A data protection method based on two-level privacy intersection

Abstract

The present invention relates to the field of data circulation, and specifically to a data protection method based on secondary privacy intersection. In order to solve the data interaction security problem between the two parties in joint data analysis and modeling, it is necessary to protect the data security and privacy of both parties, reduce the interaction cost, and provide modeling engineers with familiar platforms and tools. The invention includes two parts: the first part is that the two parties use privacy pan intersection on their respective data primary keys to obtain a superset larger than the true intersection, and the size of the superset can be controlled by an algorithm; the second part is based on the primary key intersection obtained in the first part, and the two parties are associated with their respective data sets through the primary key intersection, which is imported into the security server after encryption to perform secondary data intersection to obtain a wide table, so that joint data analysis and modeling can be carried out. Finally, only statistical data and models can be taken out from the security server, and all data are destroyed.

Description

Technical Field

[0001] The present invention relates to the field of data circulation, and in particular to a data protection method based on secondary privacy intersection. Background Art

[0002] In the field of data circulation, there are often scenarios where two companies or institutions need to do joint data modeling. Although there are now technical means such as federated learning that allow both parties to do federated data analysis and modeling without exposing their data to each other, thus achieving the goal of "data does not move, model moves", federated learning also has many shortcomings and deficiencies: 1. High communication overhead and complex deployment: The federated learning platform needs to deploy nodes with various functional roles at multiple participants. During the modeling process, model parameter updates require frequent communication with each participant, resulting in high communication overhead; 2. Poor interpretability: Since the model parameters are stored at multiple participants, the overall operating logic of the model is not transparent enough, resulting in poor interpretability of the model; 3. Complex algorithms: Compared with traditional centralized learning algorithms, federated learning algorithms are relatively more complex and difficult to implement and debug; 4. It does not conform to the work experience and habits of modeling engineers: Federated learning is essentially an encrypted distributed learning model. Modeling engineers are not familiar with this modeling method, and the platform cannot provide the various data analysis and modeling tools required by modeling engineers; 5. High cost of use: Using commercial federated learning platforms is expensive. Therefore, the shortcomings of federated learning listed above make the technical and business personnel of each participating party reluctant to use federated learning for modeling, greatly reducing the willingness of both parties to jointly model.

[0003] In addition to the federated learning platform, another security technology and device to ensure federated data modeling is the trusted computing node TEE. As a secure hardware technology, the trusted execution environment (TEE) can provide a secure computing environment to protect data and code from malware and physical attacks. However, TEE also has some disadvantages or shortcomings: 1. Complexity: Designing, implementing and maintaining TEE technology requires quite high technical requirements, which is complex for developers and administrators; 2. Performance overhead: The use of TEE technology may introduce additional performance overhead, including memory consumption, computing delay, etc., which affects the overall performance of the system; 3. High dependence: Because TEE technology relies on specific hardware support, TEE cannot be implemented on devices that do not have corresponding hardware support, which limits its scope of application; 4. Scalability limitations: Some TEE implementations may have scalability limitations, making it difficult to manage and maintain when deployed on a large scale; 5. Standardization and interoperability: There is a lack of trusted certification standards in China, and TEE solutions from different manufacturers may have inconsistent standards or interoperability issues, resulting in difficulties in cross-platform applications; 6. High cost of use: The use of commercial TEE devices is expensive. The various shortcomings of TEE listed above have greatly reduced the willingness of all parties involved to use TEE for joint modeling. Summary of the invention

[0004] The technical problem solved by the present invention is to provide a data protection method based on secondary privacy intersection, which can solve the scenario where both companies are unwilling to use the federated learning platform and trusted computing node TEE for joint modeling, thereby promoting more companies or institutions to carry out joint modeling.

