Data Processing Method, Apparatus, Device, and Storage Medium

Abstract

The present disclosure provides a data processing method, apparatus, device, and storage medium, which can be applied to the fields of big data technology and encryption technology. The data processing method applied to the data demand side includes: processing preset screening threshold information through additive secret sharing to generate a first threshold secret shard and a second threshold secret shard; generating a first feature data set according to the first threshold secret shard and a first feature secret shard; generating a binary expansion set of the first feature data set; and obtaining a first screening mask data set from the data provider according to the binary expansion set by executing an oblivious transfer protocol; receiving a second encrypted data set and a third encrypted data set from the data provider; and obtaining a target data set by using a private intersection algorithm according to the first screening mask data set, the second encrypted data set, and the third encrypted data set.

Description

Technical Field

[0001] The present disclosure relates to the fields of big data technology and encryption technology, and particularly relates to a data processing method, apparatus, device, medium, and program product. Background Art

[0002] Data sharing, interaction, and collaboration help to better realize the value of data and empower relevant scenarios and institutions. With the continuous improvement of requirements for data security and privacy protection, potential security risks such as data leakage must be avoided during the process of data sharing and collaboration among institutions.

[0003] However, in the traditional data sharing process, the data requester needs to send the data screening strategy to the data provider, and the data screening strategy generally involves core parameters that affect the risk decision-making of the institution. Therefore, there are data security risk problems in this traditional data sharing process. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a data processing method, apparatus, device, medium, and program product.

[0005] According to a first aspect of the present disclosure, there is provided a data processing method applied to a data requester side, including:

[0006] Processing preset screening threshold information through an additive secret sharing method to generate a first threshold secret shard and a second threshold secret shard;

[0007] Generating a first feature data set according to the first threshold secret shard and a first feature secret shard;

[0008] Generating a binary expansion set of the first feature data set according to the first feature data set; and obtaining a first screening mask data set from the data provider side according to the binary expansion set by executing an oblivious transfer protocol;

[0009] Receiving a second encrypted data set and a third encrypted data set from the data provider side, where the second encrypted data set is obtained by processing a first encrypted data set with a shared key, and the first encrypted data set is obtained by the data requester side processing a first data set to be matched with the shared key and a first private key;

[0010] Obtaining a target data set by using a private intersection algorithm according to the first screening mask data set, the second encrypted data set, and the third encrypted data set.

[0011] According to an embodiment of the present disclosure, in the above data processing method, the first feature secret shard is obtained by the data provider processing the second dataset to be matched through additive secret sharing. The third encrypted dataset is obtained by processing the second dataset to be matched using a shared key, a second private key, and a second screening mask dataset; the second screening mask dataset is determined according to the binary expansion set of the second feature dataset; the second feature dataset is obtained according to the second threshold secret shard and the second feature secret shard.

[0012] According to an embodiment of the present disclosure, generating a binary expansion set of the first feature dataset according to the first feature dataset includes:

[0013] Inputting the first feature dataset into a hash function to obtain a first hash value set;

[0014] Performing bit expansion on the first hash value set to generate a binary expansion set of the first feature dataset.

[0015] According to an embodiment of the present disclosure, the binary expansion set includes n elements. By executing the oblivious transfer protocol, obtaining a first screening mask dataset from the data provider according to the binary expansion set includes:

[0016] Receiving a random array from the data provider, where the random array includes m groups of random numbers, where m represents a security parameter, and both m and n are positive integers, and each group of random numbers includes at least two unequal random numbers;

[0017] For the i-th element, according to a preset rule, determining screening mask data from the j-th group of random numbers according to the binary value of the i-th element;

[0018] By executing the oblivious transfer protocol m×n times, a first screening mask dataset is obtained.

[0019] According to an embodiment of the present disclosure, processing the first dataset to be matched using a shared key and a first private key to obtain a first encrypted dataset includes:

[0020] Inputting the shared key and the first dataset to be matched into a preset random point generation function to obtain a first privacy dataset;

[0021] For each privacy data in the first privacy dataset, performing a multiple point operation on the privacy data using the first private key to obtain a first encrypted dataset.

[0022] According to an embodiment of the present disclosure, according to the first screening mask dataset, the second encrypted dataset, and the third encrypted dataset, using a private intersection algorithm to obtain a target dataset includes:

[0023] Perform a double point operation on the third encrypted dataset using the first private key and the first screening mask dataset to obtain a third encrypted dataset embedded with the first screening mask;

[0024] Generate a target dataset according to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask by using a private intersection protocol.

[0025] According to an embodiment of the present disclosure, generating a target dataset according to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask by using a private intersection protocol includes:

[0026] Obtain a target intersection according to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask by using a private intersection protocol;

[0027] Determine the target dataset from the first dataset to be matched according to the correspondence between each element in the target intersection and the second encrypted dataset.

[0028] According to a second aspect of the present disclosure, a data processing method is provided, which is applied to a data provider and includes:

[0029] Process the second dataset to be matched by additive secret sharing to obtain a first feature secret shard and a second feature secret shard; and generate a second feature dataset according to the second threshold secret shard and the second feature secret shard;

[0030] Generate a binary expansion set of the second feature dataset according to the second feature dataset; and determine a second screening mask dataset according to the binary expansion set of the second feature dataset by performing an oblivious transfer protocol;

[0031] Process the first encrypted dataset by using the second private key to obtain a second encrypted dataset;

[0032] Process the second dataset to be matched by using the shared key, the second private key, and the second screening mask set to obtain a third encrypted dataset, and send the second encrypted dataset and the third encrypted dataset to the data requester.

[0033] According to an embodiment of the present disclosure, the second threshold secret shard is obtained by the data requester through additive secret sharing according to preset threshold information;

[0034] The first encrypted dataset is obtained by the data requester processing the first dataset to be matched by using the shared key and the first private key.

[0035] According to an embodiment of the present disclosure, generating a binary expansion set of the second feature dataset includes:

[0036] Input the second feature data set into a hash function to obtain a second set of hash values;

[0037] Perform bit expansion on the second set of hash values to generate a binary expansion set of the second feature data set.

