A privacy data-based query method and related device

Abstract

The specification provides a query method based on privacy data and related equipment, applied to a first computing device. The method comprises: obtaining a query statement to be executed, determining the query condition corresponding to the query statement and the data table to be queried; the data table comprises user privacy data held by the first computing device and at least one other computing device participating in multi-party secure calculation; based on a secure out-of-order protocol, the multiple rows of data included in the data table are securely out-of-order processed to obtain a corresponding out-of-order data table; the clear execution result corresponding to the query statement is disclosed, so as to determine the target data in the out-of-order data table that meets the query condition based on the clear execution result, and execute secure calculation based on user privacy data for the target data.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the technical field of data computing, and in particular, to a query method based on privacy data and related equipment. BACKGROUND

[0002] In the era of big data, privacy protection and data security are increasingly valued by all parties. Among them, multi-party secure computing technology can accurately complete the computing task of privacy data without exposing the data, providing strong support for the safe and compliant use of data. SQL is a programming language commonly used in business intelligence (Business Intelligence, BI) scenarios. SQL secure computing can enable users to process data securely using SQL language without being aware of secure computing logic. Among them, using the where clause in SQL language to perform conditional queries to obtain data for subsequent calculations is a common scenario.

[0003] Therefore, how to improve the computing efficiency based on data query, so as to realize efficient and reliable multi-party secure computing is a problem to be solved. SUMMARY

[0004] Therefore, one or more embodiments of the present specification provide a query method based on privacy data and related equipment.

[0005] In a first aspect, the present specification provides a query method based on privacy data, applied to a first computing device, the method comprising:

[0006] obtaining a query statement to be executed, determining the query condition corresponding to the query statement and the data table to be queried; the data table includes user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computing;

[0007] Based on the secure out-of-order protocol, the multiple rows of data included in the data table are securely out-of-order processed to obtain a corresponding out-of-order data table;

[0008] The clear execution result corresponding to the query statement is disclosed, so as to determine the target data in the out-of-order data table that meets the query condition based on the clear execution result, and execute secure computing based on user privacy data for the target data.

[0009] In an illustrative embodiment, the query statement includes a where clause in the SQL database language; the where clause includes the query condition.

[0010] In an illustrated embodiment, the data table includes a share form of data table composed of user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computation.

[0011] In an illustrated embodiment, the method further includes:

[0012] executing the query statement to obtain a share form of condition vector corresponding to the where clause;

[0013] based on the secure out-of-order protocol, performing secure out-of-order processing on a plurality of elements included in the condition vector to obtain a corresponding share form of out-of-order condition vector.

[0014] In an illustrated embodiment, the method further includes:

[0015] After performing secure out-of-order processing on a plurality of rows of data included in the data table to obtain a corresponding out-of-order data table, based on the share form of out-of-order condition vector, a corresponding plaintext out-of-order condition vector is disclosed.

[0016] In an illustrated embodiment, each element in the plaintext out-of-order condition vector is 0 or 1; and based on the plaintext execution result, determining target data in the out-of-order data table that satisfies the query condition includes:

[0017] If the i-th element in the plaintext out-of-order condition vector is 1, then the i-th row of data in the out-of-order data table is determined to be the target data that satisfies the query condition; i is an integer greater than or equal to 1;

[0018] If the i-th element in the plaintext out-of-order condition vector is 0, then the i-th row of data in the out-of-order data table is determined not to satisfy the query condition.

[0019] In an illustrated embodiment, the secure out-of-order protocol includes a secure out-of-order protocol implemented based on a secret sharing algorithm or a homomorphic encryption algorithm.

[0020] In a second aspect, the present specification provides a query device based on privacy data, applied to a first computing device, the device includes:

[0021] an acquisition unit configured to acquire a query statement to be executed, determine a query condition corresponding to the query statement and a data table to be queried; the data table includes user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computation;

[0022] a secure shuffle unit, configured to perform secure shuffle processing on a plurality of rows of data included in the data table based on a secure shuffle protocol, to obtain a corresponding shuffled data table;

[0023] a determination unit, configured to disclose a plaintext execution result corresponding to the query statement, to determine target data in the shuffled data table that satisfies the query condition based on the plaintext execution result, and to perform secure computation based on user privacy data on the target data.

[0024] In an illustrated implementation, the query statement includes a where clause in a SQL database language; and the where clause includes the query condition.

[0025] In an illustrated implementation, the data table includes a shared data table in a share form of user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computation.

[0026] In an illustrated implementation, the apparatus further includes:

[0027] a performing unit, configured to execute the query statement to calculate a condition vector in a share form corresponding to the where clause;

[0028] The secure shuffle unit is specifically configured to:

[0029] perform secure shuffle processing on a plurality of elements included in the condition vector based on the secure shuffle protocol, to obtain a corresponding shuffled condition vector in a share form.

[0030] In an illustrated implementation, the determination unit is specifically configured to:

[0031] after performing secure shuffle processing on a plurality of rows of data included in the data table to obtain a corresponding shuffled data table, disclose a corresponding plaintext shuffled condition vector based on the shuffled condition vector in a share form.

