A data processing method, apparatus, device, and medium

Abstract

The application relates to the field of information security, in particular to a data processing method and device, equipment and medium, which are used to solve the security problem of two-party data transmission. In the method, a first device receives a second public key sent by a second device, and encrypts a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first device receives a second encrypted data set sent by the second device, and encrypts the second encrypted data set based on the first private key to obtain a second target data set; and the first target data set and the second target data set are processed by complementation to obtain a data complement.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, and in particular to a data processing method and device, equipment and medium. BACKGROUND

[0002] With the rapid development of economy, in order to meet the increasing demand for business, data transmission between different institutions is usually needed to obtain complete business data. For example, when two institutions have part of the data of the same business, one party may need the other party to transmit the data of the business it saves to the party to obtain complete data of the business to meet the subsequent business requirements. However, when data transmission is performed, the security of data is particularly important. Therefore, in order to prevent the leakage of business data of each institution, the two institutions need a method to ensure the security of data transmission when data transmission is performed. SUMMARY

[0003] The embodiments of the present application provide a data processing method, device, equipment and medium, which are used to solve the data security when data transmission is performed between two institutions.

[0004] In a first aspect, the present application provides a data processing method applied to a first device, the method comprising:

[0005] receiving a second public key sent by a second device, and encrypting a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0006] receiving a second encrypted data set sent by the second device, and encrypting the second encrypted data set based on the first private key to obtain a second target data set; the second encrypted data set is obtained by encrypting a second data set based on the second private key and the first base point by the second device; the first data set and the second data set correspond to the same target business;

[0007] performing a complement set processing on the first target data set and the second target data set to obtain a data complement set.

[0008] In one possible embodiment, the first encrypted data set is determined based on the following manner:

[0009] encrypting each first data in the first data set based on the first private key and the order of the first base point to obtain the first encrypted data set.

[0010] In a possible implementation, the encrypting each first data in the first data set based on the first private key and the order of the first base point comprises:

[0011] performing a modulo operation on the first private key and the order of the first base point;

[0012] encrypting each first data based on a result of the modulo operation to obtain first encrypted data corresponding to each first data.

[0013] In a possible implementation, the encrypting each first data in the first data set based on the first private key and the order of the first base point comprises:

[0014] generating a negotiated key based on the second public key and the first private key, and calculating a hash value of the negotiated key based on a hash function;

[0015] calculating a hash value of each first data based on the hash function, with the hash value of the negotiated key as a salt value;

[0016] encrypting the hash value of each first data based on the first private key and the order of the first base point.

[0017] In a possible implementation, the first data set comprises at least one first data, and the first data set is determined based on the following manner:

[0018] receiving a first initial data set corresponding to the target service, the first initial data set comprising at least one first initial data, and each first initial data comprising a plurality of sub data corresponding to respective primary keys, and each primary key corresponding to a different attribute parameter of the first initial data;

[0019] for each first initial data, splicing each sub data in the first initial data according to a preset arrangement order of the primary keys to obtain a first data corresponding to the first initial data.

[0020] In a second aspect, the present application provides a data processing apparatus applied to a first device, the apparatus comprising:

[0021] a first receiving module configured to receive a second public key sent by a second device, and encrypt a first encrypted data set based on the second public key to obtain a first target data set, wherein the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device, the second public key is generated based on a second private key of the second device and a first base point, and the first base point is generated based on an elliptic curve encryption algorithm;

[0022] a second receiving module, configured to receive a second encrypted data set sent by the second device, and encrypt the second encrypted data set based on the first private key to obtain a second target data set; the second encrypted data set is obtained by encrypting a second data set based on the second private key and the first base point by the second device; the first data set and the second data set correspond to a same target service;

[0023] a complement processing module, configured to perform complement processing on the first target data set and the second target data set to obtain a data complement.

[0024] In a possible implementation, the apparatus further includes a first set determining module, configured to determine the first encrypted data set based on the following manner:

[0025] encrypt each first data in the first data set based on the first private key and an order of the first base point to obtain the first encrypted data set.

[0026] In a possible implementation, the first set determining module is specifically configured to:

[0027] perform a modulo operation on the first private key and the order of the first base point.

[0028] encrypt each first data based on a result of the modulo operation to obtain a first encrypted data corresponding to each first data.

[0029] In a possible implementation, the first set determining module is specifically configured to:

[0030] generate a negotiated key based on the second public key and the first private key, and calculate a hash value of the negotiated key based on a hash function;

[0031] calculate a hash value of each first data based on the hash function, with the hash value of the negotiated key as a salt value;

[0032] encrypt the hash value of each first data based on the first private key and the order of the first base point.

[0033] In a possible implementation, the first data set includes at least one first data; and the first set determining module is further configured to determine the first data set based on the following manner:

[0034] receive a first initial data set corresponding to a target service, the first initial data set including at least one first initial data, each first initial data including a plurality of sub-data corresponding to respective primary keys, and each primary key corresponding to a different attribute parameter of the first initial data;

[0035] for each first initial data, splice the sub-data in the first initial data according to a preset arrangement order of the primary keys to obtain first data corresponding to the first initial data.