[0038] According to an embodiment of the present disclosure, the binary expansion set of the second feature data set includes n elements. By executing the oblivious transfer protocol, a second screening mask data set is determined according to the binary expansion set of the second feature data set, including:

[0039] Randomly generate a random array, where the random array includes m groups of random numbers, where m represents a security parameter, and both m and n are positive integers. Each group of random numbers includes at least two unequal random numbers;

[0040] For the i-th element, according to a preset rule, determine the screening mask data from the j-th group of random numbers according to the binary value of the i-th element;

[0041] By executing the oblivious transfer protocol m×n times, obtain the second screening mask data set.

[0042] According to an embodiment of the present disclosure, a second feature data set is generated according to the second threshold secret shard and the second feature secret shard, including:

[0043] Generate a third threshold secret shard according to the second threshold secret shard and the system support encoding parameters, where the system support encoding parameters include parameter values and parameter formats;

[0044] Generate a second feature data set according to the second feature secret shard and the third threshold secret shard.

[0045] A third aspect of the present disclosure provides a data processing device, which is applied to a data demand side and includes a first generation module, a second generation module, a first transmission module, a receiving module, and an intersection module. Among them, the first generation module is used to process the preset screening threshold information through additive secret sharing to generate a first threshold secret shard and a second threshold secret shard. The second generation module is used to generate a first feature data set according to the first threshold secret shard and the first feature secret shard. The first transmission module is used to generate a binary expansion set of the first feature data set according to the first feature data set; and obtain a first screening mask data set from the data provider according to the binary expansion set by executing the oblivious transfer protocol. The receiving module is used to receive a second encrypted data set and a third encrypted data set from the data provider. The intersection module is used to obtain a target data set by using a private intersection algorithm according to the first screening mask data set, the second encrypted data set, and the third encrypted data set.

[0046] The fourth aspect of the present disclosure provides a data processing apparatus, which is applied to a data providing end and includes a first processing module, a second transmission module, a second processing module, and a sending module. Among them, the first processing module is configured to process a second dataset to be matched through additive secret sharing to obtain a first feature secret shard and a second feature secret shard; and generate a second feature dataset according to a second threshold secret shard and the second feature secret shard. The second transmission module is configured to generate a binary expansion set of the second feature dataset according to the second feature dataset; and determine a second screening mask dataset according to the binary expansion set of the second feature dataset by executing an oblivious transfer protocol. The second processing module is configured to process a first encrypted dataset by using a second private key to obtain a second encrypted dataset. The sending module is configured to process a second dataset to be matched by using a shared key and a second screening mask set to obtain a third encrypted dataset, and send the second encrypted dataset and the third encrypted dataset to a data demanding end.

[0047] The fifth aspect of the present disclosure provides an electronic device, including: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the above data processing method.

[0048] The sixth aspect of the present disclosure further provides a computer-readable storage medium, on which executable instructions are stored, and when the instructions are executed by a processor, the processor is caused to execute the above data processing method.

[0049] The seventh aspect of the present disclosure further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the above data processing method is implemented.

[0050] According to an embodiment of the present disclosure, by performing additive secret sharing between a dataset to be matched and preset threshold information, a first feature dataset is obtained, and a binary expansion set of the first feature dataset is generated, and oblivious transfer communication in a bit-by-bit mode is performed. Finally, according to a first screening mask dataset, a second encrypted dataset, and a third encrypted dataset, a target dataset is obtained by using a private set intersection algorithm, which can achieve both protecting the screening condition threshold from being leaked and protecting the security of data samples other than the target dataset, achieving the technical effect of private set intersection based on an inequality strategy, and at least partially overcoming the problem of data security risks existing in the traditional private data transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, the above content and other objects, features, and advantages of the present disclosure will become clearer. In the drawings:

[0052] Figure 1 Schematically shows an application scenario diagram of a data processing method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

[0053] Figure 2 Schematically shows a flowchart of a data processing method applied to a data demand side according to an embodiment of the present disclosure;

[0054] Figure 3 Schematically shows a flowchart of a method for generating a binary expansion set of a first feature data set according to an embodiment of the present disclosure;

[0055] Figure 4 Schematically shows a flowchart of a method for obtaining a first screening mask data set according to an embodiment of the present disclosure;

[0056] Figure 5 Schematically shows a flowchart of a method for generating a first encrypted data set according to an embodiment of the present disclosure;

[0057] Figure 6 Schematically shows a flowchart of a method for obtaining a target data set according to an embodiment of the present disclosure;

[0058] Figure 7 Schematically shows a flowchart of a data processing method applied to a data provider side according to an embodiment of the present disclosure;

[0059] Figure 8 Schematically shows a structural block diagram of a data processing apparatus applied to a data demand side according to an embodiment of the present disclosure;

[0060] Figure 9 Schematically shows a structural block diagram of a data processing apparatus applied to a data provider side according to an embodiment of the present disclosure; and

[0061] Figure 10 Schematically shows a block diagram of an electronic device suitable for implementing a data processing method according to an embodiment of the present disclosure. Detailed implementation manners

[0062] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary and are not intended to limit the scope of the present disclosure. In the following detailed description, for the sake of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, obviously, one or more embodiments may be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present disclosure.

[0063] The terms used herein are for describing specific embodiments only and are not intended to limit the present disclosure. The terms "including", "comprising", etc. used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0064] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0065] In the case of using expressions such as "at least one of A, B, and C", generally, it should be interpreted according to the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include, but is not limited to, a system having only A, only B, only C, having A and B, having A and C, having B and C, and / or having A, B, and C, etc.).

[0066] It should be noted that the data processing method and apparatus of the present disclosure can be used in the financial field and the data sharing technology field, and the application fields of the data processing method and apparatus of the present disclosure are not limited.

[0067] In the technical solution of the present disclosure, the processing of the data involved (such as including but not limited to user personal information) in collection, storage, use, processing, transmission, provision, disclosure, and application, etc., all comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good customs.

[0068] Taking the sample screening scenario between the data requester P A and the data provider P B as an example, when the data requester P A hopes to perform conditional privacy intersection on the samples in its own sample set and the other party's sample set that meet the constraint condition of "registration time ≠ 2021", then it can only send the additional screening condition of "≠ 2021" to the data provider P B , and this way will cause the leakage of the screening condition, which is not conducive to the privacy protection of the data requester.

