection in the intersection ciphertext data as the attribute key in the second key-value pair and takes the set character as the attribute value.

[0153] As an example, as Figure 7As shown, the intersection ciphertext data obtained by the first data provider contains two, bbbbb and ccccc, so that the second key-value pair generated by the intersection ciphertext data bbbbb is [bbbbb, null], where bbbbb is the attribute key and null is the attribute value; the second key-value pair generated by the intersection ciphertext data ccccc is [ccccc, null], where ccccc is the attribute key and null is the attribute value.

[0154] In step 505, a third key-value pair is generated according to the correspondence relationship, where the attribute key in the third key-value pair is ciphertext data, and the attribute value in the third key-value pair is plaintext data having the correspondence relationship.

[0155] In the embodiment of the application, the decryption module generates a third key-value pair according to the correspondence relationship in the map stage, where the correspondence relationship contained by the first data provider in Table 5 is indicated by the identifier of the ciphertext data, and the correspondence relationship between each ciphertext data and plaintext data is shown in Table 5.

[0156] Table 5

[0157] Identifier of ciphertext data Plaintext data bbbbb B ccccc C ddddd D

[0158] According to the correspondence relationship between the ciphertext data and the plaintext data, a third key-value pair is generated, where the attribute key in the third key-value pair is ciphertext data, and the attribute value in the third key-value pair is plaintext data having the correspondence relationship, as shown in Figure 7 the third key-value pair in the embodiment.

[0159] In step 506, the second key-value pair and the third key-value pair are pushed to the storage node in the distributed cluster, so that the second key-value pair and the third key-value pair having the same attribute key are pushed to the same storage node.

[0160] In an implementation manner of the embodiment of the application, the decryption module includes a shuffle stage, and in the shuffle stage, for each second key-value pair, the attribute key of the second key-value pair is subjected to hash calculation to obtain the hash value of the attribute key of the second key-value pair, where the hash value indicates a storage node in the distributed cluster, so that the second key-value pair is pushed to a storage node corresponding to the hash value in the distributed cluster according to the hash value of the attribute key of the second key-value pair. Similarly, each third key-value pair is pushed to a storage node in the distributed cluster, where the second key-value pair and the third key-value pair having the same attribute key are pushed to the same storage node.

[0161] It should be noted that the storage node in the embodiment of the application is configured with a reduce, that is, the reduce stage is executed in the storage node.

[0162] As an example, asFigure 7 As shown, the second key-value pair with attribute key bbbbb in the second key-value pair and the third key-value pair with attribute key bbbbb in the third key-value pair are pushed to the same storage node M1; and the second key-value pair with attribute key ccccc in the second key-value pair, the third key-value pair with attribute key ccccc in the third key-value pair and the third key-value pair with attribute key ddddd are pushed to the same storage node M2.

[0163] In step 507, for the second key-value pair and the third key-value pair pushed to the same storage node, the intersection plaintext data corresponding to the intersection ciphertext data of the attribute key in the target second key-value pair is determined according to the plaintext data as the attribute value in the target third key-value pair.

[0164] In the embodiment of the present application, for the second key-value pair and the third key-value pair pushed to the same storage node, the attribute keys are compared to obtain the target second key-value pair and the target third key-value pair with the same attribute key.

[0165] As an example, in the reduce phase, for the second key-value pair and the third key-value pair pushed to the same storage node, the attribute keys are compared to obtain the target second key-value pair and the target third key-value pair with the same attribute key. As an example, Figure 7 As shown, for the three key-value pairs in the storage node M2, which are one second key-value pair and two third key-value pairs, the target second key-value pair X2 and the target third key-value pair L2 with the same attribute key are obtained by comparing the attribute keys.

[0166] Further, as shown in FIG. 6, for the target second key-value pair X2 and the target third key-value pair L2 in the storage node M2, the intersection plaintext data C corresponding to the intersection ciphertext data of the attribute key in the target second key-value pair is determined according to the plaintext data C as the attribute value in the target third key-value pair. Figure 7

[0167] ​The data intersection method of the embodiments of the present application encrypts at least one piece of plaintext data to be processed to obtain ciphertext data corresponding to each piece of plaintext data, stores the correspondence between each piece of plaintext data and the corresponding ciphertext data, and sends at least one piece of ciphertext data to a data processing party. By encrypting the plaintext data, it is ensured that the data processing party cannot obtain the plaintext data, and the security of the plaintext data is ensured. Further, the intersection ciphertext data obtained by the data processing party by using the data intersection method of the foregoing method embodiments to perform data intersection on the ciphertext data sent by multiple data providing parties is obtained, the intersection plaintext data corresponding to the intersection ciphertext data is obtained according to the intersection ciphertext data and the correspondence, the intersection ciphertext data obtained by the data processing party is obtained from the first data providing party, the security of the plaintext data to be processed in the data intersection process is ensured, and the data intersection result, that is, the intersection ciphertext data, can only be decrypted by the first data providing party, and cannot be decrypted by the data processing party, so that information leakage is avoided, and the security of the information is ensured.

[0168] To implement the foregoing embodiments, the present application further provides a data intersection device.

[0169] Figure 8 FIG. 8 is a structural schematic diagram of a data intersection device according to an eighth embodiment of the present application.

[0170] As shown in FIG. 8, the device includes: Figure 8 The obtaining module 81 is configured to obtain multiple pieces of ciphertext data.

[0171] The generating module 82 is configured to generate a first key-value pair of each piece of ciphertext data, wherein the first key-value pair includes a first attribute key and a first attribute value, the first attribute key is used to indicate the corresponding ciphertext data, and the first attribute value is used to indicate the data providing party of the corresponding ciphertext data. The processing module 83 is configured to, for the first key-value pairs with the same first attribute key, take at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data.

[0172] Further, in a possible implementation manner of the embodiments of the present application, the device further includes:

[0173] The determining module is configured to determine the data providing party to which the intersection ciphertext data belongs according to the first attribute value of the intersection ciphertext data.

[0174] The sending module is configured to send the intersection ciphertext data to the data providing party to which the intersection ciphertext data belongs.

[0175]

[0176]

[0177] ​In one possible implementation of this application embodiment, the processing module 83 is specifically used for:

[0178] The first key-value pair of each of the encrypted data is pushed to the processing node in the distributed cluster, so that the first key-value pairs with the same first attribute key are pushed to the same processing node.

[0179] For the first key-value pair pushed to the same processing node, at least two ciphertext data that have different first attribute values ​​and the same first attribute key are taken as the intersection ciphertext data.

[0180] In one possible implementation of this application embodiment, the processing module 83 is specifically used for:

[0181] Sort the first key-value pairs of the multiple encrypted data;

[0182] Based on the sorting, the hash calculation of the first attribute value is performed on the first key-value pairs of the multiple encrypted data to obtain the hash value of the first attribute value of each encrypted data;

[0183] Based on the hash value, the first key-value pair of each encrypted data is pushed to a processing node in the distributed cluster that corresponds to the hash value.

[0184] In one possible implementation of this application embodiment, each of the ciphertext data is obtained by encrypting plaintext data at least once, wherein the at least one encryption uses at least one of the following encryption algorithms:

[0185] The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters.

[0186] The second encryption algorithm is used to divide the data to be encrypted by the power of d by N', and the remainder is used as the encrypted ciphertext data. d and N' are the private key parameters.

[0187] The third encryption algorithm is used to divide the product of the data to be encrypted and the modulo reciprocal of r by N, and the remainder is used as the encrypted ciphertext data. r is a random number and N is a public key parameter.

[0188] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of this embodiment, and will not be repeated here.

[0189] The data intersection device of the embodiment obtains multiple pieces of ciphertext data, ensures the security of the original data provided by the data party, and further generates a first key-value pair of each piece of ciphertext data. For the first key-value pairs with the same first attribute key, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data. Since the data intersection is based on the first key-value pair of the ciphertext data, the plaintext data corresponding to the ciphertext data cannot be obtained, which ensures the security of the original data in the intersection process. Meanwhile, the intersection result is also ciphertext data, so the intersection result cannot be exposed to the calculation party, thereby fully ensuring the security of the data in the data intersection process.

[0190] To implement the above embodiment, the application further provides a data intersection device arranged in a first data provider in multiple data providers.

[0191] Figure 9 FIG. 9 is a structural schematic diagram of the data intersection device according to the ninth embodiment of the application.

[0192] As shown in FIG. 9, the device includes: Figure 9

[0193] The reading module 91 is configured to read at least one piece of plaintext data to be processed.

[0194] The encryption module 92 is configured to encrypt the at least one piece of plaintext data to obtain ciphertext data corresponding to each piece of plaintext data, and store the correspondence between the plaintext data and the ciphertext data.

[0195] The sending module 93 is configured to send at least one piece of ciphertext data to a data processing party, so that the data processing party obtains intersection ciphertext data by using the method of the foregoing method embodiments for data intersection.

[0196] The processing module 94 is configured to obtain intersection plaintext data corresponding to the intersection ciphertext data according to the intersection ciphertext data and the correspondence.

[0197] Further, in an implementation manner of the embodiment of the application, the processing module 94 is specifically configured to:

[0198] generate a second key-value pair according to the intersection ciphertext data and a set character, wherein the attribute key in the second key-value pair is the intersection ciphertext data, and the attribute value in the second key-value pair is the set character;

[0199] generate a third key-value pair according to the correspondence, wherein the attribute key in the third key-value pair is the ciphertext data, and the attribute value in the third key-value pair is the plaintext data having the correspondence;

[0200] ​For a second key-value pair and a third key-value pair with the same attribute key, the intersection plaintext data corresponding to the intersection ciphertext data of the second key-value pair as attribute keys is determined based on the plaintext data used as attribute values ​​in the third key-value pair.

[0201] In one implementation of this application embodiment, the processing module 94 is specifically used for:

[0202] The second key-value pair and the third key-value pair are pushed to the storage nodes in the distributed cluster so that the second key-value pair and the third key-value pair with the same attribute key are pushed to the same storage node;

[0203] For the second key-value pair and the third key-value pair pushed to the same storage node, based on the plaintext data used as attribute values ​​in the target third key-value pair, determine the intersection plaintext data corresponding to the intersection ciphertext data used as attribute keys in the target second key-value pair.

[0204] In one implementation of this application, each piece of ciphertext data is obtained by encrypting the plaintext data at least once, and the at least one encryption algorithm is used:

[0205] The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters.

[0206] The second encryption algorithm is used to divide the data to be encrypted by the power of d by N', and the remainder is used as the encrypted ciphertext data. d and N' are the private key parameters.

[0207] The third encryption algorithm is used to divide the product of the data to be encrypted and the modulo reciprocal of r by N, and the remainder is used as the encrypted ciphertext data. r is a random number and N is a public key parameter.

[0208] In one implementation of this application embodiment, the encryption module 92 is specifically used for:

[0209] For any plaintext data, the first encryption algorithm is used to encrypt it to obtain the first intermediate ciphertext;

[0210] The first intermediate ciphertext is sent to the second data provider among the plurality of data providers, so that the second data provider encrypts the first intermediate ciphertext using the second encryption algorithm to obtain the second intermediate ciphertext;

[0211] The second intermediate ciphertext is encrypted using a third encryption algorithm to obtain the ciphertext data.

[0212] It should be noted that the foregoing explanation of the method embodiment is also applicable to the device of this embodiment, which will not be repeated here.

[0213] In the data intersection device of the embodiment of the application, the at least one piece of plaintext data to be processed is encrypted to obtain the ciphertext data corresponding to each piece of plaintext data, and the correspondence between each piece of plaintext data and the corresponding ciphertext data is stored, and the at least one piece of ciphertext data is sent to the data processing party. By encrypting the plaintext data, it is ensured that the data processing party cannot obtain the plaintext data, and the security of the plaintext data is ensured. Further, the data intersection method described in the foregoing method embodiment is used to obtain the intersection ciphertext data obtained by performing data intersection on the ciphertext data sent by the plurality of data providing parties, and the intersection plaintext data corresponding to the intersection ciphertext data is obtained according to the intersection ciphertext data and the correspondence, so that the intersection ciphertext data obtained by performing data intersection from the data processing party is obtained, the intersection plaintext data is determined at the first data providing party, and the security of the plaintext data to be processed in the data intersection process is ensured. The data intersection result, that is, the intersection ciphertext data, can only be decrypted by the first data providing party, and cannot be decrypted by the data processing party, so that information leakage is avoided, and the security of the data providing party information is ensured.

[0214] To implement the above-mentioned embodiments, the application further provides an electronic device, comprising: a processor, and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the foregoing data intersection method.

[0215] To implement the above-mentioned embodiments, the application further provides a computer-readable storage medium, when the instructions in the storage medium are executed by the processor of an electronic device, the electronic device can execute the foregoing data intersection method.

[0216] To implement the above-mentioned embodiments, the application further provides a computer program product, comprising a computer program, when the computer program is executed by a processor, the foregoing data intersection method is implemented.

[0217] Figure 10 A block diagram of an electronic device provided for an exemplary embodiment of the application is provided. The electronic device includes a processor 1001 and a memory 1002 for storing instructions executable by the processor 1001. Wherein, the processor 1001 is configured to execute the instructions to implement the method in the foregoing method embodiment of the application. In actual application, the electronic device can further include a network interface 1003, an I / O controller 1004, a mass storage device 1005, and a bus 1006 for connecting them.

[0218] In an example embodiment, a storage medium including instructions, such as the memory 1002 including instructions, is also provided, which can be executed by the processor 1001 of the electronic device to implement the method in the foregoing method embodiments. Optionally, the storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0219] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, the person skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples, without contradiction.

[0220] In addition, the terms "first", "second" are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "multiple" is at least two, for example, two, three, etc., unless otherwise specifically limited.

[0221] Any process or method descriptions in flow charts or described elsewhere herein can be understood as representing code modules, segments, or portions of code that include one or more executable instructions for implementing the specified logic functions or processes, and the preferred embodiments of the present application also include additional implementation examples, in which the functions can be performed in different orders, in different ways, or in reverse, and the described embodiments should not be construed as limited to the described or discussed order or sequence of functions, unless otherwise specifically specified.

[0222] The logic and / or steps represented in the flowcharts and / or described herein, for example, can be considered as a sequence of executable instructions stored in a computer readable medium, which can be executed by an instruction execution system, apparatus or device, such as a computer-based system, a processor-based system, or other system that can fetch the instructions from the instruction execution system, apparatus or device and execute the instructions, or a combination thereof. For the purposes of this specification, a "computer readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus or device. The computer readable medium can specifically be, but is not limited to, the following: an electronic connection (electronic apparatus) having one or more wires, a portable computer diskette (magnetic apparatus), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disk read-only memory (CDROM). In addition, the computer readable medium can even be paper or other suitable medium upon which the program can be printed, because the program can be electronically obtained, for example, by optically scanning the paper or other medium, then

[0223] It should be understood that portions of the present application can be realized with hardware, software, firmware or a combination thereof. In the foregoing embodiments, a plurality of steps or methods can be realized as software or firmware to be executed by a suitable instruction-executing system. As an example, if realized with hardware and in another embodiment, any one or a combination of the following technologies known in the art can be used: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0224] Those skilled in the art can understand that all or part of the steps carried out by the above-mentioned embodiment methods can be completed by programs instructing relevant hardware, and the programs can be stored in a computer readable storage medium. When the programs are executed, one or a combination of the steps of the method embodiments is included.