[0036] In a third aspect, the present application provides a data processing method applied to a second device, the method comprising:

[0037] sending a second public key to a first device to enable the first device to encrypt a first encrypted data set based on the second public key to obtain a first target data set, the first encrypted data set being obtained by the first device encrypting a first data set based on a first private key of the first device, the second public key being generated based on a second private key of the second device and a first base point, and the first base point being generated based on an elliptic curve encryption algorithm;

[0038] sending a second encrypted data set to the first device to enable the first device to encrypt the second encrypted data set based on the first private key to obtain a second target data set, and performing a complement operation on the first target data set and the second target data set to obtain a data complement, the second encrypted data set being obtained by encrypting a second data set based on the second private key and the first base point, and the first data set and the second data set corresponding to the same target service.

[0039] In a possible implementation, the second encrypted data set is determined based on the following manner:

[0040] encrypting each second data in the second data set based on the second private key and an order of the first base point to obtain an intermediate data set;

[0041] encrypting the intermediate data set based on the first base point to obtain the second encrypted data set.

[0042] In a possible implementation, the encrypting each second data in the second data set based on the second private key and the order of the first base point comprises:

[0043] performing a modulo operation on the second private key and the order of the first base point;

[0044] The second data are respectively encrypted based on a result of a modulo operation to obtain intermediate data respectively corresponding to the second data.

[0045] In a possible implementation, the encrypting the second data respectively based on the second private key and the order of the first base point includes:

[0046] The negotiation key is generated based on the first public key and the second private key, and a hash value of the negotiation key is calculated based on a hash function; the first public key is generated based on the first private key and the first base point;

[0047] The hash values of the second data are respectively calculated based on the hash function and the hash value of the negotiation key as a salt value;

[0048] The hash values of the second data are respectively encrypted based on the second private key and the order of the first base point.

[0049] In a fourth aspect, the present application provides a data processing apparatus applied to a second device, and the apparatus includes:

[0050] The first sending module is configured to send a second public key to a first device, so that the first device encrypts a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; and the first base point is generated based on an elliptic curve encryption algorithm;

[0051] The second sending module is configured to send a second encrypted data set to the first device, so that the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set, and performs a complement set processing on the first target data set and the second target data set to obtain a data complement set; the second encrypted data set is obtained by encrypting a second data set based on the second private key and the first base point; and the first data set and the second data set correspond to a same target service.

[0052] In a possible implementation, the apparatus further includes a second set determining module configured to determine the second encrypted data set based on the following manner:

[0053] The second data are respectively encrypted based on the second private key and the order of the first base point to obtain an intermediate data set;

[0054] The first base point is used to encrypt the intermediate data set to obtain a second encrypted data set.

[0055] In a possible implementation, the second set determining module is specifically configured to:

[0056] The second private key and an order of the first base point are subjected to a modulo operation.

[0057] Each second data is encrypted based on a result of the modulo operation to obtain intermediate data corresponding to each second data.

[0058] In a possible implementation, the second set determining module is specifically configured to:

[0059] A negotiation key is generated based on the first public key and the second private key, and a hash value of the negotiation key is calculated based on a hash function; the first public key is generated based on the first private key and the first base point;

[0060] The hash value of the negotiation key is used as a salt value, and hash values of the second data are calculated based on the hash function;

[0061] The hash values of the second data are respectively encrypted based on the second private key and an order of the first base point.

[0062] In a fifth aspect, the present application provides a data processing method, which comprises:

[0063] First data set is encrypted based on a first private key of a first device to obtain a first encrypted data set, and the first encrypted data set is encrypted based on a second public key of a second device to obtain a first target data set; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0064] Second data set is encrypted based on the second private key and the first base point to obtain a second encrypted data set, and the second encrypted data set is encrypted based on the first private key to obtain a second target data set; the first data set and the second data set correspond to a same target service;

[0065] The first target data set and the second target data set are subjected to a complement processing to obtain a data complement.

[0066] In a sixth aspect, the present application provides an electronic device, which comprises:

[0067] A memory configured to store program instructions;

[0068] A processor configured to invoke program instructions stored in the memory to perform the steps of the method of any one of the first aspect.

[0069] In a seventh aspect, the present application provides a computer readable storage medium storing a computer program, the computer program comprising program instructions which, when executed by a computer, cause the computer to perform the method of any one of the first aspect.

[0070] In an eighth aspect, the present application provides a computer program product comprising: computer program code which, when run on a computer, causes the computer to perform the method of any one of the first aspect.

[0071] Through the technical solutions in one or more of the above embodiments of the present application, the present application has at least the following technical effects:

[0072] The above method, the second device generates a second public key based on the first base point and the second private key, and sends the second public key to the first device, ensuring the security of the second private key. After the second data set is encrypted by the second private key and the first base point, a second encrypted data set is obtained, and the second encrypted data set is sent to the first device, ensuring the transmission security of the second data set. The first device encrypts the first encrypted data set based on the second public key to obtain a first target data set, and encrypts the second encrypted data set based on the first private key to obtain a second target data set, ensuring that the first data set and the second data set are encrypted by the same encryption method, and facilitating subsequent complement calculation.

[0073] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings. BRIEF DESCRIPTION OF DRAWINGS

[0074] Figure 1 A flowchart of a data processing method provided by an embodiment of the present application;

[0075] Figure 2 A flowchart of a data processing method applied to a first device provided by an embodiment of the present application;

[0076] Figure 3 A structural diagram of a data processing device applied to a first device provided by an embodiment of the present application;

[0077] