A cloud ERP secure data cross-domain processing method and system

Abstract

The application discloses a kind of cloud ERP security data cross-domain processing method and system, different multi-party secure computation protocols are designed for the characteristics of different data operation performance requirements in cloud ERP, different data encryption and processing methods are used for different cloud ERP data, under the premise of guaranteeing data security and personal privacy, the fastest encryption scheme suitable for application scenario is used. Both meet the needs of users for cloud ERP data operation speed, and guarantee the security of data, realize the combination of multi-party secure computation and cloud ERP cross-domain, each computing node can be realized without exposing own privacy data, while meeting the security and reliability of data cross-domain, guarantee the data transmission speed, have higher use value and popularization value in the field of cloud ERP data cross-domain processing.

Description

Technical Field

[0001] This invention relates to the field of cloud ERP data security, specifically to a method and system for cross-domain secure data processing in cloud ERP. Background Technology

[0002] Cross-domain refers to a client in a cloud ERP system requesting data from another service (B) or accessing data from different domains. Because the data owner and user are not unified, data security and personal privacy issues are increasingly serious, leading to the phenomenon of "data silos" and difficulties in cross-domain data flow. To prevent sensitive data leakage or attacks during cross-domain data transmission, a distributed architecture of a multi-party secure computation platform can be deployed and modeled. This allows cross-domain data-driven computation to be performed without leaving the database, ensuring both system data security and personal privacy. However, multi-party secure computation requires encryption before data transmission; the more complex the encryption algorithm, the higher the security of the multi-party secure computation. However, complex encrypted communication can lead to excessive computational loads, resulting in slow data flow in cloud ERP systems. Therefore, multi-party secure computation is difficult to implement in cloud ERP cross-domain scenarios where high data flow speed and timely response are required. Summary of the Invention

[0003] To address the problems existing in the prior art, this invention provides a method and system for secure cross-domain processing of cloud ERP data, which meets users' needs for cloud ERP data processing speed while improving data security.

[0004] This invention is achieved through the following technical solution:

[0005] A method for secure cross-domain data processing in cloud ERP systems includes the following steps:

[0006] Step 1: Classify ERP security data according to the set rules, and generate keys using corresponding encryption algorithms for different categories of data;

[0007] Step 2: The cloud ERP data storage terminal encrypts each independent data in the corresponding category data according to the key, and sends the encrypted ciphertext to the ERP calculation assistance module.

[0008] Step 3: The cloud ERP calculation auxiliary module performs calculations on the obtained ciphertext to obtain the result ciphertext, and sends the result ciphertext to the ERP data receiving end;

[0009] Step 4: All participants jointly analyze the encrypted result E(f(x1,x2…x) m Decryption is performed to obtain the corresponding plaintext.

[0010] Preferably, in step 1, the security data is classified according to the confidentiality level.

[0011] Preferably, in step 1, the security data is divided into ordinary data and confidential data;

[0012] The ordinary data uses a homomorphic encryption algorithm to generate a key; the confidential data uses a fully homomorphic encryption technique to generate a key.

[0013] Preferably, in step 2, the cloud ERP data storage terminal stores each independent data point x in the financial data. i For each i = 1, 2, ..., m, a matrix is ​​used for encryption, and a random matrix is ​​introduced to process the noise vector, resulting in ciphertext C. The binary decomposition of ciphertext C into its state G is then performed. -1 (C) is sent as the final encrypted message to the cloud ERP computing auxiliary module.

[0014] Preferably, in step 3, the homomorphic encryption algorithm used by the cloud ERP computing auxiliary module performs operations on the obtained ciphertext to obtain the result ciphertext.

[0015] Preferably, in step 3, the cloud ERP computing assistance module processes the encrypted G of the obtained financial data. -1 (C) Perform matrix operations to obtain the ciphertext G. -1 (f(x1,x2…x m )).

[0016] Preferably, in step 4, all participants use their homomorphic encryption private keys to decrypt the ciphertext of the ordinary data result to obtain the corresponding plaintext.

[0017] Preferably, in step 4, all participants reassemble the encrypted financial data into binary form and decrypt it in matrix form to obtain a result vector containing the encrypted original information, and then obtain the plaintext based on the result vector.

[0018] A system for secure cross-domain data processing in cloud ERP includes,

[0019] The data classification module categorizes ERP security data according to set rules and generates keys using corresponding encryption algorithms for different categories of data.

[0020] The encryption module encrypts each independent piece of data in the corresponding category data according to the key, and sends the encrypted ciphertext to the ERP calculation assistance module.

[0021] The ciphertext module performs calculations on the obtained ciphertext to obtain the ciphertext result, and then sends the ciphertext result to the ERP data receiving end.

[0022] The decryption module involves all participants working together to decrypt the ciphertext of the result to obtain the corresponding plaintext.

[0023] A computer-readable storage medium storing a computer program, characterized in that, when executed by a processor, the computer program implements the steps of the cloud ERP secure data cross-domain processing method.