[0032] In an illustrated implementation, each element in the plaintext shuffled condition vector is 0 or 1; and the determination unit is specifically configured to:

[0033] if an i-th element in the plaintext shuffled condition vector is 1, determine an i-th row of data in the shuffled data table as the target data that satisfies the query condition; i is an integer greater than or equal to 1;

[0034] if the i-th element in the plaintext shuffled condition vector is 0, determine that the i-th row of data in the shuffled data table does not satisfy the query condition.

[0035] In one illustrated embodiment, the secure out-of-order protocol includes a secure out-of-order protocol implemented based on a secret-sharing algorithm or a homomorphic encryption algorithm.

[0036] Accordingly, this specification also provides a computing device, including: a memory and a processor; the memory stores a computer program that can be executed by the processor; when the processor executes the computer program, it performs the privacy-based data query method described in the first aspect above.

[0037] Accordingly, this specification also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the privacy-based data query method as described in the first aspect above.

[0038] In summary, in multi-party secure computation scenarios, to prevent the leakage of data from each party and intermediate computation results, computation is typically conducted in a shared state. Consequently, each party holds its own data and intermediate computation results in a shared manner, and no single party can access the complete data. Based on this, when executing a query statement to perform conditional data queries on data held by multiple parties, this application can first use a secure out-of-order protocol to securely out-of-order the data table composed of the first computing device participating in the multi-party secure computation and the user privacy data held by other parties. This scrambles the order of multiple rows of data in the data table, resulting in a corresponding out-of-order data table. Then, this application can directly disclose the plaintext execution result of the query statement, meaning that the computation of this query statement is no longer kept in a shared state. Therefore, based on the disclosed plaintext execution result, data that meets the query conditions can be directly determined from the out-of-order data table. Subsequent calculations only need to be performed based on this data that meets the conditions, while data that does not meet the conditions can be directly removed without participating in subsequent calculations. In this way, since the data table has been security-scrambled, even if the execution result of the query statement is directly disclosed, it does not reveal which rows of data in the original data table actually meet the query conditions. Thus, unnecessary calculations are greatly avoided and calculation efficiency is improved while ensuring the reliability of multi-party secure computation and the security of user privacy data. Attached Figure Description

[0039] Figure 1 This is a flowchart illustrating a query method based on privacy data, provided in an exemplary embodiment.

[0040] Figure 2 This is a schematic diagram of the structure of a privacy-based data query device provided in an exemplary embodiment;

[0041] Figure 3 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Detailed Implementation

[0042] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0043] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0044] Furthermore, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. The collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0045] First, some terms used in this specification will be explained to facilitate understanding by those skilled in the art.

[0046] (1) Secure Multi-Party Computation (SMPC) is used to solve the problem of collaborative computation with privacy protection among a group of mutually distrustful parties. SMPC can ensure the independence of data inputs and the correctness of data computation, while not disclosing the input data to other parties participating in the computation.

[0047] (2) Secret Sharing (SS), also known as secret sharing, is a commonly used security protocol in multi-party secure computation. During multi-party secure computation, to prevent the leakage of data from each party and intermediate computation results, the computation is usually conducted in a shared state. Secret sharing involves dividing secret information (such as data from each party and intermediate computation results) in an appropriate manner and assigning each part to a different participant for management. No single participant can recover the secret information independently; only through collaboration among several participants can the secret information be recovered. Common forms of secret sharing in multi-party secure computation include arithmetic sharing, Boolean sharing, Yao's sharing, etc., which are not specifically limited in this specification.

[0048] (3) Secure out-of-order protocol: Multiple parties involved in secure computation jointly perform secure out-of-order processing on the data they hold, so that none of them know the relationship between the data. In one illustrated embodiment, the secure out-of-order protocol may include a secure out-of-order protocol implemented based on a secret-sharing algorithm or a homomorphic encryption algorithm.

[0049] (4) SQL (Structured Query Language) is a database language with multiple functions such as data manipulation and data definition. SQL is interactive, providing great convenience to users. Database management systems can fully utilize SQL to improve the quality and efficiency of computer application systems. SQL can not only be used independently in terminals, but also as a sub-language to participate in program design with other programming languages, optimizing program functions and providing users with more comprehensive information. SQL is a commonly used programming language in Business Intelligence (BI) scenarios. Business intelligence refers to the technology of querying and extracting effective and valuable information from vast amounts of system data to provide powerful services for the thinking and strategic development of enterprise decision-makers, thereby significantly improving the enterprise's market responsiveness and competitiveness.

[0050] (5) The WHERE clause is a commonly used statement in SQL database language to query data that meets specified conditions. For example, a query statement could be: `SELECT FROM emp WHERE sal>2000 AND sal<3000`. This query statement indicates that the data in the SAL column of the `emp` table is greater than 2000 and less than 3000, where the WHERE clause condition is "sal>2000 AND sal<3000". Another example query statement could be: `SELECT MAX(a) WHERE a>10`. This query statement indicates that among all data where a is greater than 10, the data with the largest 'a' is retrieved, where the WHERE clause condition is "a>10".

[0051] It's important to note that the result of the WHERE clause is typically represented as a 0 / 1 condition vector (where each element is either 0 or 1), used to describe whether the corresponding rows in the data table satisfy the query conditions of the WHERE clause. For example, taking the query "SELECT MAX(a) WHERE a>10" as an example, the result of the WHERE clause could be a vector (0,0,1,1), indicating that the data in rows 3 and 4 of the data table satisfies the query condition "a>10". Alternatively, the result of the WHERE clause could be a vector (1,0,0,1), indicating that the data in rows 1 and 4 of the data table satisfies the query condition "a>10", and so on.

[0052] However, as mentioned above, in multi-party secure computation, to prevent the leakage of data from all parties and intermediate computation results, the computation is usually kept in a shared state. Similarly, to avoid directly revealing which rows of data in the data table satisfy the query conditions of the WHERE clause, thereby protecting user privacy and data security, the computation result of the WHERE clause (such as the vector (0,0,1,1) mentioned above) cannot be directly revealed (or made public) to all parties. Instead, it is generated as a shared vector held by each party, making it impossible for any single party to know the correct and complete computation result of the WHERE clause, thus preventing the direct leakage of the WHERE clause computation result.

[0053] However, in the above scheme, because the calculation results remain in a shared state, the actual calculation result of the WHERE clause is unknown. Therefore, multiple rows of data that do not meet the query conditions of the WHERE clause cannot be directly removed. Instead, they must be processed and continue to participate in subsequent calculations. This adds many unnecessary calculations, resulting in redundancy, complexity, and extremely low efficiency. Furthermore, the processing performed before participating in subsequent calculations differs depending on the conditions of the query statement, further complicating the calculation. For example, after executing the query "select max(a)where a>10", data that does not meet the "a>10" condition cannot be directly removed. Instead, it needs to be copied to the minimum value MIN and continue to participate in subsequent safe calculations. Similarly, after executing the query "select min(a)where a<10", data that does not meet the "a<10" condition cannot be directly removed. Instead, it needs to be copied to the maximum value MAX and continue to participate in subsequent safe calculations.

[0054] It's important to note that for simple queries like "select a where a>10", the execution result itself reveals which rows satisfy the query condition, so directly disclosing the calculation result of the WHERE clause is irrelevant. However, for complex queries such as "select max(a)where a>10" or "select b, max(a)where a>10groupby b", the execution result will only return max(a), without directly revealing which rows satisfy the "a>10" condition. Therefore, in these cases, it's crucial to avoid disclosing the calculation result of the WHERE clause to prevent security risks related to user privacy data leakage.

[0055] Based on this, this specification provides a technical solution that securely shuffles the data held by multiple parties before publicly disclosing the execution results of the query statement. This allows for the direct filtering out of data that does not meet the query conditions based on the publicly disclosed execution results, while only performing subsequent secure calculations on the data that does meet the query conditions. This achieves improved computational efficiency while ensuring secure computation.

[0056] In implementation, this application first obtains the query statement to be executed, determines the query conditions corresponding to the query statement, and the data table to be queried. This data table may include user privacy data held by a first computing device participating in multi-party secure computation and at least one other computing device. Then, this application can perform secure out-of-order processing on multiple rows of data included in the data table based on a secure out-of-order protocol to obtain a corresponding out-of-order data table. Finally, this application can directly disclose the plaintext execution result corresponding to the query statement, and based on this plaintext execution result, determine the target data in the out-of-order data table obtained after the secure out-of-order processing that satisfies the query conditions of the query statement, and only perform secure computation based on user privacy data on this target data.

[0057] In the above technical solution, when executing a query statement to perform conditional data queries on data held by multiple parties, this application can first, based on a secure out-of-order protocol, perform secure out-of-order processing on a data table composed of the first computing device participating in the multi-party secure computation and the user privacy data held by other parties. This scrambles the order of multiple rows of data in the data table, resulting in a corresponding out-of-order data table. Then, this application can directly disclose the plaintext execution result of the query statement, meaning that the computation of this query statement is no longer kept in a shared state. Therefore, based on the disclosed plaintext execution result, data that meets the query conditions can be directly determined from the out-of-order data table. Subsequent calculations only need to be performed based on these data that meet the conditions, while data that does not meet the conditions can be directly removed without participating in subsequent calculations. Thus, since the data table has undergone secure out-of-order processing, even if the execution result of the query statement is directly disclosed, it does not reveal which rows of data in the original data table meet the query conditions. This greatly avoids unnecessary calculations and improves computational efficiency while ensuring the reliability of multi-party secure computation and the security of user privacy data.

[0058] Please see Figure 1 , Figure 1 This is a flowchart illustrating a query method based on privacy data, provided in an exemplary embodiment. Figure 1 As shown, this method can be applied to a first computing device that performs secure multi-party computation. In one illustrated embodiment, the first computing device can be, for example, a smart wearable device, a smartphone, a tablet, a laptop, a desktop computer, an in-vehicle computer, or a server. The first computing device can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center, etc., and this specification does not specifically limit it in this way. Figure 1 As shown, the query method based on privacy data may specifically include the following steps S101-S103.

[0059] Step S101: Obtain the query statement to be executed, and determine the query conditions and the data table to be queried corresponding to the query statement.

