Data processing method and device based on privacy protection, equipment and storage medium

Abstract

The application relates to the technical field of data processing, and provides a data processing method and device based on privacy protection, equipment and a storage medium. The method comprises the following steps: generating a trusted certificate list of a signature certificate, an encryption certificate and an identity ID of each subsystem; generating a corresponding task ID and a to-be-done subtask of each subsystem according to a preset to-be-done task flow table; when it is monitored that a first subsystem acquires a first to-be-done subtask of the to-be-done task flow table from a preset address according to a first task ID and performs decryption, performing signature verification on the decrypted first to-be-done subtask according to the trusted certificate list to obtain operation content of the first to-be-done subtask; acquiring target data associated with the operation content in a data storage device of the first subsystem, encrypting and signing the target data, obtaining target data results and uploading the target data results to the preset address. The application also relates to the technical field of blockchains, and the signature certificate, the encryption certificate and the identity ID can also be stored in a node of a blockchain.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a data processing method, apparatus, device, and storage medium based on privacy protection. Background Technology

[0002] Multi-party privacy data processing systems typically involve multiple subsystems, each deploying data acquisition devices to collect large amounts of business data. Multi-party privacy data processing refers to a secure computing technology that allows parties holding privacy data sets to obtain the intersection of their privacy data sets without disclosing their own privacy data.

[0003] However, this business data is scattered across multiple subsystems, requiring each subsystem to open external service interfaces for data transmission. In real-world scenarios, providing external services can easily lead to the leakage of service interface addresses, resulting in malicious queries that can access the servers of the parties involved in data uploading, thus causing low data privacy and security. Summary of the Invention

[0004] In view of the above, the present invention provides a privacy-protected data processing method, apparatus, device and storage medium, the purpose of which is to solve the technical problem in the prior art that the data privacy security is low because the servers of the participating parties need to provide service interfaces to the outside world in the process of multi-party privacy data processing.

[0005] To achieve the above objectives, the present invention provides a privacy-preserving data processing method. The method is applied to at least one task center and one subsystem. Each subsystem includes at least one data storage device. The task center and each subsystem communicate within a preset trusted execution environment. The method includes:

[0006] Generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem;

[0007] Based on the preset task flow table, generate corresponding task IDs and sub-tasks for each of the subsystems.

[0008] When the first subsystem detects that the first sub-task of the task process table is obtained from the preset address according to the first task ID and decrypted, the decrypted first sub-task is verified and signed according to the trusted certificate list to obtain the operation content of the first sub-task.

[0009] The target data associated with the operation content is obtained from the data storage device of the first subsystem, the target data is encrypted and signed, the target data result is obtained, and uploaded to the preset address.

[0010] Preferably, a pre-defined trusted execution environment is constructed, including:

[0011] Read input data from software running in an encrypted memory execution environment;

[0012] The input data is processed in a pre-defined manner to form a trusted execution environment with private and dedicated keys.

[0013] Preferably, before generating a trusted certificate list from the signature certificates, encryption certificates, and identity IDs of each subsystem, the method further includes:

[0014] In a trusted execution environment, random numbers are obtained from each of the subsystems to perform key initialization operations, and signature certificates and encryption certificates for each of the subsystems are generated.

[0015] Preferably, the step of obtaining random numbers from each of the subsystems to perform key initialization operations and generate signature certificates and encryption certificates for each of the subsystems includes:

[0016] According to a preset encryption algorithm, the random number is used to generate a signature key pair, which includes a first private key and a first public key.

[0017] The first public key is signed by a preset authentication center to obtain a signature certificate, an encryption certificate, and an encryption key pair digital envelope.

[0018] Preferably, after obtaining the signature certificate, encryption certificate, and encryption key pair digital envelope, the method further includes:

[0019] The digital envelope is decrypted using the first private key of the signature key pair to obtain an encryption key pair, which includes a second private key and a second public key.

[0020] Preferably, obtaining and decrypting the first subtask of the task list includes:

[0021] The first task to be done is decrypted using the second private key of the encryption key pair of the first subsystem to obtain the plaintext data of the first task to be done.

[0022] Preferably, the step of verifying the signature of the decrypted first sub-task based on the trusted certificate list to obtain the operation content of the first sub-task includes:

[0023] Read the signature certificate contained in the plaintext data of the first to-do subtask, and determine whether the signature certificate exists in the trusted certificate list. If so, verify the signature of the plaintext data according to the signature certificate of the task center to obtain the operation content of the first to-do subtask.

[0024] To achieve the above objectives, the present invention also provides a privacy-protected data processing apparatus, the apparatus comprising:

[0025] The generation module is used to generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem.

[0026] Task module: Used to generate corresponding task IDs and pending subtasks for each of the subsystems according to a preset pending task flow table;

[0027] Decryption module: When the first subsystem detects that the first subsystem has obtained the first task subtask of the task process table from the preset address according to the first task ID and decrypted it, the module verifies the signature of the decrypted first task subtask according to the trusted certificate list to obtain the operation content of the first task subtask.

[0028] Encryption module: used to obtain target data associated with the operation content from the data storage device of the first subsystem, encrypt and sign the target data, obtain the target data result, and upload it to the preset address.