[0024] Compared with the prior art, the present invention has the following beneficial technical effects:

[0025] This invention provides a secure cross-domain data processing method for cloud ERP systems. It employs different data encryption and processing methods for different types of cloud ERP data, using the fastest encryption scheme suitable for the application scenario while ensuring data security and personal privacy. This satisfies users' demands for cloud ERP data processing speed while guaranteeing data security. It combines multi-party secure computation with cross-domain cloud ERP processing, enabling each computing node to participate in computation without exposing its own private data, and achieving collaborative computation without the original and detailed data leaving the local machine.

[0026] Furthermore, a fully homomorphic encryption system, GSW, was introduced for financial data. As homomorphic operations proceed, noise accumulates continuously. Once the noise exceeds a certain threshold, decryption errors will occur. Conventional methods must take measures to reduce noise to ensure correct decryption. With the introduction of the homomorphic encryption system GSW, the protocol can compute functions of arbitrary complexity. While improving the efficiency of the algorithm, noise can be introduced into the encryption process to ensure the security of the scheme. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of a multi-party secure computation protocol for rapid computation of ordinary data in the cloud ERP secure data cross-domain processing system of the present invention;

[0028] Figure 2 This is a schematic diagram of a multi-party secure computation protocol for financial cloud in the cloud ERP secure data cross-domain processing system of the present invention. Detailed Implementation

[0029] The present invention will now be described in further detail with reference to the accompanying drawings. These descriptions are intended to explain the invention and not to limit it.

[0030] A method for secure cross-domain data processing in cloud ERP systems includes the following steps:

[0031] Step 1: Classify ERP security data according to the set rules, and generate corresponding keys using corresponding encryption algorithms for different categories of data.

[0032] Specifically, the security data of the ERP system is classified according to the confidentiality level. For example, management data is classified as ordinary data, financial data as Level 1 confidential data, and technical data as Level 2 confidential data. Different encryption methods are used to encrypt data of different confidentiality levels.

[0033] In this embodiment, for the fast multi-party secure computation protocol for ordinary data, the cloud ERP data receiving end uses a homomorphic encryption algorithm to initialize and generate public-private key pairs and random numbers; the above homomorphic encryption algorithm is a multiplication homomorphic algorithm, an addition homomorphic algorithm, or a finite-time fully homomorphic algorithm. Under the premise of satisfying basic data operations, the algorithm with simple encryption method and faster speed is preferred.

[0034] In the multi-party secure computation protocol for fast computation of financial data, fully homomorphic encryption technology is used. The data receiving end initializes and generates random numbers as noise, and randomly selects a vector. Output As a key.

[0035] Step 2: The cloud ERP data storage terminal uses the key to access each independent data point x in the corresponding category data. i Encrypt the string i = 1, 2, ..., m, and then convert the resulting ciphertext E(x) into a string. i Send it to the ERP calculation assistance module;

[0036] Specifically, in the multi-party secure computation protocol for fast computation of ordinary data, the cloud ERP data storage terminal performs encryption computation on the stored ordinary data according to the homomorphic encryption algorithm used and the key generated by the receiving end, and sends the encrypted ciphertext to the cloud ERP computing auxiliary module.

[0037] In the multi-party secure computation protocol for financial clouds, the cloud ERP data storage terminal controls each independent data point within the financial data. i For each i = 1, 2, ..., m, a matrix is ​​used for encryption, and a random matrix is ​​introduced to process the noise vector, resulting in ciphertext C. The binary decomposition of ciphertext C into its state G is then performed. -1 (C) is sent as the final encrypted message to the cloud ERP computing auxiliary module.

[0038] Step 3: The cloud ERP calculation auxiliary module performs calculations on the obtained ciphertext to obtain the result ciphertext E(f(x1,x2…x)). m The encrypted result is then sent to the ERP data receiving end.

[0039] Specifically, in the multi-party secure computation protocol for fast computation of ordinary data, the cloud ERP computing auxiliary module uses a homomorphic encryption algorithm to perform operations on the acquired ciphertext to obtain the result ciphertext.

[0040] In this invention, regarding the multi-party secure computation protocol for financial clouds, the cloud ERP computing auxiliary module processes the encrypted G of the obtained financial data. -1 (C) Perform matrix operations to obtain the ciphertext G. -1 (f(x1,x2…x m )).

[0041] Step 4: All participants jointly analyze the encrypted result E(f(x1,x2…x) m Decryption is performed to obtain the corresponding plaintext.

[0042] For example, if an ERP system user needs to obtain the average value of financial data stored across domains, the calculation auxiliary module calculates the ciphertext corresponding to the average value and sends the ciphertext to each data storage node and the data receiving end. The data receiving end sends its private key to each data storage node, and each node decrypts, saves, and records the calculation result for verification. At the same time, the data receiving end decrypts and sends the plaintext of the average value to the user, thus fulfilling the user's needs.