[0005] The basic solution provided by the present invention is a data protection method based on secondary privacy intersection. The present invention is aimed at the scenario where both parties need to use their own data for joint modeling during data flow and are unwilling to use federated learning and TEE. First, a privacy general intersection is performed through the primary keys of both parties' data, and then each party uses the general intersection primary key to retrieve their own data set. The associated data set is encrypted and imported into the secure server for secondary precise intersection to ensure joint data analysis and modeling under the premise of data security. In real business scenarios, two companies or institutions have scenarios where they want to conduct data cooperation to optimize or expand their business, but they are restricted by the high cost of federated learning and TEE and the inconvenience of deployment and use, and cannot really promote implementation. The present invention can solve this pain point.

[0006] The present invention is implemented by the following technical solution: a data protection method based on secondary privacy intersection, comprising the following steps:

[0007] From S1 to S9 is the first stage of the privacy pan-intersection step of the present invention. The purpose of the first stage is to obtain a controllable superset of the intersection of the data primary keys of the two parties in the joint modeling through the privacy pan-intersection in an unsafe environment. This is the most critical invention point in the present invention. For irrelevant outsiders, even if they steal all the data primary keys in the intersection process, they cannot crack it. For the two parties in the joint modeling, they cannot crack other data primary keys except this superset in the intersection process. Specifically, in this stage, the two parties agree on the data primary key, and perform the privacy pan-intersection algorithm on the primary key to obtain a primary key superset of the intersection of the two parties' data. This superset is larger than the real primary key intersection of the two parties, but much smaller than the full set. Data pan-intersection has two advantages: first, the result data set after pan-intersection greatly reduces the amount of data required for data joint modeling, so that all the business data of both parties do not need to be imported into the subsequent server; second, both companies or institutions do not want the other party to fully understand their business structure. If this intersection is very accurate, the party with a smaller amount of data will think that its business structure has been exposed in front of the cooperative company. These two advantages can greatly dispel the doubts of both parties and promote cooperation between the two parties. The privacy-preserving intersection can be designed based on the elliptic curve algorithm and Bloom filter, or based on the RSA algorithm and Bloom filter. The size of the superset can be more accurately controlled by adjusting the parameters of the Bloom filter.

[0008] As shown in the attached figure of the instruction manual Figure 1 As shown:

[0009] S1: The two parties agree on the data master key and data encryption algorithm to be submitted. The data encryption algorithm needs to meet the conditions of double encryption, that is, using two different keys to encrypt twice. The final ciphertext and the order in which the keys are used are irrelevant.

[0010] S2: The two parties agree on the expansion coefficient f of the privacy-preserving intersection, which is defined as the intersection cardinality of the preserving intersection / the cardinality of the real intersection. The Bloom filter has a controllable false positive error rate e, which can be derived from the preset expansion coefficient. The calculation formula is e=f-1, that is, the expansion coefficient minus 1;

[0011] S3: The two parties estimate the length m of the Bloom filter binary vector and the number k of hash functions based on the estimated false positive error rate e of the Bloom filter and the sum of the sizes of the data sets that the two parties will request to exchange, where m is equal to "-1.44nlog2e" rounded up, and k is equal to "0.6931m / n" rounded up;

[0012] S4: Partner A generates the key Ka of the data encryption algorithm, and uses the key to encrypt the primary key set D(A)=[X1,X2,...,Xn] of its own data set, and obtains the encrypted ciphertext primary key set Ea(A)=[Ea(X1),Ea(X2),...,Ea(Xn)] of its own party, retains the one-to-one corresponding sequential mapping relationship between the plaintext primary key set D(A) and the ciphertext primary key set Ea(A), and then sends the encrypted data primary key set Ea(A) to partner B;

[0013] S5: Partner B generates a key Kb of the data encryption algorithm, and uses the key to encrypt the primary key set D(B)=[Y1,Y2,...,Ym] of its own data set, and obtains the encrypted primary key set Eb(B)=[Eb(Y1),Eb(Y2),...,Eb(Ym)] of its own ciphertext, and then maps the ciphertext primary key set Eb(B) to the binary vector of the Bloom filter, which is represented by BF(Eb(B));

[0014] S6: After receiving the ciphertext primary key set Ea(A) from partner A, partner B uses the key Kb for secondary encryption to obtain the secondary encrypted ciphertext primary key set Eab(A)=[Eab(X1), Eab(X2), ..., Eab(Xn)], and then sends the Bloom filter binary vector BF(Eb(B)) in step S5 and partner A's secondary ciphertext primary key set Eab(A) to partner A;

[0015] S7: After receiving the secondary ciphertext primary key set Eab(A) and the Bloom filter binary vector BF(Eb(B)) from partner B, partner A first uses its own key a to decrypt, thereby obtaining the ciphertext primary key set Eb(A) encrypted only with partner B's key, and then traverses each ciphertext primary key value in the ciphertext primary key set Eb(A), and checks whether it hits in the Bloom filter binary vector BF(Eb(B)), and if it hits, puts the ciphertext primary key value into the general intersection ciphertext set Eb(A∩B);

[0016] S8: There is a one-to-one correspondence between the positions of the elements in the ciphertext primary key set Eb(A) and the plaintext primary key set D(A) of partner A. Therefore, partner A uses this position mapping relationship to obtain the generalized intersection plaintext primary key set D(A)∩D(B) from Eb(A∩B), and then obtains the associated plaintext data set M(A) based on the generalized intersection plaintext primary key set D(A)∩D(B). M(A) contains the intersection primary key field and other required fields.

[0017] S9: Partner A sends the pan-intersection plaintext primary key set D(A)∩D(B) of both parties to partner B on a secure channel. After receiving it, partner B obtains the associated plaintext data set M(B) based on the pan-intersection plaintext primary key set D(A)∩D(B). M(B) contains the intersection primary key field and other required fields.

[0018] From S10 to S15 is the second stage data intersection step of the present invention. In this stage, both parties use the pan-intersection primary key obtained in the first stage to associate their respective data sets, and then encrypt their associated data sets and import them into the secure server. All subsequent operations are in this secure environment. Specifically, after both parties obtain the pan-intersection primary key set, they each retrieve the data set associated with the primary key. This data set is the real pan-intersection data set. The pan-intersection data set is encrypted respectively, and then the pan-intersection data set is imported into a secure server accessible to both parties. The modelers of both parties can enter the server through the remote desktop and strict account management. Before modeling, they must inform each other to decrypt their respective pan-intersection data sets. For example, if the modeler of Company A logs in to the server first, he first uses his own key to decrypt his own data set, and then notifies Company B. The modeler of Company B also logs in to the server and uses his own key to decrypt his own part of the data set. If Company B uses the data, it must also go through the same steps. Then the modeler of Company A or Company B can make accurate intersection of the plaintext data sets of the pan-intersection of both parties, and carry out a series of subsequent data analysis and modeling work. Modelers from both parties carry out their work in this secure server. Apart from the fact that they are under security control and cannot access the external network or export data using a USB flash drive, other working methods are consistent with the software environment and methods they are familiar with, including commonly used modeling tools and software libraries.

[0019] As shown in the attached figure of the instruction manual Figure 2 As shown:

[0020] S10: Partner A generates a public-private key pair using an asymmetric encryption algorithm ( , ), and then use the public key pka to encrypt the data set M(A) to obtain the ciphertext data set Ca(A); here, a symmetric encryption algorithm can also be used to generate a symmetric key keya to encrypt the data set M(A) to obtain the ciphertext data set Ca(A);

[0021] S11: Partner B generates a public-private key pair using an asymmetric encryption algorithm ( , ), and then use the public key pkb to encrypt the data set M(B) to obtain the ciphertext data set Cb(B); here, a symmetric encryption algorithm can also be used to generate a symmetric key keyb to encrypt the data set M(B) to obtain the ciphertext data set Cb(B);

[0022] S12: Prepare a secure server that both parties can access.