[0029] To achieve the above objectives, the present invention also provides an electronic device, the electronic device comprising:

[0030] At least one processor; and,

[0031] A memory communicatively connected to the at least one processor; wherein,

[0032] The memory stores a program that can be executed by the at least one processor, which enables the at least one processor to perform the above-described privacy-preserving data processing method.

[0033] To achieve the above objectives, the present invention also provides a computer-readable medium storing a computer program, which, when executed by a processor, implements the steps of the above-described privacy-preserving data processing method.

[0034] This invention generates signature certificates, encryption certificates, and trusted certificate lists for each subsystem within a pre-built trusted execution environment. It assigns task IDs and pending subtasks to each subsystem by setting a pending task workflow table through a task center. By setting the operation content of each pending subtask, it ensures that the data uploader only uploads necessary data that complies with the privacy agreement.

[0035] During the data upload process, the uploaded data is encrypted using the encryption certificates of the participating parties, and the first private key of the uploader's signature key pair is used to sign the encrypted uploaded data. During the data retrieval process, the retrieved data is decrypted using the second private key of the participating parties' encryption key pair, and the uploader's signature certificate verifies the decrypted data. Furthermore, the upload address and retrieval address of the data are matched and correspond, thereby ensuring the security of the privacy data of all parties and solving the technical problem in existing technologies where the service interfaces provided by the participating parties' servers are prone to data leakage. Attached Figure Description

[0036] Figure 1 This is a flowchart illustrating the privacy-protected data processing method of the present invention.

[0037] Figure 2 This is a schematic diagram of the privacy-protected data processing device of the present invention;

[0038] Figure 3 This is a schematic diagram of an electronic device based on the privacy-preserving data processing method of the present invention;

[0039] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0041] The embodiments of this invention can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0042] Foundational artificial intelligence technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0043] This invention provides a privacy-preserving data processing method. (See reference...) Figure 1 The diagram shows a flowchart of the privacy-preserving data processing method of the present invention. This method can be executed by an electronic device, which can be implemented by software and / or hardware. The method is applied to at least one task center and one subsystem, each subsystem including at least one data storage device. The task center and each subsystem communicate with each other in a preset trusted execution environment. The privacy-preserving data processing method includes the following steps S10-S40:

[0044] Step S10: Generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem.

[0045] In this embodiment, each subsystem and task center obtains random numbers within their respective pre-built trusted execution environments to perform key initialization operations, generating signature and encryption certificates for each subsystem. The random numbers are generated randomly within a certain range, and each number within that range has an equal chance of being obtained. The trusted execution environment forms a closed-loop data transmission environment, ensuring that data cannot be stolen from the outside.

[0046] A Trusted Execution Environment (TEE) can refer to a TEE recognized by the State Cryptography Administration (e.g., Hygon CSV TEE). Within this TEE, the CSV virtual machine uses the national cryptographic standard SM4 hardware engine to encrypt memory data, constructing a secure TEE. This ensures that host administrators or other users cannot access data within the TEE, supports startup metrics and runtime remote authentication, and guarantees that legitimate user programs are running. The encryption key for the TEE's memory is generated by a hardware random number generator and is invisible to the software, ensuring user data security.

[0047] In one embodiment, constructing a pre-defined trusted execution environment includes:

[0048] Read input data from software running in an encrypted memory execution environment;

[0049] The input data is processed in a pre-defined manner to form a trusted execution environment with private and dedicated keys.

[0050] In one embodiment, the step of performing pre-processing on the input data to form a trusted execution environment with private keys includes:

[0051] A proof report is generated based on the input data processed by the physical host's secure CPU;

[0052] After the hardware cryptographic module of the physical host successfully verifies the proof report, a bus session key is generated.

[0053] The bus session key is encrypted using the public key in the user data of the proof report to obtain the ciphertext of the bus session key;

[0054] The identifier ID of the hardware cryptographic module and the ciphertext of the bus session key are used as the key authorization result, and the key authorization result is returned to the software running in the encrypted memory execution environment;

[0055] The ciphertext of the bus session key is decrypted using the private key of the software to obtain the decrypted bus session key.

[0056] When the key corresponding to the identifier ID in the hardware cryptographic module is invoked, the decrypted bus session key is used to protect the invocation process, forming a trusted execution environment with private and dedicated keys.

[0057] The secure CPU of the physical host provides an encrypted memory execution environment for software. The keys for encrypting memory data are randomly generated and managed within the secure CPU chip, and the software code cannot access these keys. However, the key management and services provided by the secure CPU are very limited and cannot meet the needs of software applications for using a large number of keys. Therefore, a hardware cryptographic module needs to be introduced to meet these needs.

[0058] The hardware cryptographic module of the physical host can generate, store, and calculate a large number of keys internally, and only output the calculation results of the keys, thus ensuring the security of the keys and providing secure and comprehensive key management and services for the software.

[0059] However, the relationship between existing secure CPUs and hardware cryptographic modules is loosely coupled. Due to the following two security issues, a trusted execution relationship of "key-private" is not formed between a certain encrypted memory execution environment and a specific key in the hardware cryptographic module:

[0060] 1. The encrypted memory execution environment and the hardware cryptographic module exchange data through an external bus (such as the PCI bus). Existing secure CPU chips cannot encrypt and protect the data transmitted on the external bus through hardware encryption.

[0061] 2. The hardware cryptographic module on the external bus is shared by all encrypted memory execution environments on the same physical host. Although the key inside the hardware cryptographic module is not leaked, it can be accessed by different encrypted memory execution environments on the same physical host.

[0062] To address the two issues mentioned above, this embodiment requires the construction of a new security mechanism within the trusted execution environment:

[0063] Step A1: Configure Key Authorization for the Hardware Cryptographic Module: The secure CPU has a Platform Endorsement Key (PEK) internally. This is an SM2 key pair containing a private key (PEK_Private) and a public key (PEK_Public). The PEK is generated internally within the secure CPU chip during the initialization of the encrypted memory execution environment platform. The secure CPU assigns a unique identifier ID (Env ID) to each encrypted memory execution environment. The secure CPU chip manufacturer assigns a unique identifier ID (Chip ID) to the secure CPU chip.

[0064] When generating a key (the key's unique identifier is HSMKeyID), the hardware cryptographic module must configure authorization information (HSMKeyAuth) for that key. This authorization information is stored in a secure storage space within the hardware cryptographic module and cannot be tampered with by unauthorized external parties. The authorization information (HSMKeyAuth) establishes an authorized binding relationship between a specific key within the hardware cryptographic module and a specific encrypted memory execution environment running on a specific secure CPU chip.

[0065] HSMKeyAuth = (HSMKey ID, Chip ID, Env ID, PEK_Public).

[0066] Step A2: Obtain key authorization from the hardware cryptographic module: When the software running in the encrypted memory execution environment needs to call the key inside the hardware cryptographic module, it generates a bus negotiation key pair (BusKey) inside the encrypted memory execution environment. This is an SM2 key pair containing a private key (BusKey_Private) and a public key (BusKey_Public). The public key (BusKey_Public) is used as the input data (ATTESTATION) for constructing secure CPU proofs using user-defined data.

[0067] Input data (ATTESTATION) = (user-defined data USER DATA, random number MNONCE, message digest HASH), where user-defined data USER DATA includes HSMKey ID and BusKey_Public.

[0068] Random number (MNONCE): A one-time random number generated by the software calling the hardware cryptographic module. This random number is also stored in the random number register of the hardware cryptographic module. Each time a new random number is generated, it will overwrite the old random number in the random number register.

[0069] Message digest hash: HASH = SM3(USERDATA || MNONCE);

[0070] The secure CPU generates an attestation report (ATTESTATION_Report) based on the input data (ATTESTATION). ATTESTATION_Report = (Chip ID, Env ID, USER DATA, MNONCE, Report_Signature);

[0071] Report_Signature is the overall SM2 signature of Chip ID, Env ID, USER DATA, and MNONCE using the private key (PEK_Private).

[0072] The software running in the encrypted memory execution environment sends an ATTESTATION_Report to the hardware cryptographic module to request access to the key corresponding to the HSMKey ID. The hardware cryptographic module performs the following verifications:

[0073] The system reads the HSMKeyAuth from its own secure storage space based on the HSMKey ID in the USER DATA (HSMKeyAuth includes HSMKeyID, ChipID, EnvID, and PEK_Public). If the read fails, the verification fails.

[0074] Verify the signature (Report_Signature) of the ATTESTATION_Report using the public key (PEK_Public). If signature verification fails, the verification fails.

[0075] Compare the random number MNONCE in the verification report (ATTESTATION_Report) with the value in its own random number register. If they are not the same, the verification fails.

[0076] Compare the Chip ID and Env ID in the verification report (ATTESTATION_Report) with those in the HSMKeyAuth. If they are different, the verification fails.

[0077] If they are the same, the verification is successful.

[0078] After the hardware cryptographic module successfully verifies the ATTESTATION_Report, it generates a bus session key (BusSessionKey). BusSessionKey is an SM4 symmetric key. Using the public key (BusKey_Public) of USER DATA in the ATTESTATION_Report, the bus session key (BusSessionKey) is encrypted using SM2 to obtain the ciphertext BusSessionKeyCipher. HSMKeyID and BusSessionKeyCipher are returned as the key authorization result to the software running in the encrypted memory execution environment. The software running in the encrypted memory execution environment uses the private key (BusKey_Private) to decrypt BusSessionKeyCipher using SM2 to obtain the bus session key (BusSessionKey).

[0079] Step A3: Call the key of the hardware cryptographic module: After the software running in the encrypted memory execution environment obtains the key authorization result, it can call the key corresponding to HSMKeyID in the hardware cryptographic module under the protection of the bus session key, forming a trusted execution relationship with private and dedicated keys.

[0080] Data exchange between the two parties is encrypted using the BusSessionKey (SM4) and HMAC-SM3 is calculated for integrity and authorization verification.

[0081] After each subsystem and task center has completed its key initialization steps, the task center generates the execution order of each pending subtask according to the pending task flow table, and generates an identity ID for each subsystem and task center according to the execution order (for example, the identity ID of the task center (task initiator - disease control subsystem) is C00, the identity ID of the first subsystem (participant - telecommunications operator subsystem) is P01, the identity ID of the second subsystem (participant - public monitoring subsystem) is P02, and the identity ID of the third subsystem (participant - citizen ID card subsystem) is P03).

[0082] Generate a trusted certificate list from the signature certificates, encryption certificates, and identity IDs of each subsystem and task center, and store the trusted certificate list in the data storage device of each subsystem. By storing a trusted certificate list in each subsystem, only requests from the associated subsystems that are on the trusted certificate list are processed, preventing users not on the trusted certificate list from requesting data arbitrarily, and reducing the expenditure of system resources.

[0083] The list of generated trusted certificates is shown in Table 1 below:

[0084]

[0085] Table 1

[0086] In one embodiment, before generating a trusted certificate list from the signature certificates, encryption certificates, and identity IDs of each subsystem, the method further includes:

[0087] In a trusted execution environment, random numbers are obtained from each of the subsystems to perform key initialization operations, and signature certificates and encryption certificates for each of the subsystems are generated.

[0088] In one embodiment, the step of obtaining random numbers from each of the subsystems to perform key initialization operations and generate signature certificates and encryption certificates for each of the subsystems includes:

[0089] According to a preset encryption algorithm, the random number is used to generate a signature key pair, which includes a first private key and a first public key.

[0090] The first public key is signed by a preset authentication center to obtain a signature certificate, an encryption certificate, and an encryption key pair digital envelope.

[0091] The preset encryption algorithms include, but are not limited to, the SM4 algorithm; random numbers are generated for each subsystem and task center based on the trusted execution environment's random number generation function.

[0092] The random number is generated into an SM2 signature key pair according to the preset encryption algorithm. The signature key pair includes a first private key and a first public key. The first public key of the signature key pair is exported from the trusted execution environment and sent to the digital certificate authentication center recognized by the State Cryptography Administration to issue a signature certificate. At the same time as receiving the signature certificate returned from the digital certificate authentication center, the digital envelope of the encryption key pair and the encryption certificate are also returned.

[0093] In one embodiment, after obtaining the signature certificate, encryption certificate, and encryption key pair digital envelope, the method further includes:

[0094] The digital envelope is decrypted using the first private key of the signature key pair to obtain an encryption key pair, which includes a second private key and a second public key.

[0095] In the trusted execution environment, the first private key is used to decrypt the encryption key pair digital envelope to obtain the SM2 encryption key pair. Finally, after each subsystem and task center completes key initialization, the key holdings of each party are shown in Table 2 below:

[0096]

[0097] Table 2

[0098] Key initialization provides automatic encryption and decryption protection for data upload and retrieval, ensuring the four key elements of network security: confidentiality of information transmission, integrity of data exchange, non-repudiation of sent data, and certainty of the identities of participating parties.

[0099] Step S20: Generate corresponding task IDs and pending subtasks for each of the subsystems according to the preset task flow table.

[0100] In this embodiment, the task center sets up a task flow table, and the task center can refer to a subsystem that initiates the task. The task center assigns task IDs and corresponding sub-tasks to each subsystem according to the execution order of each sub-task in the task flow table. In addition, in a trusted execution environment, only the task center needs to open its service interface to the outside world. Other subsystems participating in the sub-tasks (i.e., the receiving sub-tasks) do not need to open their service interfaces to the outside world. Through the preset address of the task flow table set by the task center, it is ensured that the servers of the subsystems participating in the sub-tasks are not subject to malicious query attacks.

[0101] This invention uses the example of tracing close contacts in an epidemiological investigation to describe the implementation of a privacy-preserving data processing method. In this example, the ID number of a close contact, the location of the close contact, and the time of the close contact can be found from the ID number of a confirmed patient.

[0102] First, define the identity ID of the Disease Control Subsystem (Task Center) as C00, and the identity IDs of the participants in other subsystems as follows: P01 for the Telecommunications Operator Subsystem, P02 for the Public Monitoring Subsystem, and P03 for the Citizen ID Card Subsystem.

[0103] Please see Table 3 below for the generated preset to-do task flowchart:

[0104]

[0105] Table 3

[0106] The task center fills in the operation content of the first sub-task in the task to be done process table (e.g., the ID number of a confirmed patient), and simultaneously encrypts, signs, and uploads the first sub-task to the output field of the preset address and pushes the release message of the first sub-task to the first subsystem. The preset address can refer to a designated port of a blockchain node or cloud server. The steps of encrypting, signing, and uploading the first sub-task to the preset address include:

[0107] 1. Encrypt the operation content using the second public key of the encryption certificate of the participant (first subsystem) of the first sub-task in the task schedule;

[0108] 2. Sign the operation content using the first private key of the signature key in the task center, and upload the encrypted and signed operation content to the output field at the preset address.

[0109] In the task to be done workflow table, the next task to be done is only published after the previous task to be done is completed and the data is uploaded to the output field of the preset address. The next sub-system (i.e., the participant that receives or obtains the next task to be done) obtains the operation content of the next task to be done from the input field of the preset address. This process continues to execute each task to be done in the task to be done workflow table. The input field and the output field of the preset address are matched and correspond to each other. That is, the output address of the previous task to be done is equal to the acquisition address of a task to be done, thereby ensuring the consistency and legality of the data source.