[0060] In one illustrated embodiment, in a multi-party secure computation scenario, multiple computing devices participating in the multi-party secure computation can each hold corresponding data. These multiple computing devices can be devices managed under multiple different platforms (or enterprises). The data held by each computing device can be user privacy data it has collected, such as the user's name, gender, age, length of service, income, place of residence, and marital status, etc., which are not specifically limited in this specification. In a multi-party secure computation scenario, the user privacy data held by each computing device can be different, and they will not disclose data to each other.

[0061] For example, platform A is a gaming platform, and the computing devices it manages may hold data such as users' names and ages. For example, platform B is a recruitment platform, and the computing devices it manages may hold data such as users' names, genders, ages, length of service, and places of residence. For example, platform C is a financial services platform, and the computing devices it manages may hold data such as users' names, genders, ages, and incomes. Furthermore, these multiple platforms can participate in multi-party secure computation, such as performing joint data queries under a secret-sharing algorithm, such as jointly querying the length of service of users who meet a certain income range using platforms B and C, etc. This specification does not specifically limit this.

[0062] In one illustrated embodiment, the actual data table consisting of user privacy data held by each of the multiple computing devices participating in multi-party secure computation (e.g., including a first computing device and at least one other computing device) can be shown in Table 1 below.

[0063] Table 1

[0064] ID Income Age 1 1000 20 2 2000 25 3 3000 30

[0065] As shown in Table 1 above, the actual data table includes three rows of data. Each row may include three columns: user ID, income, and age. In one illustrated embodiment, the first computing device participating in the multi-party secure computation could originally hold the ID and income data in Table 1, while other computing devices (e.g., the second computing device) could originally hold the ID and age data in Table 1. Simultaneously, the first and second computing devices do not disclose their respective data to each other. In some possible embodiments, the data shown in Table 1 may also be data held by a single party, such as data held solely by the second computing device.

[0066] In one illustrated implementation, in a multi-party secure computation scenario, to prevent data leakage, the user privacy data held by each of the multiple computing devices participating in the multi-party secure computation can be split into shared data, forming a shared data table. It should be understood that in the shared state, a single party cannot obtain a complete and correct data table; only after multiple parties merge their data can a complete and correct data table be obtained. Taking Table 1 above as an example, in the shared state, the shared data table held by the first computing device can be shown in Table 2 below, and the shared data table held by the second computing device can be shown in Table 3 below. Clearly, merging Table 2 and Table 3 yields Table 1 above.

[0067] Table 2

[0068] ID Income Age 23 1023 22 11 2045 40 19 4096 33

[0069] Table 3

[0070] ID Income Age -22 -23 -2 -9 -45 -15 -16 -1096 -3

[0071] In one illustrated embodiment, during multi-party secure computation, the first computing device and the second computing device can perform joint data queries based on Tables 2 and 3 above in a shared state. Generally, the two parties can agree to perform a series of data queries.

[0072] In one illustrated embodiment, taking a first computing device as an example, the first computing device may first obtain a query statement to be executed. Further, the first computing device may determine the query conditions corresponding to the query statement and the data table to be queried.

[0073] For example, the query statement can be a query statement based on the SQL database language. For example, the query statement can include a WHERE clause in the SQL database language, and the WHERE clause can include the query conditions mentioned above.

[0074] For example, the data table to be queried can be a shared data table as shown in Tables 2 and 3 above, comprising user privacy data held by a first computing device participating in multi-party secure computation and at least one other computing device (e.g., a second computing device). In some possible implementations, the data table to be queried can also be a data table held separately by other computing devices, etc., which are not specifically limited in this specification.

[0075] For example, the query statement to be executed can be "select age max(income)where income>2000group by age", which means querying the age of the user with the highest income among all users with an income greater than 2000, where the query condition of the WHERE clause is "income>2000".

[0076] Furthermore, the first computing device executes the query statement and obtains the execution result of the query statement. It should be understood that, as mentioned above, in the process of multi-party secure computation, in order not to disclose the data of each party and the intermediate computation results, the computation is usually kept in a shared state. Therefore, the execution result of the query statement obtained by the first computing device at this time is the execution result in shared form.

[0077] In one illustrated embodiment, the first computing device executes the query statement, specifically obtaining a calculation result in share form corresponding to the WHERE clause. This share-form calculation result can be a condition vector in share form.

[0078] It should be noted that, as described in the above explanation of terms, in the non-shared state, the plaintext condition vector corresponding to the WHERE clause can include multiple elements, each of which can be 0 or 1. Furthermore, if the i-th element in the plaintext condition vector is 1, it indicates that the i-th row of data in the above data table satisfies the query condition (e.g., "income > 2000"). i is an integer greater than or equal to 1.