[0069] In view of this, an embodiment of the present disclosure provides a data processing method, which is applied to the data demand side and includes: processing preset screening threshold information through the additive secret sharing method to generate a first threshold secret shard and a second threshold secret shard;

[0070] Generate a first feature dataset based on the first threshold secret shards and the first feature secret shards, where the first feature secret shards are obtained by the data provider processing the second dataset to be matched through additive secret sharing; generate a binary expansion set of the first feature dataset based on the first feature dataset; and obtain a first screening mask dataset from the data provider according to the binary expansion set by executing the oblivious transfer protocol; receive a second encrypted dataset and a third encrypted dataset from the data provider, where the second encrypted dataset is obtained by processing the first encrypted dataset using a shared key, and the first encrypted dataset is obtained by the data requester processing the first dataset to be matched using the shared key and the first private key; the third encrypted dataset is obtained by processing the second dataset to be matched using the shared key, the second private key, and the second screening mask dataset; the second screening mask dataset is determined according to the binary expansion set of the second feature dataset; the second feature dataset is obtained according to the second threshold secret shards and the second feature secret shards; obtain the target dataset using the private intersection algorithm based on the first screening mask dataset, the second encrypted dataset, and the third encrypted dataset. Effectively protect the privacy of the sample set and screening conditions of the data requester, so that the data provider cannot identify any valid information about the screening conditions.

[0071] Figure 1 Schematically shows an application scenario diagram of the data processing method according to an embodiment of the present disclosure.

[0072] As Figure 1 shown, the application scenario 100 according to this embodiment may include a data requester 101, a data provider 102, and a network 103. The network 103 is used to provide a medium for a communication link between the data requester 101 and the data provider 102. The network 103 may include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0073] The data requester 101 may send the second threshold secret shards and the first encrypted dataset to the data provider 102 by executing the data processing method applied to the data requester in the embodiments of the present disclosure.

[0074] The data provider 102 may send the first feature secret shards obtained through additive secret sharing to the data requester 101 by executing the data processing method applied to the data provider in the embodiments of the present disclosure.

[0075] The data requester 101 generates a binary expansion set of the first feature dataset; and obtains a first screening mask dataset from the data provider 102 according to the binary expansion set of the first feature dataset by executing the oblivious transfer protocol with the data provider 102.

[0076] The data provider 102 generates a binary expansion set of the second feature data set, and determines a second screening mask data set with the data requester 101 by executing the oblivious transfer protocol according to the binary expansion set of the second feature data set.

[0077] The data provider 102 processes the second data set to be matched by using the second screening mask data set, the shared key, and the second private key to obtain a third encrypted data set, and processes the first encrypted data set by using the shared key to obtain a second encrypted data set. Then, the second encrypted data set and the third encrypted data set are sent to the data requester.

[0078] The data requester 101 performs private set intersection according to the first screening mask data set, the second encrypted data set, and the third encrypted data set by using the private set intersection algorithm to obtain a target data set.

[0079] It should be understood that Figure 1 the numbers of the data requester and the data provider in are merely illustrative. According to actual needs, any number of data requesters and data providers can be used for data interaction. The data processing method provided by the embodiments of the present disclosure can be executed by a server or a client, and the present disclosure does not specifically limit the execution entity.

[0080] The following will be based on Figure 1 the described scenario, and will describe in detail the data processing method of the disclosed embodiments through Figures 2 to 6

[0081] Figure 2 Schematically shows a flowchart of the data processing method according to an embodiment of the present disclosure.

[0082] As Figure 2 shown, the data processing method of this embodiment includes operation S210 to operation S250.

[0083] In operation S210, the preset screening threshold information is processed by the additive secret sharing method to generate a first threshold secret shard and a second threshold secret shard.

[0084] According to an embodiment of the present disclosure, the preset screening threshold information can be determined according to a screening strategy. For example, if the screening strategy is registration time ≠ 2021, the preset screening threshold information can be determined to be 2021.

[0085] According to an embodiment of the present disclosure, for a preset screening threshold information a, a first threshold secret shard a1 and a second threshold secret shard a2 can be randomly generated through additive secret sharing. Wherein, the sum of the first threshold secret shard a1 and the second threshold secret shard a2 is equal to the preset screening threshold information a. For example: the preset screening threshold information is 2021, the first threshold secret shard can be 2020, and the second threshold secret shard can be 1; the first threshold secret shard can also be 2019, and the second threshold secret shard can be 2.

[0086] In operation S220, a first feature data set is generated according to the first threshold secret shard and the first feature secret shard.

[0087] According to an embodiment of the present disclosure, the first feature secret shard is obtained by the data provider processing the second data set to be matched through additive secret sharing. For example: the second data set to be matched can be x1,..., x can be randomly generated respectively through additive secret sharing n additive secret shards [x1],..., [x n , where [x k =(y k , z k ), satisfying x k =y k +z k , k = 1,..., n. That is, the first feature secret shard can be expressed as y1,..., y n , and the second feature secret shard can be expressed as z1,..., z n .

[0088] According to an embodiment of the present disclosure, a first feature data set can be generated according to the difference between the first feature secret shard and the first threshold secret shard. For example: the k-th element y' k in the first feature data set can be expressed as y' k =y k -a1, where k = 1,..., n.

[0089] In operation S230, a binary expansion set of the first feature data set is generated according to the first feature data set; and by executing the oblivious transfer protocol, a first screening mask data set is obtained from the data provider according to the binary expansion set.

[0090] According to an embodiment of the present disclosure, a binary expansion set of the first feature data set is generated according to the first feature data set. For example: for the k-th element h kA hash function can be used to calculate the hash value of the k-th element, and the hash value is bit-expanded to obtain the binary expansion of the k-th element in the first feature dataset, and then the binary expansion set of all elements in the first feature dataset is obtained.

[0091] According to an embodiment of the present disclosure, by executing the oblivious transfer protocol, a first screening mask dataset is obtained from the data provider according to the binary expansion set. For example, taking the execution of the k-th oblivious transfer as an example, the k-th group of random numbers can be obtained from the data provider, and the k-th group of random numbers can include and

[0092] According to an embodiment of the present disclosure, taking the i-th element in the binary expansion set of the k-th element in the first feature dataset as an example, the target random number can be determined from the k-th group of random numbers according to a preset rule as the first screening mask data. For example: if then Party A selects as the received target data; if then Party A selects as the received target data, so as to obtain the first screening mask dataset satisfies when when

[0093] In operation S240, a second encrypted dataset and a third encrypted dataset are received from the data provider, wherein the second encrypted dataset is obtained by processing the first encrypted dataset using the shared key, and the first encrypted dataset is obtained by the data requester using the shared key and the first private key to process the first dataset to be matched.

[0094] According to an embodiment of the present disclosure, before executing the data processing method of the embodiment of the present disclosure, the data provider and the data requester can determine the elliptic curve (G, q) and the random point generation function H p (·), and determine an elliptic curve generator g ∈ G. Both parties generate their own matching private keys sk A , sk B ∈ Zq, where sk A is the matching private key of the data requester P A , sk B is the matching private key of the data provider P B , and both parties calculate their own matching public keys And it is disclosed. For example: The shared key K for this task can be calculated and determined based on the Diffie-Hellman key negotiation algorithm. It should be noted that the shared key K can be used as the service identifier for executing this data processing task to identify the task. The first private key and the second private key of both parties are used to encrypt the data information of both parties to prevent privacy leakage.

[0095] In the embodiment of the present disclosure, the second encrypted data set and the third encrypted data set are data processing operations performed by the data provider, which are specifically described in detail in the data processing method of the data provider and will not be elaborated here.

[0096] In operation S250, according to the first screening mask data set, the second encrypted data set, and the third encrypted data set, the target data set is obtained by using the private intersection algorithm.

[0097] According to the embodiment of the present disclosure. The third encrypted data set embedded with the screening conditions can be obtained by using the first screening mask data set and the third encrypted data set, and then the intersection is performed with the second encrypted data set by using the private intersection algorithm to obtain the target data set.

[0098] According to the embodiment of the present disclosure, by performing additive secret sharing between the data set to be matched and the preset threshold information, the first feature data set is obtained, and the binary expansion set of the first feature data set is generated. The oblivious transfer communication is performed in a bit-by-bit mode. Finally, according to the first screening mask data set, the second encrypted data set, and the third encrypted data set, the target data set is obtained by using the private intersection algorithm, which can protect both the non-disclosure of the screening condition threshold and the security of the data samples outside the target data set, achieving the technical effect of private set intersection based on the not-equal strategy, and at least partially overcoming the problem of data security risks existing in the traditional private data transmission process.

[0099] Figure 3 Schematically shows a method for generating the binary expansion set of the first feature data set according to an embodiment of the present disclosure.

[0100] As Figure 3 shown, this embodiment includes operations S310 to S320.

[0101] In operation S310, the first feature data set is input into the hash function to obtain the first hash value set;

[0102] In operation S320, the first hash value set is bit-expanded to generate the binary expansion set of the first feature data set.

[0103] According to the embodiment of the present disclosure, taking the k-th element y' in the first feature data set k as an example. The k-th element y'k Input a hash function to obtain the first hash value h of the k-th element k = H(y′ k ). Expand the hash value bit by bit to obtain the binary expansion of the k-th element in the first feature dataset Furthermore, obtain the binary expansion set of all elements in the first feature dataset

[0104] According to an embodiment of the present disclosure, since the binary expansion set of the first feature dataset is obtained by the method of hash-by-bit expansion, it can be applied to the privacy set intersection scenario with a not-equal screening strategy, realizing a more accurate and effective sample matching and data sharing mode without leaking the screening strategy

[0105] Figure 4 Schematically shows a flowchart of a method for obtaining a first screening mask dataset according to an embodiment of the present disclosure

[0106] As Figure 4 shown, the method for obtaining the first screening mask data in this embodiment includes operations S410 to S430

[0107] In operation S410, receive a random array from the data provider. Among them, the random array includes τ groups of random numbers, where τ represents a security parameter, and both τ and n are positive integers. Each group of random numbers includes at least two unequal random numbers

[0108] In operation S420, for the i-th element, according to a preset rule, determine the screening mask data from the j-th group of random numbers according to the binary value of the i-th element

[0109] In operation S430, obtain the first screening mask dataset by executing the oblivious transfer protocol τ × n times

[0110] According to an embodiment of the present disclosure, for example: the two parties negotiate the security parameter τ in advance (for example, τ is equal to 16, 32, 40, etc.), and τ groups of random numbers And it is required that For i = 1,..., τ, the two parties execute the oblivious transfer scheme. In the oblivious transfer protocol, Party B is the data sender and Party A is the data receiver. If then Party A selects as the received target data; if then Party A selects as the received target data. For k = 1,..., n and i = 1,..., τ, the two parties execute the oblivious transfer protocol n·τ times in total, and Party A obtains its own received data set as Satisfy When When

[0111] According to an embodiment of the present disclosure, by executing the oblivious transfer protocol, the data requester receives a random array from the data provider, and determines the first screening mask set according to the random array, thereby effectively protecting the data privacy and security of both parties.

[0112] Figure 5 Schematically shows a flowchart of a method for generating a first encrypted data set according to an embodiment of the present disclosure.

[0113] As Figure 5 shown, this embodiment includes operations S510 to S520.

[0114] In operation S510, the shared key and the first data set to be matched are input into a preset random point generation function to obtain a first private data set;

[0115] In operation S520, for each private data in the first private data set, the private data is subjected to a double point operation using the first private key to obtain a first encrypted data set.

[0116] According to an embodiment of the present disclosure, the first data set to be matched can be expressed as A = {ID1, ID2,..., ID m}. Among them, ID can be used to represent identity information, enterprise credit identification, number identification, etc. with unique directivity.

[0117] According to an embodiment of the present disclosure, the first data set to be matched is input into a preset random point generation function H p (·) to obtain a first private data set, and a double point operation is performed on the first private data set using the first private key sk A to obtain a first encrypted data set

[0118] According to the elliptic curve and preset random point generation function determined through negotiation between the two parties, the data privacy and security of the data provider can be effectively protected.

[0119] Figure 6 Schematically shows a flowchart of a method for obtaining a target data set according to an embodiment of the present disclosure.

[0120] As Figure 6 shown, this embodiment includes operations S610 to S620.

[0121] In operation S610, a double point operation is performed on the third encrypted data set using the first private key and the first screening mask data set to obtain a third encrypted data set embedded with the first screening mask.

[0122] According to an embodiment of the present disclosure, the third encrypted data set T1 can be expressed as:

[0123] Each element in the set is in the form of

[0124] According to an embodiment of the present disclosure, a double - point operation is performed on the third encrypted dataset by using the first private key and the first screening mask dataset, and the third encrypted dataset T2 embedded with the first screening mask is obtained, which can be expressed as:

[0125]

[0126] In operation S620, according to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask, a target dataset is generated by using the private set intersection protocol.

[0127] According to an embodiment of the present disclosure, generating a target dataset according to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask by using the private set intersection protocol includes:

[0128] According to the second encrypted dataset and the third encrypted dataset embedded with the first screening mask, a target intersection is obtained by using the private set intersection protocol;

[0129] According to the correspondence between each element in the target intersection and the second encrypted dataset, the target dataset is determined from the first dataset to be matched.

[0130] According to an embodiment of the present disclosure, the second encrypted dataset can be expressed as: Wherein,

[0131] According to an embodiment of the present disclosure, the intersection I = S2 ∩ T2 = {I1,..., I l} of the second encrypted dataset S2 and the third encrypted dataset T2 embedded with the first screening mask can be obtained by using the private set intersection algorithm. The original set intersection can be restored according to the correspondence between each element in the intersection I and the second encrypted dataset S2 Thereby, the target dataset is obtained.

[0132] According to an embodiment of the present disclosure, since the first screening mask capable of representing the screening strategy has been embedded in the third encrypted dataset, compared with the traditional private set intersection algorithm, it can support the data intersection requirement with the feature screening strategy, and can perform data screening more accurately and effectively while ensuring the forward security of the screening conditions and sample data.

[0133] Figure 7 The flowchart of the data processing method applied to the data provider according to an embodiment of the present disclosure is schematically shown.

[0134] AsFigure 7 As shown, this embodiment includes operations S710 to S740.

[0135] In operation S710, the second dataset to be matched is processed through additive secret sharing to obtain a first feature secret shard and a second feature secret shard; and a second feature dataset is generated according to the second threshold secret shard and the second feature secret shard.

[0136] According to an embodiment of the present disclosure, the second dataset to be matched respectively randomly generates x1,..., x n additive secret shards [x1],..., [x n , where [x k = (y k , z k ), satisfying x k = y k + z k , k = 1,..., n. That is, the first feature secret shard can be represented as y1,..., y n , and the second feature secret shard can be represented as z1,..., z n .

[0137] According to an embodiment of the present disclosure, a second feature dataset can be generated according to the difference between the second feature secret shard and the second threshold secret shard. For example: the k-th element z′ k in the first feature dataset can be represented as z′ k = z k - a2, where k = 1,..., n.

[0138] In operation S720, a binary expansion set of the second feature dataset is generated according to the second feature dataset; and by executing the oblivious transfer protocol, a second screening mask dataset is determined according to the binary expansion set of the second feature dataset.

[0139] According to an embodiment of the present disclosure, a binary expansion set of the second feature dataset is generated according to the second feature dataset. For example: for the k-th element in the second feature dataset, the hash value of the k-th element can be calculated using a hash function , and the hash value is bit-expanded to obtain the binary expansion of the k-th element in the second feature dataset, and then the binary expansion set of all elements in the second feature dataset is obtained

[0140] According to an embodiment of the present disclosure, by executing an oblivious transfer protocol, a second screening mask data set is determined according to a binary expansion set of a second feature data set. For example, taking the execution of the k-th oblivious transfer as an example, according to the k-th set of random numbers randomly generated by the data provider, the k-th set of random numbers may include and

[0141] According to an embodiment of the present disclosure, for example, the second screening mask data set , satisfies the condition when when

[0142] In operation S730, the first encrypted data set is processed using the second private key to obtain a second encrypted data set.

[0143] According to an embodiment of the present disclosure, the first encrypted data set may be represented as The second encrypted data set obtained by processing the first encrypted data set using the second private key sk B is

[0144] In operation S740, the second data set to be matched is processed using the shared key, the second private key, and the second screening mask set to obtain a third encrypted data set, and the second encrypted data set and the third encrypted data set are sent to the data requester.

[0145] According to an embodiment of the present disclosure, for example, the second data set to be matched may be represented as: The third encrypted data set obtained by processing the second data set to be matched using the shared key, the second private key, and the second screening mask set may be represented as:

[0146]

[0147] According to an embodiment of the present disclosure, by performing additive secret sharing on preset threshold information, a second feature data set is obtained, and a binary expansion set of the second feature data set is generated, and oblivious transfer communication in a bit-by-bit mode is performed, it is possible to protect both the screening condition threshold from being leaked and the security of data samples outside the target data set, achieving the technical effect of private set intersection based on the not-equal strategy, and at least partially overcoming the problem of data security risks existing in the traditional private data transmission process.

[0148] According to an embodiment of the present disclosure, generating a binary expansion set of the second feature data set according to the second feature data set includes:

[0149] Inputting the second feature data set into a hash function to obtain a second set of hash values;

[0150] Perform bit expansion on the second hash value set to generate a binary expansion set of the second feature data set.

[0151] According to an embodiment of the present disclosure, for the k-th element in the second feature data set A hash function can be used Calculate the hash value of the k-th element, perform bit expansion on the hash value to obtain the binary expansion of the k-th element in the second feature data set, and further obtain a binary expansion set of all elements in the second feature data set

[0152] According to an embodiment of the present disclosure, since the binary expansion set of the second feature data set is obtained by means of hash-by-bit expansion, it can be applied to the private set intersection scenario with an inequality filtering strategy, realizing a more accurate and effective sample matching and data sharing mode without leaking the filtering strategy.

[0153] According to an embodiment of the present disclosure, the binary expansion set of the second feature data set includes n elements. By executing the oblivious transfer protocol, a second screening mask data set is determined according to the binary expansion set of the second feature data set, including:

[0154] Randomly generate a random array, where the random array includes τ groups of random numbers, where τ represents a security parameter, and both τ and n are positive integers, and each group of random numbers includes at least two unequal random numbers;

[0155] For the i-th element, according to a preset rule, determine the screening mask data from the j-th group of random numbers according to the binary value of the i-th element;

[0156] By executing the oblivious transfer protocol τ×n times, a second screening mask data set is obtained.

[0157] According to an embodiment of the present disclosure, the random array can be: The preset rule can be When When By executing the oblivious transfer protocol τ×n times, a second screening mask data set is obtained

[0158] According to an embodiment of the present disclosure, in order to improve performance, extended oblivious transfer technology can be used to accelerate the performance of the above-mentioned oblivious transfer protocol.