[0043] Specifically, in the multi-party secure computation protocol for fast computation of ordinary data, the data receiving end and the data storage end will receive the ciphertext of the result returned by the ERP calculation auxiliary module, and use the homomorphic encryption private key to decrypt the ciphertext of the result to obtain the corresponding plaintext.

[0044] In the multi-party secure computation protocol for financial cloud, the data receiving end and the data storage end will receive the encrypted result G returned by the cloud ERP computing auxiliary module. -1 (f(x1,x2…x m )), for G -1 (f) Perform binary recombination G and decrypt it in matrix form to obtain a result vector containing the encrypted original information. Calculate the result vector again to obtain the plaintext result.

[0045] This invention provides a secure cross-domain data processing method for cloud ERP. The data storage terminal encrypts and transmits the required information from the data receiving terminal to the cloud ERP computing auxiliary module via a key. The computing auxiliary module performs calculations on the encrypted text and makes decisions to obtain a result encrypted text, which is then transmitted to the data storage terminal. The data receiving terminal decrypts the result, thus obtaining the data processing result without knowing the actual data in the data storage terminal. Furthermore, addressing the issue of low data transmission speed caused by multi-party secure computation, this invention designs different targeted multi-party secure computation protocols for different cloud ERP application scenarios, employing different encryption algorithms to process different types of data, and using different data encryption and processing methods. While ensuring data security and personal privacy, it uses the fastest encryption scheme suitable for the application scenario, satisfying users' needs for cloud ERP data processing speed while guaranteeing data security.

[0046] This invention also provides a system for cross-domain processing of secure data in cloud ERP, comprising:

[0047] The data classification module categorizes ERP security data according to set rules and generates keys using corresponding encryption algorithms for different categories of data.

[0048] The encryption module encrypts each independent piece of data in the corresponding category data according to the key, and sends the encrypted ciphertext to the ERP calculation assistance module.

[0049] The ciphertext module performs calculations on the obtained ciphertext to obtain the ciphertext result, and then sends the ciphertext result to the ERP data receiving end.

[0050] The decryption module involves all participants working together to decrypt the ciphertext of the result to obtain the corresponding plaintext.

[0051] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0052] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or function. The processor described in this embodiment of the present invention can be used for cloud ERP secure cross-domain data processing methods.

[0053] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the cloud ERP secure data cross-domain processing method in the above embodiments.

[0054] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0055] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A method for secure cross-domain data processing in cloud ERP systems, characterized in that, Includes the following steps: Step 1: Classify the ERP security data according to the confidentiality level, dividing the security data into ordinary data and confidential data; Step 2: The ordinary data is encrypted using a homomorphic encryption algorithm to generate a key; The fully homomorphic encryption technology used to secure the data generates a key; this key is then used to encrypt each independent data item within the secure data. Encryption is performed using a matrix, and a random matrix is ​​introduced to process the noise vector to obtain ciphertext C. The binary decomposition of ciphertext C is then performed. It is sent as the final encrypted message to the cloud ERP computing assistance module; Step 3: The cloud ERP computing auxiliary module performs homomorphic encryption on the ciphertext of the obtained ordinary data to obtain the result ciphertext of the ordinary data; and performs matrix operation on the final ciphertext of the obtained confidential data, i.e. the binary decomposition state G-1(C), to obtain the result ciphertext of the confidential data. Step 4: Decrypt the ciphertext of the ordinary data result; and reassemble the ciphertext of the confidential data result into binary form, and then decrypt it in matrix form to obtain the corresponding plaintext.

2. The cloud ERP secure cross-domain data processing method according to claim 1, characterized in that, In step 3, the cloud ERP computing auxiliary module performs matrix operations on the encrypted financial data to obtain the encrypted result.

3. The cloud ERP secure cross-domain data processing method according to claim 1, characterized in that, In step 4, all participants use their homomorphic encryption private keys to decrypt the ciphertext of the ordinary data result, obtaining the corresponding plaintext.

4. The cloud ERP secure cross-domain data processing method according to claim 3, characterized in that, In step 4, all participants reassemble the encrypted financial data into binary form and decrypt it in matrix form to obtain a result vector containing the encrypted original information. The plaintext is then obtained based on the result vector.

5. A system for implementing the cloud ERP secure cross-domain data processing method according to any one of claims 1-4, characterized in that, include, The data classification module categorizes ERP security data according to set rules and generates keys using corresponding encryption algorithms for different categories of data. The encryption module encrypts each independent piece of data in the corresponding category data according to the key, and sends the encrypted ciphertext to the ERP calculation assistance module. The ciphertext module performs calculations on the obtained ciphertext to obtain the ciphertext result, and then sends the ciphertext result to the ERP data receiving end. The decryption module involves all participants working together to decrypt the ciphertext of the result to obtain the corresponding plaintext.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the cloud ERP secure data cross-domain processing method as described in any one of claims 1 to 4.

Images