[0079] In one illustrated implementation, taking Table 1 above and the query statement "select age max(income)whereincome>2000group by age" as an example, the third row of data in Table 1 satisfies the query condition income>2000. Therefore, the plaintext condition vector obtained by executing this query statement can be v(0, 0, 1). As mentioned above, since the multi-party secure computation is performed in a shared state, the condition vector calculated by the first computing device is actually in shared form. For example, it can include vector v1(1, 2, 4) and vector v2(-1, -2, -3), and it is easy to verify that v1+v2=v. Vector v1(1, 2, 4) can be held by the first computing device, and vector v2(-1, -2, -3) can be held by the second computing device. It should be understood that at this time, the parties participating in the multi-party secure computation only obtain the shared condition vector; the plaintext condition vector is not disclosed to the parties, meaning that the parties do not know which rows of data in the data table satisfy the query condition "income>2000".

[0080] Step S102: Based on the secure out-of-order protocol, perform secure out-of-order processing on the multiple rows of data included in the data table to obtain the corresponding out-of-order data table.

[0081] In one illustrated embodiment, after executing the query statement and obtaining the condition vector in share form corresponding to the WHERE clause, the first computing device can perform secure out-of-order processing on the multiple rows of data included in the data table to be queried based on a secure out-of-order protocol to obtain the corresponding out-of-order data table.

[0082] For example, the first computing device and the second computing device can jointly perform secure out-of-order processing on multiple rows of data included in the share format data tables shown in Tables 2 and 3 above, based on a secure out-of-order protocol, to obtain the out-of-order data table corresponding to Table 2 and the out-of-order data table corresponding to Table 3, respectively.

[0083] For example, the disordered data table corresponding to Table 2 can be shown in Table 4 below. Referring to both Table 2 and Table 4, it can be seen that after the safe disordering process, the order of the second and third rows of data in the original data table has been swapped.

[0084] Table 4

[0085] ID Income Age 23 1023 22 19 4096 33 11 2045 40

[0086] For example, the disordered data table corresponding to Table 3 can be shown in Table 5 below. Referring to both Table 3 and Table 5, it can be seen that after the safe disordering process, the second and third rows of data in the original data table have been swapped.

[0087] Table 5

[0088] ID Income Age -22 -23 -2 -16 -1096 -3 -9 -45 -15

[0089] Accordingly, the actual disordered data table obtained by merging Tables 4 and 5 can be shown in Table 6 below. Referring to Tables 1 and 6 together, it can be seen that after the safe disordering process, the second and third rows of data in the original data table have been swapped.

[0090] Table 6

[0091] ID Income Age 1 1000 20 3 3000 30 2 2000 25

[0092] For example, when Table 1 is a data table held solely by the second computing device, that is, when the data table to be queried is a data table held solely by one party, the first computing device and the second computing device can also jointly perform secure out-of-order processing on the multiple rows of data included in Table 1 based on a secure out-of-order protocol, thereby obtaining out-of-order data tables as shown in Tables 4 and 5 above, respectively.

[0093] Furthermore, in one illustrated embodiment, based on a secure out-of-order protocol, multiple elements included in the calculated share-form condition vector can also be securely out-of-ordered to obtain a corresponding share-form out-of-order condition vector. For example, still using the vectors v1(1, 2, 4) and v2(-1, -2, -3) as examples, multiple elements included in vectors v1(1, 2, 4) and v2(-1, -2, -3) can be securely out-of-ordered to obtain a share-form out-of-order condition vector, such as vector v1'(1, 4, 2) and vector v2'(-1, -3, -2). It can be seen that after secure out-of-order processing, the second and third elements in the original vectors are swapped.

[0094] Generally, the rules for safe out-of-order processing of condition vectors are the same as those for safe out-of-order processing of data tables.

[0095] It should be noted that this specification does not specify the order in which the secure out-of-order processing of the data table and the secure out-of-order processing of the condition vector are executed. In some possible implementations, the condition vector may be processed first, and then the data table may be processed, etc., and this specification does not specify this.

[0096] Furthermore, it should be noted that the first and second computing devices only obtained Tables 4 and 5 and the scrambled condition vector in the form of shares through secure scrambling, but they did not know the specific scrambling rules. This ensures that even if the plaintext condition vector is subsequently made public, it will not reveal which rows of data in the original data table meet the query conditions, thus ensuring the security of user privacy data and the reliability of multi-party secure computation.

[0097] In one illustrated embodiment, the aforementioned secure out-of-order protocol may include a secure out-of-order protocol implemented based on a secret-sharing algorithm or a homomorphic encryption algorithm. In one illustrated embodiment, the secure out-of-order protocol may also be implemented based on other algorithms, which are not specifically limited in this specification.

[0098] The following will illustrate the secure out-of-order algorithm involved in this application through examples.

[0099] In one illustrated implementation, unilateral security out-of-order handling is first explained in the case of unilaterally held data (i.e., the data is not split into share formats).

[0100] First, a third-party server (e.g., a random number distribution server) can generate a random array (p, a, b, d). Here, p represents a disorder rule (or a permutation rule), and p, a, b, d satisfy the following relationship: pa - b = d, where pa represents applying the permutation p to a.

[0101] For example, the specific data p, a, b, and d can be as follows:

[0102] p = [1, 3, 2, 4]

[0103] a = [11, 13, 54, 12]

[0104] pa = [11, 54, 13, 12]

[0105] b = [7, 8, 11, 23]

[0106] d = [4, 46, 2, -11]

[0107] Then, the third-party server can distribute p and d to party 0 (e.g., the first computing device) participating in the multi-party secure computation, and distribute a and b to party 1 (e.g., the second computing device) participating in the multi-party secure computation. At this time, party 0 holds p and d, and party 1 holds a and b; neither party can know the other's data. Meanwhile, party 1 can hold data x, which can be the data table to be queried mentioned above. For example, data x = [100, 200, 300, 400].