[0159] According to an embodiment of the present disclosure, through executing the oblivious transfer protocol, what the data requester receives from the data provider is a random array, and a first screening mask set is determined according to the random array, thus effectively ensuring the data privacy and security of both parties.

[0160] To further elaborate on the technical effects of this solution in detail, the following will elaborate in detail from three aspects: the correctness, security, and accuracy of the solution.

[0161] According to the embodiments of the present disclosure, since the screening condition is x k ≠a, because the two parties perform additive secret sharing on [x k -a] = (y′ k , z′ k ), k = 1,..., n as the multiplicative shards of x k -a, satisfying x k -a = y′ k +z′ k , then the two parties respectively perform hash calculation and expansion on y′ k and -z′ k through the hash algorithm. It can be known that if x k =a, then y′ k =-z′ k . At this time When x k ≠a, According to the calculation rules calculated and obtained by both parties and , when , and are different in each bit. And when , there exists i ∈ {1,..., τ} satisfying

[0162]

[0163]

[0164] Therefore, there exists i ∈ {1,..., τ} satisfying At this time It can be known that when , So, through the intersection of S2 and T2, it can be concluded whether the two parties have an intersection and satisfy the condition of not being equal to the screening condition.

[0165] When x k =a, and are different in each bit. At this time Therefore, even if cannot be output as the intersection in the intersection-finding link.

[0166] Therefore, the correctness of the solution holds.

[0167] According to an embodiment of the present disclosure, for the data provider, all the processed data are random values, and no valid information about the intersection, the screening strategy judgment result, the number of intersection elements, etc. can be obtained. For the data requester, through the running scheme, an intersection result that meets the screening judgment condition of not equal can be obtained, and no other sample information and feature information of the data provider can be obtained, nor can it be judged whether the samples not in the final intersection are due to not being in the intersection or not meeting the screening conditions.

[0168] According to an embodiment of the present disclosure, since this scheme selects the security parameter τ, for the bit expansion of the hash value only the first τ bits are subject to oblivious transfer. The situation where an error occurs is: is equal, but is not equal. At this time, x k ≠a will be recognized as x k =a.

[0169] By adjusting the value of τ, the error rate can be controlled within an acceptable range for the scenario. Usually, τ = 40 can ensure that the error rate is lower than 2 -40 .

[0170] Based on the above data processing method, the present disclosure also provides a data processing device applied to the data requester side. The following will be combined with Figure 8 to describe this device in detail.

[0171] Figure 8 Schematically shows a structural block diagram of a data processing device applied to the data requester side according to an embodiment of the present disclosure.

[0172] As Figure 8 shown, the data processing device 800 applied to the data requester side in this embodiment includes a first generation module 810, a second generation module 820, a first transmission module 830, a receiving module 840, and an intersection finding module 850.

[0173] The first generation module 810 is used to process the preset screening threshold information by means of additive secret sharing to generate a first threshold secret shard and a second threshold secret shard. In one embodiment, the first generation module 810 can be used to execute the operation S210 described above, which will not be elaborated here.

[0174] The second generation module 820 is used to generate a first feature data set according to the first threshold secret shard and the first feature secret shard. In one embodiment, the second generation module 820 can be used to execute the operation S220 described above, which will not be elaborated here.

[0175] The first transmission module 830 is configured to generate a binary expansion set of the first feature data set according to the first feature data set; and obtain a first screening mask data set from the data provider according to the binary expansion set by performing an oblivious transfer protocol. In one embodiment, the first transmission module 830 may be configured to perform the operation S230 described above, which will not be elaborated herein.

[0176] The receiving module 840 is configured to receive a second encrypted data set and a third encrypted data set from the data provider, wherein the second encrypted data set is obtained by processing the first encrypted data set with a shared key, and the first encrypted data set is obtained by processing the first data set to be matched with the shared key and the first private key by the data requirer. In one embodiment, the receiving module 840 may be configured to perform the operation S240 described above, which will not be elaborated herein.

[0177] The intersection module 850 is configured to obtain a target data set according to the first screening mask data set, the second encrypted data set, and the third encrypted data set by using a private intersection algorithm. In one embodiment, the intersection module 850 may be configured to perform the operation S250 described above, which will not be elaborated herein.

[0178] According to an embodiment of the present disclosure, any multiple of the first generation module 810, the second generation module 820, the first transmission module 830, the receiving module 840, and the intersection module 850 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first generation module 810, the second generation module 820, the first transmission module 830, the receiving module 840, and the intersection module 850 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on a substrate, a system in a package, an application specific integrated circuit (ASIC), or any other reasonable way of integrating or packaging circuits, etc., implemented by hardware or firmware, or implemented in any one of the three implementation manners of software, hardware, and firmware, or in any suitable combination of several of them. Alternatively, at least one of the first generation module 810, the second generation module 820, the first transmission module 830, the receiving module 840, and the intersection module 850 may be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding functions may be executed.

[0179] Figure 9 A structural block diagram of a data processing device applied to a data provider according to an embodiment of the present disclosure is schematically shown.

[0180] As shown Figure 9 in the figure, the data processing device 1000 applied to the data provider end in this embodiment includes a first processing module 910, a second transmission module 920, a second processing module 930, and a sending module 940.

[0181] The first processing module 910 is used to process the second dataset to be matched through the additive secret sharing method to obtain a first feature secret shard and a second feature secret shard; and generate a second feature dataset according to the second threshold secret shard and the second feature secret shard. In one embodiment, the first processing module 910 can be used to perform the operation S710 described above.

[0182] The second transmission module 920 is used to generate a binary expansion set of the second feature dataset according to the second feature dataset; and determine a second screening mask dataset according to the binary expansion set of the second feature dataset by executing the oblivious transfer protocol. In one embodiment, the second transmission module 920 can be used to perform the operation S720 described above.

[0183] The second processing module 930 is used to process the first encrypted dataset with the second private key to obtain a second encrypted dataset. In one embodiment, the second processing module 930 can be used to perform the operation S730 described above.

[0184] The sending module 940 is used to process the second dataset to be matched with the shared key and the second screening mask set to obtain a third encrypted dataset, and send the second encrypted dataset and the third encrypted dataset to the data requester end. In one embodiment, the sending module 940 can be used to perform the operation S740 described above.

