Data processing method, device, equipment and storage medium

Abstract

The present disclosure provides a data processing method, apparatus, device, and storage medium, relating to the field of secure computing technology. The method includes: obtaining to-be-processed data information based on real-time streaming service data; obtaining processing requirement information based on the to-be-processed data information, and sending the processing requirement information to the second data owner, so that the second data owner obtains the second data according to the processing requirement information and sends data readiness information; receiving the data readiness information, and sending the data readiness information to the first intermediate result queue; in response to obtaining the data readiness information from the first intermediate result queue, converting and processing the first data according to the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information. The method implements multi-party data secure computing in real-time scenarios.

Description

Technical Field

[0001] The present disclosure relates to the field of secure computing, and in particular to a data processing method, device, electronic device, and readable storage medium. Background Art

[0002] In scenarios involving joint data computation across multiple platforms, it's crucial to ensure that user data on each platform remains within the domain, effectively achieving secure multi-party data computation. Some related multi-party data secure computation solutions, such as secure multi-party computation (MPC) and trusted execution environments (TEEs), rely on offline batch processing to perform computations, which cannot meet the needs of real-time scenarios.

[0003] As mentioned above, how to provide a multi-party data secure computing method for real-time scenarios has become an urgent problem to be solved.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure and therefore it may contain information that does not form the prior art that is already known to a person of ordinary skill in the art. Summary of the Invention

[0005] The purpose of the present disclosure is to provide a data processing method, device, electronic device and readable storage medium for realizing multi-party data secure computing in real-time scenarios.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a data processing method is provided, which is applied to a first data owner, the method comprising: obtaining information on data to be processed based on real-time streaming service data, the information on data to be processed comprising processing rule information, processing target information, and information on the first data owner and information on the second data owner, the information on the first data owner comprising first data; obtaining processing requirement information based on the information on data to be processed, and sending the processing requirement information to the second data owner, so that the second data owner obtains second data and sends data readiness information based on the processing requirement information, the processing requirement information comprising the processing rule information and information on the second data owner; receiving the data readiness information, and sending the data readiness information to a first intermediate result queue; in response to obtaining the data readiness information from the first intermediate result queue, converting and processing the first data based on the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner in accordance with a multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information.

[0008] According to an embodiment of the present disclosure, the multi-party secure computing parameter information includes information of a logic circuit and random data, the logic circuit is used to determine whether the input data meets the target corresponding to the processing target information according to the processing rule information, and the random data includes first random data, second random data and third random data; the first data is converted and processed according to the processing rule information and the processing target information, and the multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing according to the second data based on the multi-party secure computing parameter information, including: obtaining information of the logic circuit according to the processing rule information and the processing target information; encrypting the information of the logic circuit to obtain obfuscated circuit information; sending the obfuscated circuit information to the second data owner; according to the first The method further comprises: obtaining the first random data and sending the first random data to the second data owner; obtaining the second random data and the third random data according to the first data; sending the ciphertext of the second random data and the ciphertext of the third random data to the second data owner using the oblivious transfer protocol, so that the second data owner decrypts the second random data, the ciphertext of the second random data and the ciphertext of the third random data according to the second data, and obtains the second random data; decrypting the obfuscation circuit information according to the first random data and the second random data, and obtaining and sending the encrypted information of the judgment result of the logic circuit; the method further comprises: receiving the encrypted information of the judgment result; decrypting the encrypted information of the judgment result according to the obfuscation circuit information, and obtaining the judgment result of the logic circuit with the first data and the second data as the input data.

[0009] According to one embodiment of the present disclosure, the processing rule information includes a multi-party secure computing identifier, and the data readiness information includes the multi-party secure computing identifier; the method also includes: in response to obtaining the data readiness information from the first intermediate result queue, obtaining a logic circuit generation request according to the processing rule information and the processing target information based on the multi-party secure computing identifier, and sending the logic circuit generation request to the first intermediate result queue, the logic circuit generation request includes the multi-party secure computing identifier; obtaining information of the logic circuit according to the processing rule information and the processing target information, including: in response to obtaining the logic circuit generation request from the first intermediate result queue according to the multi-party secure computing identifier, obtaining information of the logic circuit according to the processing rule information and the processing target information.

[0010] According to an embodiment of the present disclosure, the first data is converted and processed according to the processing rule information and the processing target information, and the multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information. It also includes: obtaining an obfuscation circuit generation request according to the information of the logic circuit based on the multi-party secure computing identifier, and sending the obfuscation circuit generation request to the first intermediate result queue, the obfuscation circuit generation request includes the multi-party secure computing identifier; encrypting the information of the logic circuit to obtain the obfuscation circuit information, including: in response to obtaining the obfuscation circuit generation request from the first intermediate result queue according to the multi-party secure computing identifier, encrypting the information of the logic circuit to obtain the obfuscation circuit information.

[0011] According to one embodiment of the present disclosure, the first data is converted and processed according to the processing rule information and the processing target information, and the multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information. It also includes: obtaining an oblivious transfer request based on the second random data and the third random data based on the multi-party secure computing identifier, and sending the oblivious transfer request to the first intermediate result queue, the oblivious transfer request includes the multi-party secure computing identifier; using the oblivious transfer protocol to send the ciphertext of the second random data and the ciphertext of the third random data to the second data owner, including: in response to obtaining the oblivious transfer request from the first intermediate result queue according to the multi-party secure computing identifier, sending the ciphertext of the second random data and the ciphertext of the third random data to the second data owner using the oblivious transfer protocol.

[0012] According to one embodiment of the present disclosure, the logic circuit includes multiple logic gates, and the obfuscated circuit information includes an obfuscation table corresponding to each logic gate; encrypting the information of the logic circuit to obtain the obfuscated circuit information includes: encrypting the information of the multiple logic gates respectively through multiple first execution engines to obtain multiple obfuscation tables, wherein one first execution engine is used to encrypt the information of one logic gate.

[0013] According to one embodiment of the present disclosure, the ciphertext of the second random data and the ciphertext of the third random data are sent to the second data owner using an oblivious transfer protocol, so that the second data owner decrypts according to the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscation circuit information according to the first random data and the second random data, and obtains and sends the encrypted information of the judgment result of the logic circuit, including: using the oblivious transfer protocol to send the ciphertext of the second random data and the ciphertext of the third random data to the second data owner, so that the second data owner obtains a decryption request according to the second data, the ciphertext of the second random data, and the ciphertext of the third random data, sends the decryption request to a second intermediate result queue, and in response to obtaining the decryption request from the second intermediate result queue, decrypts according to the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscation circuit information according to the first random data and the second random data, and obtains and sends the encrypted information of the judgment result of the logic circuit.

[0014] According to one embodiment of the present disclosure, sending the processing requirement information to the second data owner includes: caching the data information to be processed, and sending the processing requirement information to the second data owner through a first proxy service; receiving the data readiness information, and sending the data readiness information to a first intermediate result queue includes: receiving the data readiness information through the first proxy service, and sending the data readiness information to the first intermediate result queue.