[0108] For example, the process of party 0 and party 1 jointly performing secure out-of-order processing on data x is as follows:

[0109] (1) 1 calculates xa = [89,187,246,388] and sends xa to 0. At the same time, let b = y1 = [7,8,11,23].

[0110] (2) 0 receives xa sent by 1 and calculates p(xa)+d=[89,246,187,388]+[4,46,2,-11]=y0=[93,292,198,377].

[0111] At this point, the secure scrambling of data x is complete, and a shared representation of the securely scrambled data x is obtained, including y0 and y1. Among them, party 1 holds the scrambled y1, and party 0 holds the scrambled y0. It is easy to verify that p(y0+y1)=[100,300,200,400]=px.

[0112] In one illustrated implementation, the following will describe a secure out-of-order delivery of data x held by both parties in the form of a share.

[0113] For example, party 0 (e.g., the first computing device) and party 1 (e.g., the second computing device) each hold a share of data x, which can be the data table to be queried (e.g., Table 1 above). Among them, party 0 holds x0 (e.g., Table 2 above), party 1 holds x1 (e.g., Table 3 above), and x = x0 + x1.

[0114] First, two random arrays, (p0, d0, a0, b0) and (p1, d1, a1, b1), are generated by a third-party server (e.g., a random number server). Here, p0 and p1 represent a scrambling rule (or a permutation rule). Furthermore, p0, a0, b0, and d0 satisfy the following relationship: p0(a0) – b0 = d0, where p0(a0) represents applying the scrambling rule p0 to a0. Similarly, p1, a1, b1, and d1 satisfy the following relationship: p1(a1) – b1 = d1, where p1(a1) represents applying the scrambling rule p1 to a1.

[0115] Then, the third-party server can distribute p0, a0, b0, and d0 to party 0 participating in the multi-party secure computation, and distribute p1, a1, b1, and d1 to party 1 participating in the multi-party secure computation. At this point, party 0 holds p0, a0, b0, and d0, and party 0 holds p1, a1, b1, and d1; neither party can know the other's data.

[0116] For example, the process of securely reordering data x (including x0 and x1) in share format jointly by party 0 and party 1 is as follows:

[0117] (1) 1 calculates x1-a1 and sends x1-a1 to 0. At the same time, let r1 = b1.

[0118] (2) 0 receives x1-a1 sent by 1 and calculates r0=p0(x1-a1)+d0+p0(x0).

[0119] (3) 0 calculates r0-a0 and sends r0-a0 to 1. At the same time, let y0 = b0.

[0120] (4) 1 receives r0-a0 sent by 0 and calculates y1=p1(r0-a0)+d1+p1(r1).

[0121] At this point, the secure scrambling of data x in share format has been completed by both parties. Here, y0 (e.g., Table 4 above) is the securely scrambled x0, and y1 (e.g., Table 5 above) is the securely scrambled x1. It is easy to verify that (y0+y1) = p1p0(x0+x1).

[0122] It should be noted that this specification does not specifically limit the algorithm used for secure out-of-order processing. In some possible implementations, this specification may also use any other possible secure out-of-order processing algorithm besides the one described above, such as a secure out-of-order processing algorithm based on g-modules, etc. This specification does not specifically limit this.

[0123] Step S103: Publicly disclose the plaintext execution result corresponding to the query statement, so as to determine the target data in the disordered data table that meets the query conditions based on the plaintext execution result, and perform secure calculation based on user privacy data on the target data.

[0124] In one of the illustrated embodiments, after the secure scrambling of the data table to be queried is completed and the corresponding scrambled data table is obtained, the plaintext execution result corresponding to the above query statement can be directly disclosed. Based on the plaintext execution result, the target data in the above scrambled data table that meets the query conditions can be directly determined, and a secure calculation based on user privacy data can be performed on the target data.

[0125] In one illustrated embodiment, the plaintext execution result corresponding to the query statement may include the plaintext representation corresponding to the shared form of the disordered condition vector, i.e., the disordered condition vector of the plaintext. For example, the shared form of the disordered condition vector may include vector v1'(1, 4, 2) and vector v2'(-1, -3, -2), which can yield the corresponding disordered condition vector v'(0, 1, 0) of the plaintext.

[0126] In one illustrated embodiment, determining the target data in the out-of-order data table that satisfies the query conditions based on the plaintext execution result may include: if the i-th element in the out-of-order condition vector of the plaintext is 1, then the i-th row of data in the out-of-order data table is determined to be the target data that satisfies the query conditions; if the i-th element in the out-of-order condition vector of the plaintext is 0, then the i-th row of data in the out-of-order data table does not satisfy the query conditions. Here, i is an integer greater than or equal to 1.