[0023] S13: Partner A imports its ciphertext data set Ca(A) into the secure server, and partner B imports its ciphertext data set Cb(B) into the secure server;

[0024] S14: If partner A wants to do joint data analysis and modeling, he should first log in to the security server and use his own key ska or keya to decrypt his own data to get M(A), then notify partner B to log in to the security server. After logging in, partner B uses his own private key skb or keyb to decrypt his own data to get M(B). At this time, partner A can use the primary key to perform a secondary intersection on M(A) and M(B) in the server to get the accurate data intersection M(A)∩M(B), that is, a wide table that combines all fields of both parties. Then, he can use various data analysis and modeling tools installed on the server to carry out the work, and the analysis results can be encrypted with partner A's key pka or keya. If partner B wants to do joint data analysis and modeling, he should also perform the above steps;

[0025] S15: If partner A completes a data analysis and modeling, before exiting the security server, first delete the plaintext data intersection M(A)∩M(B) of both parties, then use its own key pka or keya to encrypt its own plaintext data M(A) to obtain the ciphertext data set Ca(A), and then notify partner B to log in online. After partner B logs in, it uses its own key pkb or keyb to encrypt its own plaintext data M(B) to obtain the ciphertext data set Cb(B). Similarly, if partner B completes a data analysis and modeling, the above steps must also be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of a first-stage pan-intersection framework in an embodiment of a data protection method based on secondary privacy intersection of the present invention;

[0027] Figure 2 It is a schematic diagram of a second data intersection frame in an embodiment of a data protection method based on secondary privacy intersection of the present invention. DETAILED DESCRIPTION

[0028] The following is further described in detail through specific implementation methods:

[0029] The embodiment is basically as shown in the attached Figure 1 As shown:

[0030] A data protection method based on secondary privacy intersection, the specific process of step S1 is as follows:

[0031] S1-1: The two parties agree on the primary key for the intersection of data sets, and agree to use the elliptic curve algorithm for the first-level privacy intersection data encryption, and the RSA algorithm for the second-level privacy intersection data encryption;

[0032] S1-2: The two parties select an elliptic curve over a finite field, represented by Ep(a,b), where the finite field Fp is the field of integers modulo p, p is a prime number, a and b are the parameters of the elliptic curve, and the elliptic curve is a set of points that satisfy the equation {(x,y)|y2=x3+ax+b, where 4a3+27b2≠0}. The elliptic curve over the finite field limits the range of values ​​of x and y, that is, x and y must be taken from the finite field Fp;

[0033] S2: The two parties agree on the expansion coefficient f for the first privacy-prevalent intersection, which is defined as the intersection cardinality of the universal intersection / the cardinality of the real intersection. A Bloom filter is used to perform the first privacy-prevalent intersection. The Bloom filter has a controllable false positive error rate e. The required false positive error rate e can be derived based on the preset expansion coefficient. The calculation formula is e=f-1, that is, the expansion coefficient minus 1;

[0034] S3: The two parties estimate the length m of the Bloom filter binary vector and the number k of hash functions based on the estimated false positive error rate e of the Bloom filter and the sum of the sizes of the data sets that both parties will need to exchange, where m = "-1.44nlog2e" rounded up, and k = "0.6931m / n" rounded up. Then the two parties agree on k different hash functions.

[0035] In this embodiment, the specific process of step S4 is as follows:

[0036] S4-1: Partner A randomly selects a large positive integer a from the finite field Fp as the key Ka. The principle is based on the discrete logarithm problem on the elliptic curve. That is, given an elliptic curve E and points P and Q on it, where Q=k×P, × represents the multiplication calculation defined on the elliptic curve, it can be proved that it is very difficult to reversely calculate the positive integer k when P and Q are known;

[0037] S4-2: Partner A encodes the primary key set D(A)=[X1,X2,...,Xn] of its data set onto the elliptic curve of the finite field Fp, and obtains the point set P(A)=[PX1,PX2,...,PXn] on the elliptic curve. It then uses the key Ka to encrypt the ciphertext primary key set Ea(PA)=[PX1×a,PX2×a,...,PXn×a] and sends the ciphertext primary key set Ea(PA)=[PX1×a,PX2×a,...,PXn×a] to partner B.

[0038] In this embodiment, the specific process of step S5 is as follows:

[0039] S5-1: Partner B randomly selects a large positive integer b from the finite field Fp as the key Kb. The principle is based on the discrete logarithm problem on the elliptic curve. That is, given an elliptic curve E and points P and Q on it, where Q=k×P, it can be proved that it is very difficult to reversely calculate the positive integer k when P and Q are known.

[0040] S5-2: Partner B encodes the primary key set D(B)=[Y1,Y2,...,Yn] of its own data set onto the elliptic curve of the finite field Fp, and obtains the point set P(B)=[PY1,PY2,...,PYn] on the elliptic curve, and then encrypts it with the key Kb to obtain the ciphertext primary key set Eb(PB)=[PY1×b,PY2×b,...,PYn×b];

[0041] S5-3: Partner B maps the ciphertext primary key set Eb(PB) to the binary vector of the Bloom filter. The Bloom filter consists of k different hash functions and a binary vector of length m. k and m are calculated by the steps described in S3, and the binary vector is initialized to all zeros. The ciphertext primary key set Eb(PB) is traversed in sequence, and the i-th value PYi×b is mapped to the Bloom filter in the following way: k hash functions are used in sequence to convert the ciphertext primary key value into k different hash values, which are combined into a hash value set H(PYi)=[H1(PYi×b),H2(PYi×b),...,Hk(PYi×b)], and then the hash value set is traversed, and the i-th hash value is inserted into a specific position in the binary vector in sequence. The insertion position is calculated by posi=Hi(PYi×b)%m, and the bit position of the position is set to 1. When each ciphertext primary key value in the ciphertext primary key set Eb(PB) is mapped to the Bloom filter, the resulting binary vector is recorded as BF(Eb(PB));

[0042] S6: After receiving the ciphertext primary key set Ea(PA) from partner A, partner B uses the key Kb to perform secondary encryption on each ciphertext in Ea(PA) to obtain the secondary ciphertext primary key set Eab(PA)=[PX1×a×b,PX2×a×b,...,PXn×a×b], and then sends the Bloom filter binary vector BF(Eb(PB)) in step S5-3 and partner A's secondary ciphertext primary key set Eab(PA) to partner A;

[0043] In this embodiment, the specific process of step S7 is as follows:

[0044] S7-1: After partner A receives the secondary ciphertext primary key set Eab(PA) and the Bloom filter binary vector BF(Eb(PB)) from partner B, it first calculates the inverse element a-1 of its key a. On the elliptic curve, the inverse element a-1 of a = the order of the point on the curve - a. Since the order of each point is different, the inverse element a-1 of the key a is also different for each point. The order of each point in the point set P(A)=[PX1,PX2,...,PXn] on the elliptic curve is calculated, and then the key a is subtracted from its order to obtain the key inverse element of each point, which is recorded as the key inverse element set [ , ,..., ], and then use each inverse element in the key inverse element set to multiply each ciphertext value in the secondary ciphertext primary key set Eab(PA), so as to obtain the ciphertext primary key set Eb(PA)=[PX1×a×b× ,PX2×a×b× ,...,PXn×a×b× ]=[PX1×b,PX2×b,...,PXn×b], there is a one-to-one corresponding sequential mapping relationship between the ciphertext primary key set and the plaintext primary key set D(A) in Eb(PA);