[0015] According to an embodiment of the present disclosure, the method further includes: in response to determining that the free computing resources are greater than a preset resource threshold, receiving the data readiness information from the first intermediate result queue.

[0016] According to another aspect of the present disclosure, a data processing device is provided, which is applied to a first data owner, and the device includes: an acquisition module, which is used to acquire information about data to be processed based on real-time streaming business data, the information about the data to be processed includes processing rule information, processing target information, and information about the first data owner and information about the second data owner, and the information about the first data owner includes first data; an acquisition module, which is used to acquire processing requirement information based on the information about the data to be processed, and send the processing requirement information to the second data owner, so that the second data owner acquires the second data according to the processing requirement information and sends data readiness information, the processing requirement information includes the processing rule information and information about the second data owner; a receiving module, which is used to receive the data readiness information and send the data readiness information to a first intermediate result queue; a processing module, which is used to, in response to acquiring the data readiness information from the first intermediate result queue, convert and process the first data according to the processing rule information and the processing target information, and acquire and share multi-party secure computing parameter information with the second data owner in accordance with a multi-party secure computing protocol, so that the second data owner performs secure computing on the second data based on the multi-party secure computing parameter information.

[0017] According to another aspect of the present disclosure, an electronic device is provided, comprising: a memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor implements any of the above methods when executing the executable instructions.

[0018] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which computer-executable instructions are stored. When the executable instructions are executed by a processor, any of the above methods is implemented.

[0019] The data processing method provided by the embodiments of the present disclosure is that the first data owner obtains the data information to be processed including processing rule information, processing target information, and information of the first data owner and the second data owner based on real-time streaming business data, obtains processing requirement information including processing rule information and information of the second data owner based on the data information to be processed, and sends the processing requirement information to the second data owner, so that the second data owner obtains the second data according to the processing requirement information and sends data readiness information. Then, the first data owner receives the data readiness information and sends the data readiness information to the first intermediate result queue. In response to obtaining the data readiness information from the first intermediate result queue, the first data is converted and processed according to the processing rule information and the processing target information, and multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information, thereby realizing multi-party data secure computing in real-time scenarios.

[0020] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail example embodiments thereof with reference to the attached drawings.

[0022] Figure 1 A schematic diagram showing a system structure in an embodiment of the present disclosure.

[0023] Figure 2 A flow chart of a data processing method in an embodiment of the present disclosure is shown.

[0024] Figure 3 Shown Figure 2 FIG. 1 is a schematic diagram of the processing process of steps S204 to S208 in one embodiment.

[0025] Figure 4 Shown Figure 2 FIG. 1 is a schematic diagram of the processing process of step S210 and step S212 in one embodiment.

[0026] Figure 5 is a schematic diagram of a logic circuit according to an exemplary embodiment.

[0027] Figure 6 is based on Figure 5 A schematic diagram of a module package of a logic circuit is shown.

[0028] Figure 7 is based on Figure 6Shown is the truth table of the logic circuit.

[0029] Figure 8 is based on Figures 5 to 7 A schematic diagram of an optimized logic circuit is shown.

[0030] Figure 9 is based on Figure 8 The figure shows a flowchart of obtaining a confusion table for an XNOR gate.

[0031] Figure 10 according to Figures 7 to 9 A schematic diagram of the decryption process of the confusion table is shown.

[0032] Figure 11 Shown Figure 4 FIG. 4 is a schematic diagram of the processing process of step S402 in one embodiment.

[0033] Figure 12 Shown Figure 2 Step 210 and Figure 4 FIG. 4 is a schematic diagram of the processing process of step S404 in one embodiment.

[0034] Figure 13 Shown Figure 2 Steps S210 and S211 shown in Figure 4 FIG. 4 is a schematic diagram of the processing process of step S412 in one embodiment.

[0035] Figure 14 Shown Figure 4 FIG. 4 is a schematic diagram of the processing process of step S414 in one embodiment.

[0036] Figure 15 Shown Figure 4 FIG. 4 is a schematic diagram of the processing process of step S416 in one embodiment.

[0037] Figure 16 is based on Figures 1 to 15 A schematic diagram of a multi-party secure computing process is shown.

[0038] Figure 17 A block diagram of a data processing device in an embodiment of the present disclosure is shown.

[0039] Figure 18 A block diagram showing another data processing device in an embodiment of the present disclosure.

[0040] Figure 19 A schematic structural diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0041] Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these examples are provided so that this disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The accompanying drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. Identical reference numerals in the figures indicate identical or similar parts, and thus repeated descriptions thereof will be omitted.

[0042] In addition, the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, devices, steps, etc. may be adopted. In other cases, well-known structures, methods, devices, implementations or operations are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0043] Furthermore, the terms "first," "second," and the like are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of such features. In the description of this disclosure, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined. The symbol " / " generally indicates an "or" relationship between the preceding and following objects.

[0044] In this disclosure, unless otherwise specified or limited, terms such as "connected" should be interpreted broadly. For example, they can mean electrically connected or capable of mutual communication; they can be directly connected or indirectly connected through an intermediary. Those skilled in the art will understand the specific meanings of these terms in this disclosure based on specific circumstances.

[0045] Some terms involved in this disclosure are explained below.

[0046] Secure Multi-Party Computation (MPC) refers to the process in which each participant uses private data to participate in confidential computing and jointly complete a computing task without disclosing their private data.

[0047] Trusted Execution Environment (TEE) is commonly used for digital rights management (DRM), mobile payments, and sensitive data protection.

[0048] As mentioned above, some scenarios involving joint data computation across multiple platforms require secure multi-party data computation. This means protecting user data on the platform from external leaks while also integrating data from other external platforms for joint analysis and insights. For example, in a scenario involving enterprise membership points / level calculation, one enterprise needs to align its offline (or other platform) membership points / level with that of another enterprise. Membership points / levels depend on several conditions, such as order quantity, order amount, and favorites. The calculation rule might be that if the order volume or order amount of both parties exceeds a certain value (configurable by the enterprise as needed) within a certain period (e.g., this week), the user will receive xx points or be upgraded. However, to protect user data, one enterprise cannot access the order volume and / or order amount details of the user from the other enterprise during that period. Therefore, secure computation is required to perform the corresponding summation and logically determine whether the set rules are met.

[0049] Related technologies for offline multi-party data fusion computing, including MPC and TEE solutions, all rely on offline batch processing by initiating tasks. This currently doesn't address multi-party secure computing in streaming scenarios and doesn't meet the requirements of real-time scenarios. Offline solutions are not only cost-prohibitive but also result in delayed computational results, leading to low computational efficiency. Therefore, a secure multi-party data computing solution for streaming scenarios is urgently needed.

[0050] The present disclosure provides a data processing method, in which a first data owner obtains information about data to be processed based on real-time streaming business data, obtains processing requirement information based on the data to be processed, and sends the processing requirement information to a second data owner, so that the second data owner obtains second data based on the processing requirement information and sends data readiness information. Then, the first data owner receives the data readiness information and sends the data readiness information to a first intermediate result queue. In response to obtaining the data readiness information from the first intermediate result queue, the first data is converted and processed based on processing rule information and processing target information, and multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with a multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information, thereby realizing multi-party data secure computing in real-time scenarios.