[0110] For example, in Table 3, task T01 operation OP01: The Disease Control Subsystem (Identity ID: C00) encrypts the confirmed patient's ID number information using the encryption certificate of the Communication Operator Subsystem (Identity ID: P01) according to the task to be done process table, signs the confirmed patient's ID number information according to the first private key of the Disease Control Subsystem's signature key, and finally uploads the encrypted and signed confirmed patient's ID number information to the output field of the preset address.

[0111] Step S30: When the first subsystem detects that it has obtained the first subtask of the task process table from the preset address according to the first task ID and decrypted it, it verifies the signature of the decrypted first subtask according to the trusted certificate list to obtain the operation content of the first subtask.

[0112] In this embodiment, the task center pushes the release message of the first to-do subtask to the first subsystem. The release message contains the storage address (i.e., the preset address) of the first to-do subtask. The first subsystem obtains the first to-do subtask from the input field of the preset address according to the first task ID, decrypts it, and then verifies the signature of the decrypted first to-do subtask according to the trusted certificate list to obtain the operation content of the first to-do subtask.

[0113] For example, in Table 3, task T02 operation OP03: the communication operator subsystem (identity ID: P01) obtains the encrypted and signed ID number information of the confirmed patient from the input field of the preset address, decrypts and verifies the signature of the information, and obtains the first pending sub-task as querying all mobile phone numbers of the confirmed patient.

[0114] In one embodiment, obtaining and decrypting the first subtask of the task scheduler includes:

[0115] The first task to be done is decrypted using the second private key of the encryption key pair of the first subsystem to obtain the plaintext data of the first task to be done.

[0116] In one embodiment, the step of verifying the signature of the decrypted first sub-task based on the trusted certificate list to obtain the operation content of the first sub-task includes:

[0117] Read the signature certificate contained in the plaintext data of the first to-do subtask, and determine whether the signature certificate exists in the trusted certificate list. If so, verify the signature of the plaintext data according to the signature certificate of the task center to obtain the operation content of the first to-do subtask.

[0118] The plaintext data of the first task refers to the data provided by the party initiating the task (e.g., the ID number of a confirmed patient); the operation content of the first task refers to the data to be queried based on the plaintext data (e.g., querying all mobile phone numbers of a confirmed patient based on the ID number of the confirmed patient, and then querying the location of the base station and the time period of stay at the base station of the confirmed patient based on all mobile phone numbers).

[0119] When each participant in a pending subtask decrypts its corresponding pending subtask, it uses the second private key of its own encryption key pair to decrypt the corresponding pending subtask. At the same time, it ensures that its trusted certificate list stores the plaintext data of the first pending subtask, which contains the uploader's signature certificate, to prove the legitimacy of the communication between the two parties. Finally, it uses the uploader's signature certificate to verify the signature of the plaintext data and obtain the operation content of the first pending subtask. This double protection ensures that the data has not been tampered with during transmission.

[0120] In one embodiment, it also includes:

[0121] If it is determined that the signature certificate does not exist in the list of trusted certificates, a prompt message indicating failure to obtain the first pending subtask is generated.

[0122] This indicates that the uploader's signature certificate is not stored in the trusted certificate list of the participant receiving the first task, meaning the first task is an invalid request. A message indicating failure to obtain the first task is generated (e.g., "Hello, the signature verification data is invalid, please check and try again").

[0123] Step S40: Obtain the target data associated with the operation content from the data storage device of the first subsystem, encrypt and sign the target data, obtain the target data result, and upload it to the preset address.

[0124] In this embodiment, based on the operation content of the first to-do subtask, a large amount of candidate data associated with the operation content is retrieved from the data storage device of the first subsystem (for example, retrieving all mobile phone numbers of the confirmed patient based on the confirmed patient's ID number, and then retrieving account opening information, historical location information, and historical call information based on all mobile phone numbers). According to the preset privacy protocol, the base station locations and base station stay time periods that all mobile phone numbers of the confirmed patient have visited within a preset time period (for example, September 1, 2022 - September 5, 2022) are selected as target data. The target data is encrypted and signed to obtain the target data result and uploaded to the output field of the preset address.

[0125] For example, in Table 3, Task T02 Operation OP03: The communication operator subsystem (identity ID: P01) queries its own dataset for the locations of all mobile phone numbers of confirmed patients that have been to the base stations and the time periods spent at the base stations. It then outputs the base station locations and time periods spent at the base stations as target data, encrypts and signs them, obtains the target data results, and uploads them to the output field of the preset address so that the public monitoring subsystem (identity ID: P02) can execute Task T03.

[0126] In one embodiment, obtaining the target data associated with the operation content from the data storage device of the first subsystem includes:

[0127] Retrieve candidate data associated with the operation content from the data storage device of the first subsystem.

[0128] The candidate data is filtered according to a preset privacy protocol to obtain the target data.

[0129] The preset privacy agreement refers to the agreement signed in advance between the first subsystem and the task center to upload necessary data. For example, the candidate data from the data storage device of the first subsystem may contain a lot of users' privacy data (e.g., account opening information, historical location information, historical call information). This privacy data is also beyond the scope of the request of the operation content. In order to ensure that unnecessary data is not uploaded, this privacy data is further filtered, and only data that meets the query fields (e.g., the query fields are the base station location and base station stay time period from September 1, 2022 to September 5, 2022) is obtained to get the necessary data, i.e., the target data.