[0225] In addition, each of the functional units in the various embodiments of the present application can be integrated in one processing module, or each of the units can be physically present separately, or two or more units can be integrated in one module. The integrated module can be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0226] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and should not be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

Claims

1. A method of data intersection, the method comprising: The method comprises the following steps: obtaining a plurality of pieces of ciphertext data; generating a first key-value pair of each piece of the ciphertext data, wherein the first key-value pair comprises a first attribute key and a first attribute value, the first attribute key is used to indicate corresponding ciphertext data, and the first attribute value is used to indicate a data provider of the corresponding ciphertext data; for the first key-value pairs with the same first attribute key, at least two pieces of ciphertext data with different first attribute values and the same first attribute key are taken as intersection ciphertext data; the step of taking, for the first key-value pairs with the same first attribute key, at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data comprises: pushing the first key-value pairs of each piece of the ciphertext data to processing nodes in a distributed cluster, so that the first key-value pairs with the same first attribute key are pushed to the same processing node; for the first key-value pairs pushed to the same processing node, taking at least two pieces of ciphertext data with different first attribute values and the same first attribute key as intersection ciphertext data, wherein the processing node is used to traverse a plurality of key-value pairs to determine at least two first key-value pairs with different first attribute values and the same first attribute key.

2. The method of claim 1, wherein, The method further comprises: determining, according to the first attribute value of the intersection ciphertext data, a data provider to which the intersection ciphertext data belongs; sending the intersection ciphertext data to the data provider to which the intersection ciphertext data belongs.

3. The method of claim 1, wherein, The step of pushing the first key-value pairs of each piece of the ciphertext data to the processing nodes in the distributed cluster, so that the first key-value pairs with the same first attribute key are pushed to the same processing node, comprises: sorting the first key-value pairs of the plurality of pieces of ciphertext data; performing hash calculation on the first attribute key of the first key-value pairs of the plurality of pieces of ciphertext data according to the sorting, to obtain a hash value of the first attribute key of each piece of the ciphertext data; pushing the first key-value pairs of each piece of the ciphertext data to one processing node corresponding to the hash value in the distributed cluster according to the hash value.

4. The method according to claim 1 or 2, characterized in that, Each piece of the ciphertext data is obtained by encrypting plaintext data at least once, and the at least once encryption adopts at least one encryption algorithm in the following: The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters. a second encryption algorithm, which is used to divide the d-th power of to-be-encrypted data by N', and take the remainder as encrypted ciphertext data, d and N' being set private key parameters; a third encryption algorithm, which is used to divide the product between to-be-encrypted data and the modular inverse of r by N, and take the remainder as encrypted ciphertext data, r being a random number and N being a set public key parameter.

5. A method of data intersection, the method comprising: The method performed by a first data provider in a plurality of data providers comprises the following steps: reading at least one piece of to-be-processed plaintext data; encrypting the at least one piece of plaintext data to obtain ciphertext data corresponding to each piece of the plaintext data, and storing the correspondence between the plaintext data and the ciphertext data; sending at least one piece of the ciphertext data to a data processing party, so that the data processing party obtains intersection ciphertext data by performing data intersection using the method in any one of claims 1-4. According to the intersection ciphertext data and the corresponding relationship, intersection plaintext data corresponding to the intersection ciphertext data is obtained.

6. The method of claim 5, wherein, The intersection ciphertext data and the corresponding relationship are used to obtain intersection plaintext data corresponding to the intersection ciphertext data. According to the intersection ciphertext data and a set character, a second key-value pair is generated, wherein the attribute key in the second key-value pair is the intersection ciphertext data, and the attribute value in the second key-value pair is the set character. According to the corresponding relationship, a third key-value pair is generated, wherein the attribute key in the third key-value pair is the ciphertext data, and the attribute value in the third key-value pair is plaintext data having the corresponding relationship. For the second key-value pair and the third key-value pair having the same attribute key, the intersection plaintext data corresponding to the intersection ciphertext data as the attribute key in the second key-value pair is determined according to the plaintext data as the attribute value in the third key-value pair.