[0051] Figure 1 An exemplary system architecture 10 is shown to which the data processing method or data processing apparatus of the present disclosure can be applied.

[0052] like Figure 1As shown, system architecture 10 may include a first data owner on side A and a second data owner on side B. The first data owner may include an execution engine 1022, a proxy service (Proxy) 1024, an intermediate result queue 1026, and a business system 1028, and the second data owner may include an execution engine 1042, a proxy service (Proxy) 1044, an intermediate result queue 1046, and a business system 1048. Server 106 and database 108. Execution engines 1022 and 1042 may be implemented via a processing server, proxy services 1024 and 1044 may be implemented via a proxy server, intermediate result queues 1026 and 1046 may be implemented via a message server, and business systems 1028 and 1048 may be business systems on the same platform, and may respectively include a terminal device and a server connected via a network.

[0053] Terminal devices can be various electronic devices with display screens and support input and output, including but not limited to smartphones, tablet computers, laptops, desktop computers, wearable devices, virtual reality devices, smart homes, etc. A network is a medium used to provide communication links between terminal devices and / or servers. Networks can include various connection types, such as wired or wireless communication links or fiber optic cables. Servers can be servers or server clusters that provide various services. Databases can be large database software located on a server or small database software installed on a computer for storing data.

[0054] The business system 1028 can be used to provide first real-time streaming business data, the execution engine 1022 can be used to obtain data information to be processed based on the real-time streaming business data, and obtain processing requirement information based on the data information to be processed, the Proxy 1024 can be used to send the processing requirement information to the Proxy 1044, the Proxy 1044 can be used to forward the processing requirement information to the execution engine 1042, the execution engine 1042 obtains the second data from the business system 1048 based on the processing requirement information and caches it, and then sends the data readiness information to the Proxy 1024 through the Proxy 1044, the execution engine 1022 sends the data readiness information to the intermediate result queue 1026, the execution engine 1022 obtains the data readiness information from the intermediate result queue 1026, converts and processes the first data based on the processing rule information and the processing target information, obtains and shares the multi-party secure computing parameter information with the execution engine 1042 in accordance with the multi-party secure computing protocol, so that the execution engine 1042 performs secure computing based on the second data based on the multi-party secure computing parameter information.

[0055] It should be understood that, depending on the implementation needs, Figure 1The system can include any number of data owners, and each data owner can set up any number of execution engines.

[0056] Figure 2 FIG. 1 is a flow chart showing a data processing method according to an exemplary embodiment. Figure 2 The method shown can be applied, for example, to Figure 1 The system 10 shown is executed by a first data owner 2002 on the A side and a second data owner 2004 on the B side.

[0057] refer to Figure 2 , the method 20 provided in the embodiment of the present disclosure may include the following steps.

[0058] In step S202, the first data owner 2002 obtains data information to be processed based on real-time streaming service data.

[0059] In some embodiments, the real-time streaming business data may be a data stream of a business system obtained in real time, such as user order data, user clicks, browsing, and other real-time streaming data.

[0060] In some embodiments, after obtaining the real-time streaming business data, the first data owner 2002 can determine whether it is necessary to perform multi-party security calculation on the real-time streaming business data based on the security calculation rules set by the business system. If necessary, the data information to be processed can be obtained from the real-time streaming business data in preparation for multi-party security calculation.

[0061] For example, taking real-time streaming business data as order data, if it is necessary to jointly determine whether the total number of orders of two or more parties within a preset time (such as the last week, month, or year, etc.) exceeds a certain preset value, the data information to be processed can be obtained from the real-time streaming business data and prepared for security calculation.

[0062] In some embodiments, the data information to be processed may include processing rule information, processing target information, information about the first data owner 2002, and information about the second data owner 2004. The processing rule information may include operator information, such as greater than or less than, and the processing target information may be the target of a multi-party secure computation, such as comparing which party's data is larger, or determining whether the sum of multiple parties' data is greater than or less than a preset value. The information about the first data owner 2002 may include first data, such as real-time data provided by a business system, or binary data obtained by binary conversion of the real-time data provided by the business system. The information about the second data owner 2004 may include information to be sent to the second data owner 2004, such as the type and time range of the data to be securely computed, processing rule information, and so on.

[0063] In some embodiments, the processing rule information may include a multi-party secure computing identifier, such as a user identifier, which is used to identify a specific user so that the first data owner 2002 and the second data owner 2004 can obtain relevant data of the same user from the real-time streaming service data.

[0064] For example, still taking the real-time streaming service data as order data as an example, the data information to be processed may include the following:

[0065] {

[0066] User ID: 1 / / Processing rule information

[0067] Operator: greater than / / processing rule information

[0068] Total number of orders on side A: 5 / / Information from the first data owner 2002

[0069] The total number of orders that side B needs to be greater than: 15 / / Process the target information. The goal is to determine whether the total is greater than 20, so the other party is required to be greater than 20-5=15

[0070] B side calculation rules:

[0071] Statistics: Orders

[0072] Data rule: Sum of order quantities

[0073] Time range: xxxx / xx / xx:00:00-xxxx / xx / xx:00:00

[0074] } / / Information of the second data owner 2004,

[0075] }

[0076] In step S204 , the first data owner 2002 obtains processing requirement information according to the data to be processed, and sends the processing requirement information to the second data owner 2004 .

[0077] In some embodiments, the processing requirement information may include processing rule information and information of the second data owner 2004 , that is, the second data owner 2004 does not need to know the first data and / or processing target information of the second data owner 2004 to avoid data leakage of the first data owner 2002 .

[0078] For example, still taking the real-time streaming service data as order data as an example, when the data information to be processed includes the content described in the embodiment of step S202 above, the processing requirement information may include the following content:

[0079] A's execution engine sends the following information to B through the proxy, and caches the above information, waiting for B's return.

[0080] {

[0081] User ID: 1 / / Processing rule information

[0082] Operator: greater than / / processing rule information

[0083] B side calculation rules:

[0084] Statistics: Orders

[0085] Data rule: Sum of order quantities

[0086] Time range: xxxx / xx / xx:00:00-xxxx / xx / xx:00:00

[0087] } / / Information of the second data owner 2004

[0088] }

[0089] In some embodiments, the first data owner 2002 can cache the data information to be processed in the execution engine, and the first data owner 2002 and the second data owner 2004 can communicate through their respective proxy services. For specific implementations, please refer to Figure 3 .

[0090] In step S206 , the second data owner 2004 obtains the second data according to the processing requirement information and sends data ready information.

[0091] In some embodiments, the second data owner 2004 can obtain the second data according to the processing requirement information, cache the second data to the second execution engine, and send the data readiness information to the first data owner 2002 through the second proxy service. For specific implementation, please refer to Figure 3 .

[0092] In some embodiments, the data readiness information may also include a multi-party secure computing identifier for identifying the computing task, such as the user identifier mentioned above.

[0093] In step S208 , the first data owner 2002 receives the data readiness information and sends the data readiness information to the first intermediate result queue.