[0127] For example, taking the query statement "select age max(income)where income>2000group by age" as an example, the securely shuffled tables four and five, and the plaintext shuffled condition vector v'(0,1,0), it can be determined that the second row of data in tables four and five satisfies the query condition "income>2000", while the first and third rows of data in tables four and five do not satisfy the query condition "income>2000". Based on this, the first computing device can continue to perform a series of secure calculations based on user privacy data in a shared state, focusing only on the second row of data in tables four and five, thereby greatly reducing the computational scale and significantly improving computational efficiency.

[0128] It's important to note that directly revealing the plaintext out-of-order condition vector v'(0,1,0) only exposes the result that the second row of data in the out-of-order data table satisfies the query condition to the parties involved in the secure multi-party computation. However, since the parties are unaware of the specific rules governing the out-of-order process—that is, they are unaware that the second row of data in the out-of-order data table actually represents the original row of data—even directly disclosing the plaintext out-of-order condition vector does not reveal the actual calculation result of the WHERE clause, thus protecting the user's privacy and data security.

[0129] In summary, when executing a query statement to perform conditional data queries on data held by multiple parties, this application first uses a secure out-of-order protocol to securely out-of-order the data table consisting of the first computing device participating in the multi-party secure computation and the user privacy data held by other parties. This scrambles the order of multiple rows of data in the data table, resulting in a corresponding out-of-order data table. Then, this application can directly disclose the plaintext execution result of the query statement. That is, the computation of this query statement is no longer shared, allowing the data that meets the query conditions to be directly determined from the out-of-order data table based on the disclosed plaintext execution result. Subsequent calculations only need to be performed based on this data that meets the conditions, while data that does not meet the conditions can be directly removed without participating in subsequent calculations. Thus, because the data table has been securely out-of-ordered, even if the execution result of the query statement is directly disclosed, it does not reveal which rows of data in the original data table actually meet the query conditions. Therefore, while ensuring the reliability of multi-party secure computation and the security of user privacy data, unnecessary calculations are greatly avoided, and computational efficiency is improved.

[0130] Corresponding to the above method and flow implementation, embodiments of this specification also provide a query device based on privacy data, applied to a first computing device. Please refer to... Figure 2 , Figure 2This is a schematic diagram of the structure of a privacy-based data query device provided in an exemplary embodiment. For example... Figure 2 As shown, the device 30 includes:

[0131] The acquisition unit 301 is used to acquire the query statement to be executed, determine the query conditions corresponding to the query statement and the data table to be queried; the data table includes user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computation;

[0132] The secure out-of-order unit 302 is used to perform secure out-of-order processing on multiple rows of data included in the data table based on a secure out-of-order protocol, so as to obtain a corresponding out-of-order data table.

[0133] The determining unit 303 is used to disclose the plaintext execution result corresponding to the query statement, so as to determine the target data in the disordered data table that meets the query conditions based on the plaintext execution result, and perform secure calculations based on user privacy data on the target data.

[0134] In one illustrated implementation, the query statement includes a WHERE clause in the SQL database language; the WHERE clause includes the query conditions.

[0135] In one illustrated embodiment, the data table comprises a shared data table consisting of user privacy data held by the first computing device participating in multi-party secure computation and at least one other computing device.

[0136] In one illustrated embodiment, the device 30 further includes:

[0137] Execution unit 304 is used to execute the query statement and calculate the condition vector in share form corresponding to the WHERE clause;

[0138] The security out-of-order unit 302 is specifically used for:

[0139] Based on the aforementioned secure out-of-order protocol, the multiple elements included in the condition vector are subjected to secure out-of-order processing to obtain the corresponding out-of-order condition vector in share form.

[0140] In one illustrated embodiment, the determining unit 303 is specifically used for:

[0141] After performing secure out-of-order processing on multiple rows of data included in the data table to obtain the corresponding out-of-order data table, the corresponding plaintext out-of-order condition vector is publicly disclosed based on the out-of-order condition vector in the form of a share.

[0142] In one illustrated embodiment, each element in the plaintext disorder condition vector is either 0 or 1; the determining unit 303 is specifically used for:

[0143] If the i-th element in the disordered condition vector of the plaintext is 1, then the i-th row of data in the disordered data table is determined to be the target data that satisfies the query condition; i is an integer greater than or equal to 1.

[0144] If the i-th element in the disordered condition vector of the plaintext is 0, then it is determined that the i-th row of data in the disordered data table does not satisfy the query condition.

[0145] In one illustrated embodiment, the secure out-of-order protocol includes a secure out-of-order protocol implemented based on a secret-sharing algorithm or a homomorphic encryption algorithm.

[0146] For details on the implementation process of the functions and roles of each unit in the aforementioned device 30, please refer to the above. Figure 1 The description of the corresponding embodiments will not be repeated here. It should be understood that the above-described device 30 can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by the CPU (Central Processing Unit) of the device loading the corresponding computer program instructions into memory and running them. From a hardware perspective, in addition to the CPU and memory, the device typically includes other hardware such as chips for wireless signal transmission and reception, and / or other hardware such as boards for implementing network communication functions.

[0147] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the units or modules can be selected to achieve the purpose of the solution described in this specification, depending on actual needs. Those skilled in the art can understand and implement this without any inventive effort.