[0185] According to an embodiment of the present disclosure, any multiple of the first processing module 910, the second transmission module 920, the second processing module 930, and the sending module 940 may be combined and implemented in one module, or any one of them may be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules may be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first processing module 910, the second transmission module 920, the second processing module 930, and the sending module 940 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on substrate, a system on package, an application specific integrated circuit (ASIC), or may be implemented by any other reasonable means such as hardware or firmware through circuit integration or packaging, or may be implemented in any one of the three implementation manners of software, hardware, and firmware, or in an appropriate combination of any several of them. Alternatively, at least one of the first processing module 910, the second transmission module 920, the second processing module 930, and the sending module 940 may be at least partially implemented as a computer program module, and when the computer program module runs, it can execute corresponding functions.

[0186] Figure 10 A block diagram of an electronic device suitable for implementing a data processing method according to an embodiment of the present disclosure is schematically shown.

[0187] As Figure 10 shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROT) 1002 or a program loaded from a storage part 1008 into a random access memory (RAT) 1003. The processor 1001 may include, for example, a general microprocessor (such as a CPU), an instruction set processor, and / or a related chipset, and / or a dedicated microprocessor (such as an application specific integrated circuit (ASIC)), etc. The processor 1001 may also include on-board memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0188] In the RAT 1003, various programs and data required for the operation of the electronic device 1000 are stored. The processor 1001, the ROT 1002, and the RAT 1003 are connected to each other via the bus 1004. The processor 1001 performs various operations of the method flow according to the embodiments of the present disclosure by executing the programs in the ROT 1002 and / or the RAT 1003. It should be noted that the programs may also be stored in one or more memories other than the ROT 1002 and the RAT 1003. The processor 1001 may also perform various operations of the method flow according to the embodiments of the present disclosure by executing the programs stored in the one or more memories.

[0189] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, and the input / output (I / O) interface 1005 is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the I / O interface 1005: an input part 1006 including a keyboard, a mouse, etc.; an output part 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc. and a speaker, etc.; a storage part 1008 including a hard disk, etc.; and a communication part 1009 including a network interface card such as a LAN card, a modem, etc. The communication part 1009 performs communication processing via a network such as the Internet. The drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed so that a computer program read from it can be installed into the storage part 1008 as needed.

[0190] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist separately without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of the present disclosure is implemented.

[0191] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example, but not limited to: portable computer disks, hard disks, random access memories (RATs), read-only memories (ROTs), erasable programmable read-only memories (EPROTs or flash memories), portable compact disk read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the above-described ROT 1002 and / or RAT 1003 and / or one or more memories other than ROT 1002 and RAT 1003.

[0192] An embodiment of the present disclosure also includes a computer program product, which includes a computer program that contains program code for executing the method shown in the flowchart. When the computer program product runs in a computer system, the program code is used to enable the computer system to implement the item recommendation method provided by the embodiment of the present disclosure.

[0193] When the computer program is executed by the processor 1001, it executes the above functions defined in the system / apparatus of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0194] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices and magnetic storage devices. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and be downloaded and installed through the communication part 1009, and / or be installed from the removable medium 1011. The program code included in the computer program can be transmitted by any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0195] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or be installed from the removable medium 1011. When the computer program is executed by the processor 1001, it executes the above functions defined in the system of the embodiment of the present disclosure. According to an embodiment of the present disclosure, the above-described systems, devices, apparatuses, modules, units, etc. can be implemented by computer program modules.

[0196] According to embodiments of the present disclosure, program code for executing the computer programs provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. The programming languages include, but are not limited to, programming languages such as Java, C++, Python, the "C" language, or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., by using an Internet service provider to connect through the Internet).

[0197] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram can represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks can occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown can actually be executed substantially in parallel, and they can sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and combinations of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0198] Those skilled in the art can understand that the features recited in the various embodiments and / or claims of the present disclosure can be combined or / and combined in various ways, even if such combinations or combinations are not explicitly recited in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features recited in the various embodiments and / or claims of the present disclosure can be combined and / or combined in various ways. All such combinations and / or combinations fall within the scope of the present disclosure.

[0199] The embodiments of the present disclosure have been described above. However, these embodiments are merely for illustrative purposes and not for limiting the scope of the present disclosure. Although the embodiments have been described separately above, this does not mean that the measures in each embodiment cannot be used advantageously in combination. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art can make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A data processing method, applied to the data demand side, includes: Processing preset screening threshold information through additive secret sharing to generate a first threshold secret shard and a second threshold secret shard; Generating a first feature dataset according to the first threshold secret shard and a first feature secret shard, where the first feature secret shard is obtained by the data provider processing a second dataset to be matched through additive secret sharing; Generating a binary expansion set of the first feature dataset according to the first feature dataset; and obtaining a first screening mask dataset from the data provider according to the binary expansion set by executing the oblivious transfer protocol; Receiving a second encrypted dataset and a third encrypted dataset from the data provider, where the second encrypted dataset is obtained by processing a first encrypted dataset using a shared key, and the first encrypted dataset is obtained by the data demand side processing a first dataset to be matched using the shared key and a first private key; Obtaining a target dataset using a private set intersection algorithm according to the first screening mask dataset, the second encrypted dataset, and the third encrypted dataset; Where the first feature secret shard is obtained by the data provider processing a second dataset to be matched through additive secret sharing; The third encrypted dataset is obtained by processing the second dataset to be matched using the shared key, a second private key, and a second screening mask dataset; the second screening mask dataset is determined according to a binary expansion set of a second feature dataset; the second feature dataset is obtained according to the second threshold secret shard and a second feature secret shard; The binary expansion set includes n elements, and the obtaining a first screening mask dataset from the data provider according to the binary expansion set by executing the oblivious transfer protocol includes: Receive a random array from the data providing end, where the random array includes groups of random numbers, where represents a security parameter, , and n are both positive integers, and each group of the random numbers includes at least two unequal random numbers; For the i-th element, determining screening mask data from the j-th group of random numbers according to the binary value of the i-th element according to a preset rule; By executing ×n oblivious transfer protocols, the first screened mask data set is obtained.

2. The method according to claim 1, wherein, The generating a binary expansion set of the first feature dataset according to the first feature dataset includes: Inputting the first feature dataset into a hash function to obtain a first hash value set; Performing bit expansion on the first hash value set to generate a binary expansion set of the first feature dataset.