[0094] In some embodiments, the first data owner 2002 can receive the data readiness information through the first proxy service and send the data readiness information to the first intermediate result queue to wait for the first data owner 2002 to have free resources to obtain and execute subsequent actions. For specific implementation methods, please refer to Figure 3 .

[0095] In step S210, the first data owner 2002, in response to obtaining data readiness information from the first intermediate result queue, converts and processes the first data according to the processing rule information and the processing target information, obtains and shares the multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol.

[0096] In some embodiments, data readiness information may be received from the first intermediate result queue in response to determining that the free computing resources are greater than a preset resource threshold.

[0097] In some embodiments, the execution engine of the first data owner 2002 can perform information conversion based on the first data according to the processing rule information and the processing target information to obtain a final security calculation target, and then obtain multi-party security calculation parameter information based on the final security calculation target. Still using the real-time streaming service data as order data as an example, if the data information to be processed includes the content described in the embodiment of step S202 above, the final security calculation target is to determine the size of the user's order data on side A and side B over a period of time.

[0098] In some embodiments, the multi-party secure computing parameter information may include information of the logic circuit and random data. The logic circuit may be used to determine whether the input data meets the target corresponding to the processing target information based on the processing rule information. The first data owner 2002 may encrypt the logic circuit to obtain an obfuscated circuit. For example, the input data may be the first data and the second data (after binary conversion), and the output of the logic circuit may be the judgment result. The random data may include the first random data, the second random data, and the third random data, which may be used by the second data owner 2004 to decrypt the obfuscated circuit. The process of performing multi-party secure computing based on the logic circuit can be referred to. Figure 4 .

[0099] In step S212 , the second data owner 2004 performs security computing on the second data based on the multi-party security computing parameter information.

[0100] In some embodiments, the first data owner 2002 may send the first random data in the multi-party secure computing parameter information to the second data owner 2004, and transmit the second random data and the third random data in the multi-party secure computing parameter information to the second data owner 2004 via an oblivious transfer protocol, so that the second data owner 2004 can perform secure computing based on the second data. For specific implementation methods, please refer to Figure 4 .

[0101] In related technologies, offline multi-party data fusion calculations are all performed in batches by initiating tasks offline. If applied to real-time stream data processing tasks, it is necessary to solve the security calculation of real-time streams by starting different instance tasks, which is unbearable in terms of resources and greatly reduces processing efficiency.

[0102] According to the data processing method provided by the embodiment of the present disclosure, the first data owner obtains the data information to be processed including processing rule information, processing target information, information of the first data owner and information of the second data owner based on the real-time streaming business data, obtains the processing requirement information including processing rule information and information of the second data owner based on the data information to be processed, and sends the processing requirement information to the second data owner, so that the second data owner obtains the second data according to the processing requirement information and sends data readiness information, then the first data owner receives the data readiness information and sends the data readiness information to the first intermediate result queue, and then in response to obtaining the data readiness information from the first intermediate result queue, converts and processes the first data according to the processing rule information and the processing target information, obtains and shares the multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information, thereby efficiently realizing multi-party data secure computing in real-time scenarios.

[0103] Figure 3 Shown Figure 2 Schematic diagram of the processing process of steps S204 to S208 in one embodiment. Figure 3 As shown, in the embodiment of the present disclosure, the above step S204 may further include the following step S302, the above step S206 may further include the following step S304, and the above step S208 may further include the following step S306.

[0104] In step S302 , the first data owner 2002 caches the data information to be processed in the first execution engine, and sends the processing requirement information to the second data owner 2004 through the first proxy service.

[0105] In step S304 , the second data owner 2004 obtains the second data according to the processing requirement information, caches the second data to the second execution engine, and sends data readiness information to the first data owner 2002 via the second proxy service.

[0106] In some embodiments, the second data may be corresponding data obtained by the second data owner 2004 from the real-time streaming service data of the service system on the local side, or may be binary data obtained by performing binary conversion on the data.

[0107] For example, still taking the real-time streaming business data as order data as an example, when the second data owner 2004 receives the processing requirement information described in the embodiment of the above step S204, it obtains the number of orders of the user corresponding to the user identifier within the time range according to the relevant rules therein, caches it in the execution engine of the second data owner 2004, and sends the data readiness information to the first data owner 2002 through the proxy on this side to notify the first data owner 2002 that the data is ready.

[0108] Step S306: The first data owner 2002 receives data readiness information through the first proxy service, and sends the data readiness information to the first intermediate result queue.

[0109] In some embodiments, after the proxy of the first data owner 2002 receives the notification that the data of the second data owner 2004 is ready, it may not send it directly to the execution engine of the first data owner 2002, but put it into the intermediate result queue to wait for the free resources of the first data owner 2002 to obtain and execute subsequent actions.

[0110] According to the method provided in the embodiment of the present disclosure, the first data owner and the second data owner communicate through a proxy service to prepare data, and put the data readiness information into an intermediate result queue and wait for processing when there are free resources. This can decouple the system architecture and enhance the security and reliability of the system.

[0111] Figure 4 Shown Figure 2 Schematic diagram of the processing process of step S210 and step S212 in one embodiment. Figure 4 As shown, in the embodiment of the present disclosure, the above step S210 may further include the following steps S402 to S412, and the above step S212 may further include the following steps S414 to S418.

[0112] In step S402 , the first data owner 2002 obtains information of the logic circuit according to the processing rule information and the processing target information.

[0113] In some embodiments, the logic circuit may include a plurality of logic gates, and the information of the logic circuit may include an optimized circuit and a corresponding truth table.

[0114] For example, still taking the real-time streaming business data as order data as an example, when the data information to be processed includes the content described in the embodiment of the above step S202, the first data owner 2002 performs information conversion according to the processing rule information and the processing target information, prepares relevant operators, and generates relevant logic circuits according to the "greater than" rule. The process of generating the logic circuit is described below.

[0115] 1) Convert the order data a of the first data owner 2002 (side A) and the order data b of the second data owner 2004 (side B) into binary data as input to the logic circuit:

[0116] a:a n a n-1 a n-2 ...a1

[0117] b:b n b n-1 b n-2 ...b1, where a and b are both positive integers, a i ,b i ∈(0,1), n ​​is a positive integer greater than 1, i∈[1,n].

[0118] 2) Define the variable c i :

[0119]

[0120] Among them, the initial value c0 is 0.

[0121] 3) Given a i 、b i 、c i In this case, derive c i+1 :

[0122]

[0123] 4) Logic circuit conversion. Figure 5 The converted logic circuit diagram is shown in FIG. Figure 5 As shown, the converted logic circuit includes an AND gate 502, an XNOR gate 504, an AND gate 506 and an OR gate 508, and the input is a i and b i , the output is c i+1 .

[0124] 5) Encapsulate into a ">" module. For positive integers a and b, Figure 5 By connecting the logic circuits in series, a complete numerical comparison logic circuit can be formed. Figure 6 is based on Figure 5 The module packaging diagram of a logic circuit is shown in FIG. Figure 6 As shown, the left side is Figure 5 The modularity is n on the right. Figure 5 The modular result of connecting the logic circuits in series, c n+1 is the output of the entire circuit. When the output is 1, a n a n-1 an-2 ...a1>b n b n-1 b n-2 ...b1 holds.