[0148] The devices, units, and modules described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0149] Corresponding to the above method embodiments, embodiments of this specification also provide a computing device. Please refer to... Figure 3 , Figure 3 This is a schematic diagram of the structure of a computing device provided in an exemplary embodiment. Figure 3 The computing device 1000 shown can be either the first computing device or the second computing device described above. For example... Figure 3 As shown, the computing device 1000 includes a processor 1001 and a memory 1002, and may further include an input device 1004 (e.g., a keyboard) and an output device 1005 (e.g., a display). The processor 1001, memory 1002, input device 1004, and output device 1005 can be connected via a bus or other means. Figure 3 As shown, the memory 1002 includes a computer-readable storage medium 1003 storing a computer program executable by the processor 1001. The processor 1001 may be a general-purpose central processing unit, a microprocessor, or an integrated circuit used to control the execution of the above method embodiments. When running the stored computer program, the processor 1001 can execute various steps of the privacy-based query method in the embodiments of this specification, including: obtaining a query statement to be executed; determining the query conditions corresponding to the query statement and a data table to be queried; the data table includes user privacy data held by the first computing device and at least one other computing device participating in multi-party secure computation; performing secure out-of-order processing on multiple rows of data included in the data table based on a secure out-of-order protocol to obtain a corresponding out-of-order data table; disclosing the plaintext execution result corresponding to the query statement, determining the target data in the out-of-order data table that satisfies the query conditions based on the plaintext execution result, and performing secure computation based on user privacy data on the target data, etc. For a detailed description of each step of the above privacy-based query method, please refer to the previous content; it will not be repeated here.

[0150] Corresponding to the above-described method embodiments, embodiments of this specification also provide a computer-readable storage medium storing computer programs that, when run by a processor, execute the various steps of the privacy-based data query method described in this specification. Please refer to the above for details. Figure 1 The description of the corresponding embodiments will not be repeated here.

[0151] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

[0152] In a typical configuration, a terminal device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0153] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0154] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data.

[0155] Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transient media, such as modulated data signals and carrier waves.

[0156] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0157] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program products implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A query method based on privacy data, applied to a first computing device, the method comprising: Obtain the query statement to be executed, and determine the query conditions and the data table to be queried corresponding to the query statement; The data table includes user privacy data held by the first computing device participating in multi-party secure computation and at least one other computing device; Based on a secure out-of-order protocol, multiple rows of data included in the data table are subjected to secure out-of-order processing to obtain a corresponding out-of-order data table. The plaintext execution result corresponding to the query statement is disclosed, so as to determine the target data in the disordered data table that meets the query conditions based on the plaintext execution result, and to perform secure calculations based on user privacy data on the target data.

2. The method according to claim 1, wherein the query statement includes a WHERE clause in SQL database language; the WHERE clause includes the query conditions.

3. The method according to claim 2, wherein the data table comprises a shared data table consisting of user privacy data held by the first computing device participating in multi-party secure computation and at least one other computing device.

4. The method according to claim 3, further comprising: Execute the query statement to calculate the condition vector in share form corresponding to the WHERE clause; Based on the aforementioned secure out-of-order protocol, the multiple elements included in the condition vector are subjected to secure out-of-order processing to obtain the corresponding out-of-order condition vector in share form.

5. The method according to claim 4, wherein disclosing the plaintext execution result corresponding to the query statement includes: After performing secure out-of-order processing on multiple rows of data included in the data table to obtain the corresponding out-of-order data table, the corresponding plaintext out-of-order condition vector is publicly disclosed based on the out-of-order condition vector in the form of a share.

6. The method according to claim 5, wherein each element in the plaintext disordered condition vector is 0 or 1; The step of determining the target data in the disordered data table that satisfies the query conditions based on the plaintext execution result includes: If the i-th element in the disordered condition vector of the plaintext is 1, then the i-th row of data in the disordered data table is determined to be the target data that satisfies the query condition; i is an integer greater than or equal to 1. If the i-th element in the disordered condition vector of the plaintext is 0, then it is determined that the i-th row of data in the disordered data table does not satisfy the query condition.

7. The method according to any one of claims 1-6, wherein the secure out-of-order protocol includes a secure out-of-order protocol implemented based on a secret sharing algorithm or a homomorphic encryption algorithm.

8. A query device based on privacy data, applied to a first computing device, the device comprising: The acquisition unit is used to acquire the query statement to be executed, and to determine the query conditions and the data table to be queried corresponding to the query statement; The data table includes user privacy data held by the first computing device participating in multi-party secure computation and at least one other computing device; The out-of-order unit is used to perform secure out-of-order processing on multiple rows of data included in the data table based on a secure out-of-order protocol, so as to obtain a corresponding out-of-order data table. The determining unit is used to publicly disclose the plaintext execution result corresponding to the query statement, so as to determine the target data in the disordered data table that meets the query conditions based on the plaintext execution result, and to perform secure calculations based on user privacy data on the target data.

9. A computing device, comprising: Memory and processor; The memory stores computer programs that can be executed by the processor; When the processor runs the computer program, it performs the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the method as claimed in any one of claims 1 to 7.

Images