7. The method of claim 6, wherein, The intersection ciphertext data and the corresponding relationship are used to obtain intersection plaintext data corresponding to the intersection ciphertext data. The second key-value pair and the third key-value pair are pushed to a storage node in a distributed cluster, so that the second key-value pair and the third key-value pair having the same attribute key are pushed to the same storage node. For the second key-value pair and the third key-value pair pushed to the same storage node, the intersection plaintext data corresponding to the intersection ciphertext data as the attribute key in the target second key-value pair is determined according to the plaintext data as the attribute value in the target third key-value pair.

8. The method according to any one of claims 5-7, characterized in that, Each piece of the ciphertext data is obtained by encrypting the plaintext data at least once, and the at least once encryption uses at least one encryption algorithm in the following: The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters. A second encryption algorithm is used to divide the d-th power of the data to be encrypted by N', and the remainder is taken as the encrypted ciphertext data, d and N' being set private key parameters; A third encryption algorithm is used to divide the product between the data to be encrypted and the modular inverse of r by N, and the remainder is taken as the encrypted ciphertext data, r being a random number and N being a set public key parameter.

9. The method of claim 8, wherein, The first encryption algorithm, the second encryption algorithm and the third encryption algorithm are used together to encrypt the plurality of plaintext data, so as to obtain the ciphertext data corresponding to each piece of the plaintext data, including: For any one piece of plaintext data, the first encryption algorithm is used for encryption to obtain a first intermediate ciphertext; The first intermediate ciphertext is sent to a second data provider in the plurality of data providers, so that the second data provider encrypts the first intermediate ciphertext by using the second encryption algorithm to obtain a second intermediate ciphertext; The third encryption algorithm is used to encrypt the second intermediate ciphertext to obtain the ciphertext data.

10. A data intersection device, characterized by It includes: An acquisition module is configured to acquire a plurality of ciphertext data; A generation module is configured to generate a first key-value pair of each piece of the ciphertext data, wherein the first key-value pair includes a first attribute key and a first attribute value, the first attribute key is used to indicate the corresponding ciphertext data, and the first attribute value is used to indicate a data provider of the corresponding ciphertext data; The processing module is used to, for a first key-value pair having the same first attribute key, take at least two ciphertext data with different first attribute values ​​but the same first attribute key as intersection ciphertext data; The processing module is specifically used for: The first key-value pair of each of the encrypted data is pushed to the processing node in the distributed cluster, so that the first key-value pairs with the same first attribute key are pushed to the same processing node. For the first key-value pairs pushed to the same processing node, at least two ciphertext data that have different first attribute values ​​and the same first attribute key are taken as intersection ciphertext data. The processing node is used to traverse multiple key-value pairs to determine at least two first key-value pairs that have different first attribute values ​​and the same first attribute key.

11. The apparatus of claim 10, wherein, The device further includes: The determining module is used to determine the data provider to which the intersection ciphertext data belongs based on the first attribute value of the intersection ciphertext data; The sending module is used to send the intersection ciphertext data to the data provider to which the intersection ciphertext data belongs.

12. The apparatus of claim 10 or 11, wherein, The processing module is specifically used for: Sort the first key-value pairs of the multiple encrypted data; Based on the sorting, the hash calculation of the first attribute key is performed on the first key-value pairs of the multiple encrypted data to obtain the hash value of the first attribute key of each encrypted data. Based on the hash value, the first key-value pair of each encrypted data is pushed to a processing node in the distributed cluster that corresponds to the hash value.

13. The apparatus of claim 10 or 11, wherein, The ciphertext data described in each entry is obtained by encrypting plaintext data at least once, wherein the at least one encryption uses at least one of the following encryption algorithms: The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters. The second encryption algorithm is used to divide the data to be encrypted by the power of d by N', and the remainder is used as the encrypted ciphertext data. d and N' are the private key parameters. The third encryption algorithm is used to divide the product of the data to be encrypted and the modulo reciprocal of r by N, and the remainder is used as the encrypted ciphertext data. r is a random number and N is a public key parameter.

14. A data intersection device, comprising: Performed by the first data provider among multiple data providers, including: The read module is used to read at least one piece of plaintext data to be processed. An encryption module is used to encrypt the at least one piece of plaintext data to obtain ciphertext data corresponding to each piece of plaintext data, and to store the correspondence between the plaintext data and the ciphertext data; A sending module is configured to send at least one piece of the ciphertext data to a data processor, so that the data processor can perform data intersection to obtain the intersection ciphertext data by performing the data intersection method as described in any one of claims 1 to 4. The processing module is used to obtain the intersection plaintext data corresponding to the intersection ciphertext data based on the intersection ciphertext data and the correspondence relationship.

15. The apparatus of claim 14, wherein, The processing module is specifically used for: Based on the intersection ciphertext data and the set character, a second key-value pair is generated, wherein the attribute key of the second key-value pair is the intersection ciphertext data, and the attribute value of the second key-value pair is the set character; According to the correspondence, a third key-value pair is generated, where the attribute key in the third key-value pair is the ciphertext data, and the attribute value in the third key-value pair is plaintext data having the correspondence; For the second key-value pair and the third key-value pair having the same attribute key, intersection plaintext data corresponding to intersection ciphertext data as the attribute key in the second key-value pair is determined according to the plaintext data as the attribute value in the third key-value pair.

16. The apparatus of claim 15, wherein, The processing module is specifically further configured to: push the second key-value pair and the third key-value pair to a storage node in a distributed cluster, so that the second key-value pair and the third key-value pair having the same attribute key are pushed to the same storage node; for the second key-value pair and the third key-value pair pushed to the same storage node, determine intersection plaintext data corresponding to intersection ciphertext data as the attribute key in the target second key-value pair according to the plaintext data as the attribute value in the target third key-value pair.

17. The apparatus of any of claims 14-16, wherein, Each piece of the ciphertext data is obtained by encrypting the plaintext data at least once, and the at least once encryption adopts at least one encryption algorithm in the following: The first encryption algorithm is used to combine the data to be encrypted with r. e The product of the two is divided by N, and the remainder is used as the encrypted ciphertext data. r is a random number, and e and N are the public key parameters. a second encryption algorithm, which is used to divide the d-th power of the data to be encrypted by N', and the remainder is taken as the encrypted ciphertext data, where d and N' are set private key parameters; a third encryption algorithm, which is used to divide the product between the data to be encrypted and the modular inverse of r by N, and the remainder is taken as the encrypted ciphertext data, where r is a random number, and N is a set public key parameter.

18. The apparatus of claim 17, wherein, The first encryption algorithm, the second encryption algorithm, and the third encryption algorithm are used together to encrypt the plurality of plaintext data to obtain the ciphertext data corresponding to each piece of the plaintext data, including: for any one piece of plaintext data, the first encryption algorithm is used for encryption to obtain a first intermediate ciphertext; the first intermediate ciphertext is sent to a second data provider in the plurality of data providers, so that the second data provider encrypts the first intermediate ciphertext using the second encryption algorithm to obtain a second intermediate ciphertext; the third encryption algorithm is used to encrypt the second intermediate ciphertext to obtain the ciphertext data.

19. An electronic device, comprising: including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the data intersection method of any one of claims 1 to 4, or implement the data intersection method of any one of claims 5 to 9.

20. A computer-readable storage medium, when instructions in the computer-readable storage medium are executed by a processor of an electronic device, enable the electronic device to perform the data intersection method of any one of claims 1 to 4, or perform the data intersection method of any one of claims 5 to 9.

21. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the data intersection method of any one of claims 1 to 4, or implement the data intersection method of any one of claims 5 to 9.

Images