3. The method according to any one of claims 1 to 2, wherein The processing the first dataset to be matched using the shared key and a first private key to obtain a first encrypted dataset includes: Inputting the shared key and the first dataset to be matched into a preset random point generation function to obtain a first private dataset; Performing a point multiplication operation on each private data in the first private dataset using the first private key to obtain a first encrypted dataset.

4. The method according to claim 1, wherein, The obtaining a target dataset using a private set intersection algorithm according to the first screening mask dataset, the second encrypted dataset, and the third encrypted dataset includes: Performing a point multiplication operation on the third encrypted dataset using the first private key and the first screening mask dataset to obtain a third encrypted dataset embedded with the first screening mask; Generate a target data set by using a private set intersection protocol based on the second encrypted data set and the third encrypted data set embedded with the first screening mask.

5. The method according to claim 4, wherein, The step of generating a target data set by using a private set intersection protocol based on the second encrypted data set and the third encrypted data set embedded with the first screening mask includes: Obtain a target intersection by using a private set intersection protocol based on the second encrypted data set and the third encrypted data set embedded with the first screening mask; Determine the target data set from the first data set to be matched according to the correspondence between each element in the target intersection and the second encrypted data set.

6. A data processing method applied to a data provider, including: Process the second data set to be matched by additive secret sharing to obtain a first feature secret shard and a second feature secret shard; Generate a second feature data set according to the second threshold secret shard and the second feature secret shard; Generate a binary expansion set of the second feature data set according to the second feature data set; Determine a second screening mask data set according to the binary expansion set of the second feature data set by executing an oblivious transfer protocol; Process the first encrypted data set by using a second private key to obtain a second encrypted data set; Process the second data set to be matched by using a shared key, the second private key, and the second screening mask set to obtain a third encrypted data set, and send the second encrypted data set and the third encrypted data set to a data requester; Wherein, the second threshold secret shard is obtained by the data requester through additive secret sharing according to preset threshold information; The first encrypted data set is obtained by the data requester by processing a first data set to be matched by using a shared key and a first private key; The binary expansion set of the second feature data set includes n elements. The step of determining a second screening mask data set according to the binary expansion set of the second feature data set by executing an oblivious transfer protocol includes: Randomly generate a random array, where the random array includes groups of random numbers, where represents a security parameter, , and n are both positive integers, and each group of the random numbers includes at least two unequal random numbers; For the i-th element, determine screening mask data from the j-th group of random numbers according to the binary value of the i-th element according to a preset rule; By executing ×n oblivious transfer protocols, the second screened mask data set is obtained.

7. The method according to claim 6, wherein The step of generating a binary expansion set of the second feature data set according to the second feature data set includes: Input the second feature data set into a hash function to obtain a second hash value set; Perform bit expansion on the second hash value set to generate a binary expansion set of the second feature data set.

8. A data processing apparatus applied to a data requester, including: A first generation module, configured to process preset screening threshold information by additive secret sharing to generate a first threshold secret shard and a second threshold secret shard; A second generation module, configured to generate a first feature data set according to the first threshold secret shard and the first feature secret shard; A first transmission module, configured to generate a binary expansion set of the first feature data set according to the first feature data set; And obtain a first screening mask data set from a data provider according to the binary expansion set by executing an oblivious transfer protocol; A receiving module, configured to receive a second encrypted data set and a third encrypted data set from the data provider, wherein the second encrypted data set is obtained by processing a first encrypted data set with a shared key, and the first encrypted data set is obtained by the data requester processing a first data set to be matched with the shared key; An intersection finding module, configured to obtain a target data set by using a private intersection algorithm according to the first screening mask data set, the second encrypted data set, and the third encrypted data set; Wherein the first feature secret shard is obtained by the data provider processing a second data set to be matched through additive secret sharing; The third encrypted data set is obtained by processing the second data set to be matched with the shared key, a second private key, and a second screening mask data set; the second screening mask data set is determined according to a binary expansion set of a second feature data set; the second feature data set is obtained according to the second threshold secret shard and the second feature secret shard; The binary expansion set includes n elements. The method for obtaining the first screening mask data set from the data provider according to the binary expansion set by executing an oblivious transfer protocol includes: Receive a random array from the data providing end, where the random array includes groups of random numbers, where represents a security parameter, , and n are both positive integers, and each group of the random numbers includes at least two unequal random numbers; For the i-th element, determining screening mask data from the j-th group of random numbers according to the binary value of the i-th element according to a preset rule; By executing ×n oblivious transfer protocols, the first screened mask data set is obtained.

9. A data processing device, applied to a data provider, includes: A first processing module, configured to process a second data set to be matched through additive secret sharing to obtain a first feature secret shard and a second feature secret shard; And generating a second feature data set according to the second threshold secret shard and the second feature secret shard; A second transmission module, configured to generate a binary expansion set of the second feature data set according to the second feature data set; And determining a second screening mask data set according to the binary expansion set of the second feature data set by executing an oblivious transfer protocol; A second processing module, configured to process the first encrypted data set with the second private key to obtain a second encrypted data set; A sending module, configured to process the second data set to be matched with the shared key and the second screening mask set to obtain a third encrypted data set, and send the second encrypted data set and the third encrypted data set to the data requester; Wherein the second threshold secret shard is obtained by the data requester through additive secret sharing according to preset threshold information; The first encrypted data set is obtained by the data requester processing the first data set to be matched with the shared key and a first private key; The binary expansion set of the second feature data set includes n elements. The method for determining the second screening mask data set according to the binary expansion set of the second feature data set by executing an oblivious transfer protocol includes: Randomly generate a random array, where the random array includes groups of random numbers, where represents a security parameter, , and n are both positive integers, and each group of the random numbers includes at least two unequal random numbers; For the i-th element, determining screening mask data from the j-th group of random numbers according to the binary value of the i-th element according to a preset rule; By executing ×n oblivious transfer protocols, the second screened mask data set is obtained.

10. An electronic device, includes: One or more processors; A storage device, configured to store one or more programs, Wherein, when the one or more programs are executed by the one or more processors, the one or more processors are caused to execute the method according to any one of claims 1 to 5 or 6 to 7.

11. A computer-readable storage medium having executable instructions stored thereon, which when executed by a processor cause the processor to execute the method according to any one of claims 1 to 5 or 6 to 7.

12. A computer program product comprising a computer program, which when executed by a processor implements the method according to any one of claims 1 to 5 or 6 to 7.

Images