[0125] 6) Obtain the truth table. Figure 7 is based on Figure 6 The truth table of the logic circuit shown is Figure 7 As shown, (a i ,b i ,c i ) includes (0,0,0), (0,0,1), (0,1,0), (0,1,1), (1,0,0), (1,0,1), (1,1,0), (1,1,1), 8 cases, according to Figure 6 The modular logic circuit can obtain the corresponding c for various situations i+1 The value of .

[0126] 7) Perform optimization. Figure 8 is based on Figures 5 to 7 An optimized logic circuit diagram is shown in FIG. Figure 8 As shown, the optimized logic circuit includes XNOR gate 802, XNOR gate 804, AND gate 806 and XNOR gate 808, and the input is a i 、b i and c i , the output is c i+1 .

[0127] In step S404, the first data owner 2002 encrypts the information of the logic circuit to obtain obfuscated circuit information.

[0128] In some embodiments, the garbled circuit information includes a garbled table corresponding to each logic gate.

[0129] For example, still taking the real-time streaming business data as order data, Figure 8 The optimized logic circuit shown in FIG. 8 generates a confusion table by taking the XNOR gate 802 as an example. Figure 9 As shown in the figure, the confusion table generation process of the remaining logic gates is similar and will not be repeated here.

[0130] Figure 9 is based on Figure 8 The following is a flow chart showing the flow of obtaining a confusion table of an XNOR gate. Figure 8 and Figure 9 , the input of the XNOR gate 802 is a0 and c0, and its output is represented as d. First, random characters are generated, and each character in the truth table of the XNOR gate 802 is replaced with the random characters (S902). Then, for the truth table after the random characters are replaced, d is encrypted with a0 and c0 through a symmetric encryption method, and then (random) scrambling is performed to obtain a confusion table.

[0131] In step S406 , the first data owner 2002 sends the garbled circuit information to the second data owner 2004 .

[0132] In step S408 , the first data owner 2002 obtains first random data according to the first data, and sends the first random data to the second data owner 2004 .

[0133] For example, Figure 9 Take the confusion table shown as an example, Figure 10 according to Figures 7 to 9 The following figure shows the decryption process diagram of the confusion table. Figure 10 As shown, the first random data can be X 1 a0 .

[0134] In step S410 , the first data owner 2002 obtains second random data and third random data according to the first data.

[0135] For example, Figure 9 As an example, refer to the confusion table shown in Figure 10 , the second random data can be X 0 b0 , the third random data can be X 1 b0 .

[0136] In step S412, the first data owner 2002 sends the ciphertext of the second random data and the ciphertext of the third random data to the second data owner 2004 using the oblivious transfer protocol.

[0137] For example, Figure 9 As an example, refer to the confusion table shown in Figure 10 , step S1002 is an illustration of the oblivious transmission process.

[0138] In step S414, the second data owner 2004 decrypts the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data.

[0139] In step S416, the second data owner 2004 decrypts the obfuscated circuit information according to the first random data and the second random data to obtain encrypted information of the judgment result of the logic circuit.

[0140] For example, Figure 9 As an example, refer to the confusion table shown in Figure 10 The second data owner 2004 converts the order number into binary second data, and interacts with the first data owner 2002 through the oblivious transfer protocol to decrypt and obtain the corresponding random value (for example, X is obtained). 1a0 、X 0 b0 and X 1 d , but its meaning is unknown, that is, the corresponding values ​​of a0, c0 and d are not obtained). In this way, the confusion table 1000 of all logic gates is decrypted in sequence (S1004) to obtain the final X c1 0 (i.e., the judgment result encrypted information) value, but its meaning is unknown.

[0141] In step S418 , the second data owner 2004 sends the encrypted information of the judgment result to the first data owner 2002 .

[0142] In some embodiments, the second data owner 2004 sends the encrypted information of the judgment result to the first data owner 2002, and the first data owner 2002 can also decrypt it to obtain the judgment result. For details, please refer to step S420.

[0143] In step S420 , the first data owner 2002 decrypts the judgment result encrypted information according to the obfuscation circuit information to obtain the judgment result of the logic circuit with the first data and the second data as input data.

[0144] For example, Figure 9 As an example, refer to the confusion table shown in Figure 10 , the second data owner 2004 will X c1 0 It is sent to the first data owner 2002. After decryption, the first data owner 2002 obtains a result of 0, indicating that the order result of the second data owner 2004 is less than 15, and sends the result of determining the data size on both sides to the second data owner 2004.

[0145] Ultimately, the comparison of the relevant sizes is completed, even though First Data Owner 2002 is unaware of the number of orders placed by Second Data Owner 2004 and Second Data Owner 2004 is unaware of the data First Data Owner 2002 needs to compare. Based on the final results, First Data Owner 2002 learns that the total number of orders placed by User ID 1 is less than 20, thus failing to meet the relevant rules.

[0146] According to the secure computing method provided in the embodiment of the present disclosure, secure computing between the first data owner and the second data owner is achieved through an obfuscation circuit, which can achieve joint analysis, computing, and insight by combining the data of both parties without leaking the user data of both parties.

[0147] In some embodiments, after receiving the request data from the other party, the first data owner and the second data owner can write the request into their respective intermediate result queues. For example, a detailed description of the queues can be as shown in Table 1 below.

[0148] Table 1

[0149]

[0150] Among them, each message (Msg) in the queue includes id, type and info, which respectively represent: id represents the unique id that needs to be fused, such as user id and other information; type represents the request identifier, which can include data preparation requests from both sides, data readiness information ( Figure 3 ), logic circuit generation request ( Figure 11 ), each gate corresponding to the confusion table generation request ( Figure 12 ),OT request( Figure 13 ), interaction result request, and other request types; info includes the detailed content of each request.

[0151] Figure 11 Shown Figure 4 Schematic diagram of the processing process of step S402 in one embodiment. Figure 11 As shown, in the embodiment of the present disclosure, the step S402 performed by the first data owner may further include the following step S1104. The first data owner may also perform step S1102 before step S1104.

[0152] Step S1102, in response to obtaining data readiness information from the first intermediate result queue, obtain a logic circuit generation request based on the multi-party secure computing identifier according to the processing rule information and the processing target information, and send the logic circuit generation request to the first intermediate result queue, where the logic circuit generation request includes the multi-party secure computing identifier.

[0153] Step S1104 : in response to obtaining a logic circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier, obtain information about the logic circuit according to the processing rule information and the processing target information.

[0154] Figure 12 Shown Figure 2 Step 210 and Figure 4 Schematic diagram of the processing process of step S404 in one embodiment. Figure 12 As shown, in the embodiment of the present disclosure, the step S210 performed by the first data owner may further include the following step S1202, and the step S404 performed by the first data owner may further include the following step S1204.