[0130] In one embodiment, encrypting and signing the target data to obtain the target data result and uploading it to the preset address includes:

[0131] The target data is encrypted using the encryption certificate of the recipient of the next sub-task in the task flow table.

[0132] The target data is signed using the first private key of the signature key pair of the first subsystem, and the target data result is obtained and uploaded to the preset address.

[0133] When each participant in a pending subtask uploads the target data for that subtask, they encrypt the target data using the encryption certificate of the participant receiving the target data, and also sign the target data using the first private key of the uploading party's signing key. Encryption ensures the confidentiality of the data, and signing ensures that the data has not been tampered with.

[0134] In one embodiment, after obtaining the target data result and uploading it to the preset address, the method further includes:

[0135] Based on the task schedule and the target data results, generate a message for the next task and push it to the next subsystem so that steps S30-S40 are repeated.

[0136] For example, tasks T03 and T04 in Table 3 will repeatedly execute steps S30-S40: the step of decrypting and verifying the signature to retrieve the to-do subtask from the input field of the preset address, and the step of encrypting and signing the data result to the output field of the preset address.

[0137] Table 3 Task T03 Operation OP04: The public monitoring subsystem retrieves the confirmed patient's photo, base station location, and base station dwell time from the input field of the preset address, decrypts and verifies the information. Based on this information, it searches its own public monitoring video data for monitoring videos within a certain range of the base station location and within the dwell time period. Then, based on the input confirmed patient's photo, it identifies other faces appearing simultaneously with the patient's photo in these videos as close contacts. From the video capture location and capture time of the identified patient's face, the location and time of close contacts can be obtained. The location and time of close contacts are encrypted and signed, then uploaded to the output field of the preset address and returned to the disease control subsystem.

[0138] Task T03 Operation OP05: The public monitoring subsystem searches its own public monitoring video data for monitoring videos within a certain range of the base station location and the time period the base station was in, based on the input base station location and the base station's dwell time. Then, based on the input confirmed patient's photo, it identifies other faces appearing simultaneously with the patient's photo in these videos as close contacts. From the video capture location and time of the identified patient's photo, the location and time of the close contacts can be obtained. The close contact's photo is encrypted and signed, then uploaded to the output field at the preset address and output to the citizen ID card subsystem.

[0139] Task T04, Operation OP06: The Citizen ID Card Subsystem retrieves the close contact's photo from the input field of the preset address, decrypts and verifies it, and performs image recognition on the input close contact's photo within its own dataset to obtain the close contact's ID number. The close contact's ID number is then encrypted, signed, and uploaded to the output field of the preset address, where it is output to the Disease Control Subsystem.

[0140] In one embodiment, after obtaining the target data result and uploading it to the preset address, the method further includes:

[0141] The target data results uploaded by each of the subsystems in the preset address are obtained and fused to obtain fused data.

[0142] For example, after completing tasks T01 to T04 in Table 3, the disease control subsystem finally obtains the data fusion results from the preset address: the ID number of the close contact, the location and time of the close contact.

[0143] By setting up a task schedule, parties holding private data sets can communicate and connect in a trusted execution environment without disclosing their respective private data.

[0144] During the data upload process, the uploaded data is encrypted using the encryption certificates of the participating parties, and the first private key of the uploader's signature key pair is used to sign the encrypted uploaded data. During the data retrieval process, the retrieved data is decrypted using the second private key of the participating parties' encryption key pair, and the uploader's signature certificate is used to verify the decrypted data. Furthermore, the participating parties have the right to filter the uploaded data, uploading only the necessary data to ensure maximum privacy protection for users.

[0145] This technology acquires and merges data uploaded by various subsystems from a preset address to obtain merged data, while ensuring that the privacy data sets of all parties are not leaked. This provides a secure computing technology to guarantee the security of the privacy data of all parties.

[0146] Reference Figure 2 The diagram shows a module schematic of the privacy-protected data processing device of the present invention.

[0147] The privacy-preserving data processing device 100 of the present invention can be installed in an electronic device. Depending on the functions implemented, the privacy-preserving data processing device 100 may include a generation module 110, a generation module 120, a decryption module 130, and an encryption module 140. The modules described in this invention can also be referred to as units, which are a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0148] In this embodiment, the functions of each module / unit are as follows:

[0149] Generation module 110: Used to generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem;

[0150] Task module 120: Used to generate corresponding task IDs and pending subtasks for each of the subsystems according to a preset pending task flow table;

[0151] Decryption module 130: When the first subsystem detects that the first subsystem has obtained the first task subtask of the task process table from the preset address according to the first task ID and decrypted it, the decrypted first task subtask is verified and signed according to the trusted certificate list to obtain the operation content of the first task subtask.

[0152] Encryption module 140: used to obtain target data associated with the operation content from the data storage device of the first subsystem, encrypt and sign the target data, obtain the target data result, and upload it to the preset address.

[0153] In one embodiment, constructing a pre-defined trusted execution environment includes:

[0154] Read input data from software running in an encrypted memory execution environment;

[0155] The input data is processed in a pre-defined manner to form a trusted execution environment with private and dedicated keys.