[0045] S7-2: Partner A sequentially traverses each ciphertext primary key value in the ciphertext primary key set Eb(PA) and queries whether it hits the Bloom filter binary vector BF(Eb(PB)). The query rule is as follows: for the i-th value PXi×b in Eb(PA), use k hash functions in turn to convert the ciphertext primary key value into k different hash values, and combine them into a hash value set H(PXi)=[H1(PXi×b),H2(PXi×b),...,Hk(PXi× b)], then traverse the hash value set and check whether the bit at the i-th position in the Bloom filter binary vector BF(Eb(PB)) is 1. The query position is calculated by posi=Hi(PXi×b)%m. Only when the bits at the k positions are all 1, it is considered that PXi×b hits the Bloom filter binary vector BF(Eb(PB)), and puts it into the generalized intersection ciphertext set. This generalized intersection ciphertext set is represented by Eb(P(A)∩P(B));

[0046] S-8: There is a one-to-one correspondence between the positions of the elements in the ciphertext primary key set Eb(A) and the plaintext primary key set D(A) of partner A. Therefore, partner A uses this position mapping relationship to obtain the generalized intersection plaintext primary key set D(A)∩D(B) from Eb(A∩B), and then obtains the associated plaintext data set M(A) based on the generalized intersection plaintext primary key set D(A)∩D(B). M(A) contains the intersection primary key field and other required fields.

[0047] S9: Partner A sends the pan-intersection plaintext primary key set D(A)∩D(B) of both parties to partner B on a secure channel. After receiving it, partner B obtains the associated plaintext data set M(B) based on the pan-intersection plaintext primary key set D(A)∩D(B). M(B) contains the intersection primary key field and other required fields.

[0048] In this embodiment, the specific process of step S10 is as follows:

[0049] S10-1: Partner A calculates the public and private keys of the RSA encryption algorithm: randomly select two large prime numbers , ,calculate and ,Right now Euler function of . Partner A generates a public key: find make , that is, the public key ;Partner A generates A private key: calculation make , ;

[0050] S10-2: Use the public key pka to encrypt the data set M(A)=[A1,A2,...,An], and obtain the ciphertext data set Ca(A)=[ % , % ,..., % ];

[0051] In this embodiment, the specific process of step S11 is as follows:

[0052] S11-1: Partner B calculates the public and private keys of the RSA encryption algorithm: randomly select two large prime numbers , ,calculate and ,Right now Euler function of . Partner B generates a public key: find make , that is, the public key ;Partner B generates a private key: Calculate make , i.e. private key ;

[0053] S11-2: Use the public key pkb to encrypt the data set M(B)=[B1,B2,...,Bm] to obtain the ciphertext data set Cb(B)=[ % , % ,..., % ];

[0054] S12: Both parties prepare an accessible secure server with strict isolation and access control, operation log auditing, data flow monitoring and other security measures. Specifically, the server cannot access the Internet, cannot take screenshots, cannot copy and paste data to the host using the remote desktop, and all USB ports are closed;

[0055] S13: Partner A imports its ciphertext data set Ca(A) into the secure server, and partner B imports its ciphertext data set Cb(B) into the secure server;

[0056] In this embodiment, the specific process of step S14 is as follows:

[0057] S14-1: If partner A wants to do joint data analysis and modeling, he first logs in to the security server and uses his own private key ska to decrypt his own data set Ca(A) to obtain the plaintext M(A), that is, M(A)=[ % , % ,..., % ]=[ % , % ,..., % ]=[A1,A2,...,An], and then notify partner B to log in to the security server;

[0058] S14-2: After logging into the secure server, partner B uses his private key skb to decrypt his own data set and obtains M(B), that is, M(B)=[ % , % ,..., % ]=[ % , % ,..., % ]=[B1,B2,...,Bm];

[0059] S14-3: Partner A uses the primary key fields to perform a secondary intersection of M(A) and M(B) in the secure server to obtain an accurate data intersection, which is a wide table that combines the fields of both parties. Then, various data analysis and modeling tools installed on the server can be used to work on the wide table.

[0060] S14-4: After completing data analysis or modeling, partner A obtains the result set Ra=(R1, R2, ..., Rn);

[0061] S14-5: If partner B wants to perform joint data analysis and modeling, it also needs to perform the above steps similar to S14-1 to S14-4;

[0062] In this embodiment, the specific process of step S15 is as follows:

[0063] S15-1: If partner A completes a data analysis and modeling, before exiting the secure server, the plaintext data intersection M(A)∩M(B) of both parties is deleted first;

[0064] S15-2: Partner A uses the public key pka to encrypt the plaintext data set M(A) and obtains the ciphertext data set Ca(A)=[ % , % ,..., % ] and notify partner B to log in;

[0065] S15-3: After logging in, partner B uses the public key pkb to encrypt the plaintext data set M(B) and obtain the ciphertext data set Cb(B)=[ % , % ,..., % ];

[0066] S15-4: Similarly, if partner B completes a joint data analysis and modeling, it also needs to perform the above-mentioned operation steps similar to S15-1 to S15-4;

[0067] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

[0068] The present invention also discloses a data protection device based on secondary privacy intersection, which uses the above-mentioned data protection method based on secondary privacy intersection.

[0069] The above are only embodiments of the present invention. Common knowledge such as the known specific structures and characteristics in the scheme is not described in detail here. Ordinary technicians in the relevant field know all the common technical knowledge in the technical field to which the invention belongs before the application date or priority date, can obtain all the existing technologies in the field, and have the ability to apply conventional experimental means before that date. Ordinary technicians in the relevant field can improve and implement this scheme in combination with their own abilities under the enlightenment given by this application. Some typical known structures or known methods should not become obstacles for ordinary technicians in the relevant field to implement this application. It should be pointed out that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can be made, which should also be regarded as the scope of protection of the present invention, and these will not affect the effect of the implementation of the present invention and the practicality of the patent. The scope of protection required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. A data protection method based on two-level privacy intersection, Features: The following steps are involved: The privacy universal intersection step and the data intersection step, the privacy universal intersection step includes the following steps: S1: The two parties agree on the primary key of the data to be submitted and the data encryption algorithm; S2: The two parties agree on the expansion coefficient f of the privacy-prevalent intersection. The expansion coefficient f is defined as the intersection cardinality of the popular intersection / the cardinality of the real intersection. The Bloom filter has a controllable false positive error rate e. The false positive error rate e required by the Bloom filter is derived according to the preset expansion coefficient. The calculation formula is e=f-1, that is, the expansion coefficient minus 1; S3: The two parties estimate the length m of the Bloom filter binary vector and the number k of hash functions based on the estimated false positive error rate e of the Bloom filter and the sum of the sizes of the data sets that both parties will request to exchange, where m is equal to "-1.44nlog 2 e" rounded up, k equals "0.6931m / n" rounded up; S4: Partner A generates the key Ka of the data encryption algorithm, and uses the key to encrypt the primary key set D(A)=[X1,X2,...,Xn] of its own data set, and obtains the encrypted ciphertext primary key set Ea(A)=[Ea(X1),Ea(X2),...,Ea(Xn)] of its own party, retains the one-to-one corresponding sequential mapping relationship between the plaintext primary key set D(A) and the ciphertext primary key set Ea(A), and then sends the encrypted data primary key set Ea(A) to partner B; S5: Partner B generates a key Kb for the data encryption algorithm, and uses the key to encrypt the primary key set D(B)=[Y1,Y2,...,Ym] of its own data set, and obtains the encrypted ciphertext primary key set Eb(B)=[Eb(Y1),Eb(Y2),...,Eb(Ym)] of its own side, retaining the one-to-one correspondence between the plaintext primary key set D(B) and