[0155] Step S1202: Obtain an obfuscated circuit generation request based on the multi-party secure computation identifier and the information of the logic circuit, and send the obfuscated circuit generation request to the first intermediate result queue, where the obfuscated circuit generation request includes the multi-party secure computation identifier.

[0156] Step S1204 : In response to obtaining an obfuscation circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier, encrypt the information of the logic circuit to obtain obfuscation circuit information.

[0157] In some embodiments, multiple first execution engines may be used to encrypt information of multiple logic gates respectively to obtain multiple confusion tables, wherein one first execution engine is used to encrypt information of one logic gate.

[0158] Figure 13 Shown Figure 2 Steps S210 and S211 shown in Figure 4 Schematic diagram of the processing process of step S412 in one embodiment. Figure 13 As shown, in the embodiment of the present disclosure, the step S210 performed by the first data owner may further include the following step S1302, and the step S412 performed by the first data owner may further include the following step S1304.

[0159] Step S1302: Oblivious transfer request is obtained according to the second random data and the third random data based on the multi-party secure computation identifier, and the oblivious transfer request is sent to the first intermediate result queue, where the oblivious transfer request includes the multi-party secure computation identifier.

[0160] Step S1304 : in response to obtaining an oblivious transfer request from the first intermediate result queue according to the multi-party secure computation identifier, the ciphertext of the second random data and the ciphertext of the third random data are sent to the second data owner using the oblivious transfer protocol.

[0161] Figure 14 Shown Figure 4 FIG. 4 is a schematic diagram of the processing process of step S414 in one embodiment. Figure 14 As shown, in the embodiment of the present disclosure, the step S414 performed by the second data owner may further include the following steps S1402 and S1404.

[0162] Step S1402: Obtain a first decryption request according to the second data, the ciphertext of the second random data, and the ciphertext of the third random data, and send the first decryption request to the second intermediate result queue.

[0163] Step S1404 , in response to obtaining the first decryption request from the second intermediate result queue, decrypting the second data, the ciphertext of the second random data, and the ciphertext of the third random data according to the second data owner to obtain second random data.

[0164] Figure 15 Shown Figure 4 Schematic diagram of the processing process of step S416 in one embodiment. Figure 15 As shown, in the embodiment of the present disclosure, the step S416 performed by the second data owner may further include the following steps S1502 and S1504.

[0165] Step S1502: Obtain a second decryption request according to the first random data and the second random data, and send the second decryption request to a second intermediate result queue.

[0166] Step S1504 : In response to obtaining a second decryption request from the second intermediate result queue, decrypt the obfuscated circuit information, obtain and send encrypted information of the judgment result of the logic circuit.

[0167] Related technologies use offline methods for secure computing, but in terms of resource management, the resources allocated to each task are fixed, making horizontal expansion difficult. According to the method provided in the embodiments of the present disclosure, by accessing the intermediate result queues of each party, the execution engines on both sides can be deployed in a distributed system, easily supporting horizontal resource expansion.

[0168] Figure 16 is based on Figures 1 to 15 A schematic diagram of a multi-party secure computation process is shown. Figure 16 The multi-party secure computing process may include the following steps S1602 to S1620.

[0169] In step S1602, after obtaining the real-time streaming service data 1600, the first data owner calls the corresponding service system. Specific implementation methods can refer to step S202.

[0170] In step S1604, the first data owner determines whether multi-party secure computation is required for the real-time streaming service data according to the secure computation rules set by the service system. If it is not required, the process ends.

[0171] In step S1606, if it is determined that multi-party secure computation is required for the real-time streaming service data, the first data owner obtains the statistical data and operator information required for computation.

[0172] In step S1608, the first data owner may call the Proxy. Detailed implementation details may refer to step S204.

[0173] In step S1610, the first data owner sends processing requirement information to the second data owner via the proxy to notify the second data owner to prepare relevant data. Specific implementation methods can refer to step S204.

[0174] In step S1612, after the second data owner has prepared the data, the second data owner may call back the Proxy to send a data readiness message to the first data owner. For a specific implementation, please refer to step S206.

[0175] Step S1614: The first data owner cyclically calls the intermediate result queue to implement secure computation with the second data owner. Figures 4 to 15 .

[0176] In step S1616, the second data owner generates a security calculation result (ie, encrypted information of the judgment result). For a specific implementation, please refer to step S416.

[0177] In step S1618, the second data owner sends the security calculation result to the first data owner. For a specific implementation, please refer to step S418.

[0178] In step S1620, the first data owner decrypts the secure computation result, obtains the final result, and shares it with the second data owner. For a specific implementation, please refer to step S420.

[0179] Figure 17 FIG. 1 is a block diagram of a data processing device according to an exemplary embodiment. Figure 17 The device shown can be used, for example, in Figure 1 The system 10 shown is executed by a first data owner.

[0180] refer to Figure 17 The apparatus 170 provided by the embodiment of the present disclosure may include an acquisition module 1702 , an obtaining module 1704 , a receiving module 1706 and a processing module 1708 .

[0181] The acquisition module 1702 can be used to obtain data information to be processed based on real-time streaming service data. The data information to be processed includes processing rule information, processing target information, and information about the first data owner and the second data owner. The information about the first data owner includes the first data.

[0182] The acquisition module 1704 can be used to obtain processing requirement information based on the data to be processed, and send the processing requirement information to the second data owner so that the second data owner can obtain the second data based on the processing requirement information and send data readiness information. The processing requirement information includes processing rule information and information of the second data owner.

[0183] The receiving module 1706 may be configured to receive data readiness information and send the data readiness information to the first intermediate result queue.

[0184] The processing module 1708 can be used to respond to obtaining data readiness information from the first intermediate result queue, convert and process the first data according to the processing rule information and the processing target information, obtain and share the multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner can perform secure computing based on the second data based on the multi-party secure computing parameter information.

[0185] Figure 18 FIG. 1 is a block diagram of a data processing device according to an exemplary embodiment. Figure 18 The device shown can be used, for example, in Figure 1 The system 10 shown is executed by a first data owner.

[0186] refer to Figure 18 The apparatus 180 provided by the embodiment of the present disclosure may include an acquisition module 1802 , an obtaining module 1804 , a sending module 1805 , a receiving module 1806 , a request module 1807 and a processing module 1808 .

[0187] The acquisition module 1802 can be used to obtain data information to be processed based on real-time streaming service data. The data information to be processed includes processing rule information, processing target information, and information about the first data owner and the second data owner. The information about the first data owner includes the first data.

[0188] The processing rule information may include a multi-party secure computation identifier.

[0189] The acquisition module 1804 can be used to obtain processing requirement information based on the data to be processed, and send the processing requirement information to the second data owner so that the second data owner can obtain the second data based on the processing requirement information and send data readiness information. The processing requirement information includes processing rule information and information of the second data owner.

[0190] The sending module 1805 may be configured to cache the data information to be processed and send the processing requirement information to the second data owner through the first proxy service.

[0191] The receiving module 1806 may be configured to receive data readiness information and send the data readiness information to the first intermediate result queue.

[0192] The data readiness information may include a multi-party secure computing identifier.