[0156] In one embodiment, before generating a trusted certificate list from the signature certificates, encryption certificates, and identity IDs of each subsystem, the method further includes:

[0157] In a trusted execution environment, random numbers are obtained from each of the subsystems to perform key initialization operations, and signature certificates and encryption certificates for each of the subsystems are generated.

[0158] In one embodiment, the step of obtaining random numbers from each of the subsystems to perform key initialization operations and generate signature certificates and encryption certificates for each of the subsystems includes:

[0159] According to a preset encryption algorithm, the random number is used to generate a signature key pair, which includes a first private key and a first public key.

[0160] The first public key is signed by a preset authentication center to obtain a signature certificate, an encryption certificate, and an encryption key pair digital envelope.

[0161] In one embodiment, after obtaining the signature certificate, encryption certificate, and encryption key pair digital envelope, the method further includes:

[0162] The digital envelope is decrypted using the first private key of the signature key pair to obtain an encryption key pair, which includes a second private key and a second public key.

[0163] In one embodiment, obtaining and decrypting the first subtask of the task scheduler includes:

[0164] The first task to be done is decrypted using the second private key of the encryption key pair of the first subsystem to obtain the plaintext data of the first task to be done.

[0165] In one embodiment, the step of verifying the signature of the decrypted first sub-task based on the trusted certificate list to obtain the operation content of the first sub-task includes:

[0166] Read the signature certificate contained in the plaintext data of the first to-do subtask, and determine whether the signature certificate exists in the trusted certificate list. If so, verify the signature of the plaintext data according to the signature certificate of the task center to obtain the operation content of the first to-do subtask.

[0167] Reference Figure 3 The diagram shown is a schematic of an electronic device based on the privacy-preserving data processing method of the present invention.

[0168] The electronic device 1 includes, but is not limited to, a memory 11, a processor 12, a display 13, and a network interface 14. The electronic device 1 connects to a network via the network interface 14 to acquire raw data. The network can be an intranet, the Internet, a Global System for Mobile Communications (GSM), Wideband Code Division Multiple Access (WCDMA), a 4G network, a 5G network, Bluetooth, Wi-Fi, a voice communication network, or other wireless or wired networks.

[0169] The memory 11 includes at least one type of readable medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of the electronic device 1, such as the hard disk or memory of the electronic device 1. In other embodiments, the memory 11 may also be an external storage device of the electronic device 1, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. of the electronic device 1. Of course, the memory 11 may include both the internal storage unit and the external storage device of the electronic device 1. In this embodiment, the memory 11 is typically used to store the operating system and various application software installed on the electronic device 1, such as the program code of the privacy-protected data processing 10. In addition, the memory 11 may also be used to temporarily store various types of data that have been output or will be output.

[0170] In some embodiments, processor 12 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. Processor 12 is typically used to control the overall operation of the electronic device 1, such as performing data interaction or communication-related control and processing. In this embodiment, processor 12 is used to run program code stored in memory 11 or process data, such as running program code for privacy-preserving data processing 10.

[0171] The display 13 may be referred to as a display screen or display unit. In some embodiments, the display 13 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touch screen, etc. The display 13 is used to display information processed in the electronic device 1 and to display a visual working interface, such as displaying the results of data statistics.

[0172] The network interface 14 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface), which is typically used to establish communication connections between the electronic device 1 and other electronic devices.

[0173] Figure 3Only an electronic device 1 with components 11-14 and privacy-preserving data processing 10 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0174] Optionally, the electronic device 1 may further include a user interface, which may include a display, an input unit such as a keyboard, and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 1 and to display a visual user interface.

[0175] The electronic device 1 may also include radio frequency (RF) circuits, sensors, and audio circuits, etc., which will not be described in detail here.

[0176] In the above embodiments, when the processor 12 executes the privacy-preserving data processing program 10 stored in the memory 11, it can perform the following steps:

[0177] Generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem;

[0178] Based on the preset task flow table, generate corresponding task IDs and sub-tasks for each of the subsystems.

[0179] When the first subsystem detects that the first sub-task of the task process table is obtained from the preset address according to the first task ID and decrypted, the decrypted first sub-task is verified and signed according to the trusted certificate list to obtain the operation content of the first sub-task.

[0180] The target data associated with the operation content is obtained from the data storage device of the first subsystem, the target data is encrypted and signed, the target data result is obtained, and uploaded to the preset address.

[0181] The storage device can be the memory 11 of the electronic device 1, or it can be other storage devices that are communicatively connected to the electronic device 1.

[0182] For a detailed explanation of the above steps, please refer to the above. Figure 2 Functional block diagram of an embodiment of a privacy-protected data processing device 100 and Figure 1Description of a flowchart of an embodiment of a privacy-preserving data processing method.