the ciphertext primary key set Eb(B), and then maps the ciphertext primary key set Eb(B) to the binary vector of the Bloom filter, represented by BF(Eb(B)); S6: After receiving the ciphertext primary key set Ea(A) from partner A, partner B uses the key Kb for secondary encryption to obtain the secondary encrypted ciphertext primary key set Eab(A)=[Eab(X1), Eab(X2), ..., Eab(Xn)], and then sends the Bloom filter binary vector BF(Eb(B)) in step S5 and partner A's secondary ciphertext primary key set Eab(A) to partner A; S7: After receiving the secondary ciphertext primary key set Eab(A) and the Bloom filter binary vector BF(Eb(B)) from partner B, partner A uses its own key a to decrypt and obtain the ciphertext primary key set Eb(A) encrypted with partner B's key. Since there is a one-to-one sequential mapping relationship between the ciphertext primary key set in Eb(A) and the plaintext primary key set D(A), each ciphertext primary key value in the ciphertext primary key set Eb(A) is traversed to check whether it is a hit in the Bloom filter binary vector BF(Eb(B)). If it is a hit, the ciphertext primary key value is put into the general intersection result set Eb(A∩B); S8: There is a one-to-one correspondence between the positions of the elements in the ciphertext primary key set Eb(A) and the plaintext primary key set D(A) of partner A. Therefore, partner A uses this position mapping relationship to obtain the generalized intersection plaintext primary key set D(A)∩D(B) from Eb(A∩B), and then obtains the associated plaintext data set M(A) based on the generalized intersection plaintext primary key set D(A)∩D(B). M(A) contains the intersection primary key field and other required fields. S9: Partner A sends the plaintext primary key set D(A)∩D(B) of both parties to partner B. After receiving it, partner B obtains the associated plaintext data set M(B) according to the plaintext primary key set D(A)∩D(B). M(B) contains the intersection primary key field and other required fields. The data intersection step includes the following steps: S10: Partner A generates a public-private key pair using an asymmetric encryption algorithm ( , ), and then use the public key pka to encrypt the data set M(A) to obtain the ciphertext data set Ca(A); here, a symmetric encryption algorithm can also be used to generate a symmetric key keya to encrypt the data set M(A) to obtain the ciphertext data set Ca(A); S11: Partner B generates a public-private key pair using an asymmetric encryption algorithm ( , ), and then use the public key pkb to encrypt the data set M(B) to obtain the ciphertext data set Cb(B); here, a symmetric encryption algorithm can also be used to generate a symmetric key keyb to encrypt the data set M(B) to obtain the ciphertext data set Cb(B); S12: Establish a secure server that can be accessed by both parties; S13: Partner A imports its ciphertext data set Ca(A) into the secure server, and partner B imports its ciphertext data set Cb(B) into the secure server; S14: When partner A wants to do joint data analysis and modeling, he logs in to the security server and uses his own key ska or keya to decrypt his own data to obtain M(A), then notifies partner B to log in to the security server. After logging in, partner B uses his own private key skb or keyb to decrypt his own data to obtain M(B). At this time, partner A can use the primary key to perform a secondary intersection on M(A) and M(B) in the server to obtain the accurate data intersection M(A)∩M(B), that is, a wide table that combines all fields of both parties. Then, various data analysis and modeling tools installed on the server can be used to carry out the work. The analysis results can be encrypted using partner A's key pka or keya. If partner B wants to do joint data analysis and modeling, the above steps must also be performed.

2. According to the data protection method based on secondary privacy intersection as described in claim 1, Features: S15: If partner A completes a data analysis and modeling, before exiting the security server, it first deletes the plaintext data intersection M(A)∩M(B) of both parties, and then uses its own key pka or keya to encrypt its own plaintext data M(A) to obtain the ciphertext data set Ca(A), and then notifies partner B to log in online. After partner B logs in, it uses its own key pkb or keyb to encrypt its own plaintext data M(B) to obtain the ciphertext data set Cb(B). Similarly, if partner B completes a data analysis and modeling, the above steps must also be performed.

Images