[0193] The receiving module 1806 may also be configured to receive data readiness information through the first proxy service, and send the data readiness information to the first intermediate result queue.

[0194] The receiving module 1806 may be further configured to receive data readiness information from the first intermediate result queue in response to determining that the free computing resources are greater than a preset resource threshold.

[0195] The request module 1807 can be used to obtain data readiness information from the first intermediate result queue, obtain a logic circuit generation request based on the multi-party secure computing identifier according to the processing rule information and the processing target information, and send the logic circuit generation request to the first intermediate result queue.

[0196] The request module 1807 may also be configured to obtain an obfuscated circuit generation request based on the multi-party secure computing identifier and the information of the logic circuit, and send the obfuscated circuit generation request to the first intermediate result queue, where the obfuscated circuit generation request includes the multi-party secure computing identifier.

[0197] The request module 1807 can also be used to obtain an oblivious transfer request based on the second random data and the third random data based on the multi-party secure computing identifier, and send the oblivious transfer request to the first intermediate result queue, where the oblivious transfer request includes the multi-party secure computing identifier.

[0198] The processing module 1808 can be used to respond to obtaining data readiness information from the first intermediate result queue, convert and process the first data according to the processing rule information and the processing target information, obtain and share the multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner can perform secure computing based on the second data based on the multi-party secure computing parameter information.

[0199] The multi-party secure computation parameter information may include information about a logic circuit and random data. The logic circuit may be used to determine whether input data meets a target corresponding to the processing target information based on the processing rule information. The random data may include first random data, second random data, and third random data.

[0200] The processing module 1808 can also be used to obtain information about the logic circuit based on the processing rule information and the processing target information; encrypt the information about the logic circuit to obtain obfuscated circuit information; send the obfuscated circuit information to the second data owner; obtain first random data based on the first data, and send the first random data to the second data owner; obtain second random data and third random data based on the first data; use the oblivious transfer protocol to send the ciphertext of the second random data and the ciphertext of the third random data to the second data owner, so that the second data owner decrypts the information based on the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscated circuit information based on the first random data and the second random data to obtain and send encrypted information of the judgment result of the logic circuit; the method also includes: receiving the encrypted information of the judgment result; decrypting the encrypted information of the judgment result based on the obfuscated circuit information to obtain the judgment result of the logic circuit with the first data and the second data as input data.

[0201] The logic circuit may include multiple logic gates, and the obfuscated circuit information may include an obfuscation table corresponding to each logic gate.

[0202] The processing module 1808 may also be configured to obtain information about the logic circuit according to the processing rule information and the processing target information in response to obtaining a logic circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier.

[0203] The processing module 1808 may also be configured to, in response to obtaining an obfuscation circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier, encrypt the information of the logic circuit to obtain obfuscation circuit information.

[0204] The processing module 1808 may also be configured to, in response to obtaining an oblivious transfer request from the first intermediate result queue according to the multi-party secure computation identifier, send the ciphertext of the second random data and the ciphertext of the third random data to the second data owner using the oblivious transfer protocol.

[0205] The processing module 1808 may also be configured to encrypt information of multiple logic gates using multiple first execution engines to obtain multiple obfuscation tables, wherein one first execution engine is configured to encrypt information of one logic gate.

[0206] The processing module 1808 can also be used to use the oblivious transfer protocol to send the ciphertext of the second random data and the ciphertext of the third random data to the second data owner, so that the second data owner obtains a decryption request based on the second data, the ciphertext of the second random data and the ciphertext of the third random data, and sends the decryption request to the second intermediate result queue. In response to obtaining the decryption request from the second intermediate result queue, the second data owner decrypts the second data, the ciphertext of the second random data and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscated circuit information based on the first random data and the second random data, and obtains and sends the encrypted information of the judgment result of the logic circuit.

[0207] The specific implementation of each module in the device provided by the embodiment of the present disclosure can refer to the content of the above method and will not be repeated here.

[0208] Figure 19 FIG. 1 shows a schematic diagram of the structure of an electronic device in an embodiment of the present disclosure. It should be noted that: Figure 19 The device shown is only an example of a computer system and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0209] like Figure 19 As shown, the device 1900 includes a central processing unit (CPU) 1901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1902 or a program loaded from a storage portion 1908 into a random access memory (RAM) 1903. Various programs and data required for the operation of the device 1900 are also stored in the RAM 1903. The CPU 1901, the ROM 1902, and the RAM 1903 are connected to each other via a bus 1904. An input / output (I / O) interface 1905 is also connected to the bus 1904.

[0210] The following components are connected to the I / O interface 1905: an input section 1906 including a keyboard, a mouse, and the like; an output section 1907 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 1908 including a hard disk; and a communication section 1909 including a network interface card such as a LAN card or a modem. The communication section 1909 performs communication processing via a network such as the Internet. A drive 1910 is also connected to the I / O interface 1905 as needed. Removable media 1911, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1910 as needed, so that computer programs read therefrom can be installed in the storage section 1908 as needed.

[0211] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1909, and / or installed from a removable medium 1911. When the computer program is executed by the central processing unit (CPU) 1901, the above-mentioned functions defined in the system of the present disclosure are performed.

[0212] It should be noted that the computer-readable medium described in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber cable, RF, or any suitable combination thereof.

[0213] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0214] The modules described in the embodiments of the present disclosure may be implemented in software or hardware. The modules described may also be provided in a processor. For example, they may be described as follows: a processor includes an acquisition module, an acquisition module, a receiving module, and a processing module. The names of these modules do not, in some cases, limit the modules themselves. For example, the acquisition module may also be described as a "module for acquiring data information to be processed."

[0215] As another aspect, the present disclosure further provides a computer-readable medium, which may be included in the device described in the above embodiments; or may exist independently and not be incorporated into the device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the device, the device includes:

[0216] Obtaining information on data to be processed based on real-time streaming business data, the information on data to be processed includes processing rule information, processing target information, and information on the first data owner and the second data owner, the information on the first data owner including the first data; obtaining processing requirement information based on the information on data to be processed, and sending the processing requirement information to the second data owner, so that the second data owner obtains the second data according to the processing requirement information and sends data readiness information, the processing requirement information includes processing rule information and information on the second data owner; receiving the data readiness information, and sending the data readiness information to the first intermediate result queue; in response to obtaining the data readiness information from the first intermediate result queue, converting and processing the first data according to the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing based on the second data based on the multi-party secure computing parameter information.

[0217] While the exemplary embodiments of the present disclosure have been specifically illustrated and described above, it should be understood that the present disclosure is not limited to the detailed structures, configurations, or implementations described herein; rather, the present disclosure is intended to encompass various modifications and equivalent configurations within the spirit and scope of the appended claims.