[0183] Furthermore, this invention also proposes a computer-readable medium, which can be non-volatile or volatile. This computer-readable medium can be any one or any combination of several of the following: hard disk, multimedia card, SD card, flash memory card, SMC, read-only memory (ROM), erasable programmable read-only memory (EPROM), portable compact disc read-only memory (CD-ROM), USB memory, etc. The computer-readable medium includes a data storage area and a program storage area. The data storage area stores data created based on the use of blockchain nodes, and the program storage area stores a privacy-preserving data processing program 10. When executed by a processor, the privacy-preserving data processing program 10 performs the following operations:

[0184] Generate a list of trusted certificates from the signature certificates, encryption certificates, and identity IDs of each subsystem;

[0185] Based on the preset task flow table, generate corresponding task IDs and sub-tasks for each of the subsystems.

[0186] When the first subsystem detects that the first sub-task of the task process table is obtained from the preset address according to the first task ID and decrypted, the decrypted first sub-task is verified and signed according to the trusted certificate list to obtain the operation content of the first sub-task.

[0187] The target data associated with the operation content is obtained from the data storage device of the first subsystem, the target data is encrypted and signed, the target data result is obtained, and uploaded to the preset address.

[0188] The specific implementation of the computer-readable medium of the present invention is largely the same as the specific implementation of the privacy-protected data processing method described above, and will not be repeated here.

[0189] In another embodiment, to further ensure the privacy and security of all the aforementioned data, the privacy-preserving data processing method provided by this invention can also store all of the aforementioned data in a blockchain node. For example, all of this data can be stored in a blockchain node.

[0190] It should be noted that the blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0191] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements, but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0192] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, electronic device, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0193] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A privacy-preserving data processing method, the method being applied to at least one task center and one subsystem, each subsystem comprising at least one data storage device, characterized in that, The task center is connected with each subsystem in a preset trusted execution environment, and the method comprises: generating a trusted certificate list for each subsystem by using a signature certificate, an encryption certificate and an identity ID; generating a corresponding task ID and a to-do subtask for each subsystem according to a preset to-do task flow table; when it is monitored that a first subsystem acquires a first to-do subtask of the to-do task flow table from a preset address according to a first task ID and performs decryption, performing signature verification on the decrypted first to-do subtask according to the trusted certificate list to obtain operation content of the first to-do subtask; acquiring target data associated with the operation content from a data storage device of the first subsystem, encrypting and signing the target data to obtain target data results and uploading the target data results to the preset address.

2. The privacy preserving data processing method according to claim 1, wherein, constructing a preset trusted execution environment, comprising: reading input data of software running in an encrypted memory execution environment; performing preset processing on the input data to form a trusted execution environment private to a key.

3. The privacy-protecting data processing method according to claim 1, wherein, Before the generating of the trusted certificate list for each subsystem by using the signature certificate, the encryption certificate and the identity ID, the method further comprises: in the trusted execution environment, acquiring random numbers of each subsystem to perform key initialization operation and generate a signature certificate, an encryption certificate and an encryption key pair of each subsystem.

4. The privacy-protected data processing method according to claim 3, wherein, The acquiring of the random numbers of each subsystem to perform the key initialization operation and the generating of the signature certificate, the encryption certificate and the encryption key pair of each subsystem comprise: generating a signature key pair according to a preset encryption algorithm, the signature key pair comprising a first private key and a first public key; performing signature on the first public key according to a preset authentication center to obtain a signature certificate, an encryption certificate and a digital envelope of an encryption key pair.

5. The privacy -enabling data processing method of claim 4, wherein, After the obtaining of the signature certificate, the encryption certificate and the digital envelope of the encryption key pair, the method further comprises: decrypting the digital envelope according to the first private key of the signature key pair to obtain an encryption key pair, the encryption key pair comprising a second private key and a second public key.

6. The privacy -enabling data processing method of claim 1, wherein, The acquiring of the first to-do subtask of the to-do task flow table and the performing of decryption comprise: decrypting the first to-do subtask according to the second private key of the encryption key pair of the first subsystem to obtain plaintext data of the first to-do subtask.

7. The privacy -enabling data processing method of claim 1, wherein, The signature verification on the decrypted first to-do subtask according to the trusted certificate list to obtain the operation content of the first to-do subtask comprises: reading a signature certificate contained in the plaintext data of the first to-do subtask, and judging whether the signature certificate exists in the trusted certificate list, if yes, performing signature verification on the plaintext data according to the signature certificate of the task center to obtain the operation content of the first to-do subtask.

8. A privacy-preserving data processing apparatus, characterized by The apparatus comprises: a generating module for generating a trusted certificate list for each subsystem by using a signature certificate, an encryption certificate and an identity ID; a task module for generating a corresponding task ID and a to-do subtask for each subsystem according to a preset to-do task flow table; The decryption module is configured to, after monitoring that the first subsystem acquires and decrypts the first to-be-done subtask from the preset address according to the first task ID, verify the decrypted first to-be-done subtask according to the list of trusted certificates to obtain operation content of the first to-be-done subtask; The encryption module is configured to acquire target data associated with the operation content from a data storage device of the first subsystem, encrypt and sign the target data, obtain target data results, and upload the target data results to the preset address.

9. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein The memory stores a program that can be executed by the at least one processor, and the program is executed by the at least one processor to enable the at least one processor to execute the privacy protection-based data processing method according to any one of claims 1 to 7.

10. A computer readable medium characterized by The computer readable medium stores a computer program, and the computer program is executed by the processor to implement the privacy protection-based data processing method according to any one of claims 1 to 7.

Images