Claims

1. A data processing method, characterized in that: Applied to the first data owner, the method includes: Acquire to-be-processed data information according to the real-time streaming service data, wherein the to-be-processed data information includes processing rule information, processing target information, and information about the first data owner and the second data owner, wherein the information about the first data owner includes the first data; Obtaining processing requirement information according to the information about the data to be processed, and sending the processing requirement information to the second data owner, so that the second data owner obtains the second data according to the processing requirement information and sends data readiness information, wherein the processing requirement information includes the processing rule information and information about the second data owner; receiving the data ready information, and sending the data ready information to a first intermediate result queue; In response to obtaining the data readiness information from the first intermediate result queue, the first data is converted and processed according to the processing rule information and the processing target information, and multi-party secure computing parameter information is obtained and shared with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner performs secure computing according to the second data based on the multi-party secure computing parameter information.

2. The method according to claim 1, characterized in that The multi-party secure computing parameter information includes information of a logic circuit and random data, wherein the logic circuit is used to determine whether input data meets a target corresponding to the processing target information according to the processing rule information, and the random data includes first random data, second random data, and third random data; The method includes: performing conversion processing on the first data according to the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner according to a multi-party secure computing protocol, so that the second data owner performs secure computing on the second data based on the multi-party secure computing parameter information, and obtaining information of the logic circuit according to the processing rule information and the processing target information; Encrypting the information of the logic circuit to obtain obfuscated circuit information; Sending the obfuscation circuit information to the second data owner; Obtaining the first random data according to the first data, and sending the first random data to the second data owner; Obtain the second random data and the third random data according to the first data; Sending the ciphertext of the second random data and the ciphertext of the third random data to the second data owner using the oblivious transfer protocol, so that the second data owner decrypts the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscated circuit information based on the first random data and the second random data to obtain and send encrypted information of the judgment result of the logic circuit; The method further comprises: Receiving the encrypted information of the judgment result; The judgment result encrypted information is decrypted according to the obfuscation circuit information to obtain a judgment result of the logic circuit with the first data and the second data as the input data.

3. The method according to claim 2, characterized in that The processing rule information includes a multi-party secure computing identifier, and the data readiness information includes the multi-party secure computing identifier; The method further comprises: In response to obtaining the data readiness information from the first intermediate result queue, obtaining a logic circuit generation request based on the multi-party secure computation identifier according to the processing rule information and the processing target information, and sending the logic circuit generation request to the first intermediate result queue, wherein the logic circuit generation request includes the multi-party secure computation identifier; Obtaining information about the logic circuit according to the processing rule information and the processing target information includes: In response to obtaining the logic circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier, information about the logic circuit is obtained according to the processing rule information and the processing target information.

4. The method according to claim 2, characterized in that The method further includes: converting the first data according to the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner according to a multi-party secure computing protocol, so that the second data owner performs secure computing on the second data based on the multi-party secure computing parameter information; Obtaining an obfuscation circuit generation request based on the multi-party secure computation identifier and the information of the logic circuit, and sending the obfuscation circuit generation request to the first intermediate result queue, wherein the obfuscation circuit generation request includes the multi-party secure computation identifier; Encrypting the information of the logic circuit to obtain obfuscated circuit information includes: In response to obtaining the obfuscation circuit generation request from the first intermediate result queue according to the multi-party secure computation identifier, the information of the logic circuit is encrypted to obtain the obfuscation circuit information.

5. The method according to claim 2, characterized in that The method further includes: converting the first data according to the processing rule information and the processing target information, obtaining and sharing multi-party secure computing parameter information with the second data owner according to a multi-party secure computing protocol, so that the second data owner performs secure computing on the second data based on the multi-party secure computing parameter information; Obtaining an oblivious transfer request according to the second random data and the third random data based on a multi-party secure computation identifier, and sending the oblivious transfer request to the first intermediate result queue, where the oblivious transfer request includes the multi-party secure computation identifier; The method of sending the ciphertext of the second random data and the ciphertext of the third random data to the second data owner by using the oblivious transfer protocol includes: In response to obtaining the oblivious transfer request from the first intermediate result queue according to the multi-party secure computation identifier, the ciphertext of the second random data and the ciphertext of the third random data are sent to the second data owner using an oblivious transfer protocol.

6. The method according to claim 2, characterized in that The logic circuit includes a plurality of logic gates, and the obfuscation circuit information includes an obfuscation table corresponding to each logic gate; Encrypting the information of the logic circuit to obtain obfuscated circuit information includes: The information of the plurality of logic gates is respectively encrypted by a plurality of first execution engines to obtain a plurality of confusion tables, wherein one first execution engine is used to encrypt the information of one logic gate.

7. The method according to claim 2, characterized in that The method includes: sending the ciphertext of the second random data and the ciphertext of the third random data to the second data owner by using the oblivious transfer protocol, so that the second data owner decrypts the second data, the ciphertext of the second random data, and the ciphertext of the third random data to obtain the second random data, decrypts the obfuscated circuit information according to the first random data and the second random data, and obtains and sends the encrypted information of the judgment result of the logic circuit, including: The ciphertext of the second random data and the ciphertext of the third random data are sent to the second data owner by using the oblivious transfer protocol, so that the second data owner obtains a decryption request based on the second data, the ciphertext of the second random data and the ciphertext of the third random data, and sends the decryption request to the second intermediate result queue. In response to obtaining the decryption request from the second intermediate result queue, the second data owner decrypts the second data, the ciphertext of the second random data and the ciphertext of the third random data to obtain the second random data, and decrypts the obfuscated circuit information based on the first random data and the second random data, and obtains and sends the encrypted information of the judgment result of the logic circuit.

8. The method according to claim 1, characterized in that Sending the processing requirement information to the second data owner includes: caching the data information to be processed, and sending the processing requirement information to the second data owner through the first proxy service; Receiving the data readiness information and sending the data readiness information to the first intermediate result queue includes: The data readiness information is received through the first proxy service, and the data readiness information is sent to the first intermediate result queue.

9. The method according to claim 1, characterized in that Also includes: In response to determining that the free computing resources are greater than a preset resource threshold, the data readiness information is received from the first intermediate result queue.

10. A data processing device, characterized in that: Applied to a first data owner, the device includes: an acquisition module, configured to acquire information about data to be processed based on real-time streaming service data, wherein the information about the data to be processed includes processing rule information, processing target information, information about the first data owner, and information about the second data owner, wherein the information about the first data owner includes first data; an obtaining module, configured to obtain processing requirement information based on the to-be-processed data information, and send the processing requirement information to the second data owner, so that the second data owner obtains the second data based on the processing requirement information and sends data readiness information, wherein the processing requirement information includes the processing rule information and information about the second data owner; A receiving module, configured to receive the data readiness information and send the data readiness information to a first intermediate result queue; A processing module is used to, in response to obtaining the data readiness information from the first intermediate result queue, convert and process the first data according to the processing rule information and the processing target information, obtain and share multi-party secure computing parameter information with the second data owner in accordance with the multi-party secure computing protocol, so that the second data owner can perform secure computing according to the second data based on the multi-party secure computing parameter information.

11. An electronic device comprising: A memory, a processor, and executable instructions stored in the memory and executable in the processor, wherein the processor implements the method according to any one of claims 1 to 9 when executing the executable instructions.

12. A computer-readable storage medium having computer-executable instructions stored thereon, characterized in that: When the executable instructions are executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images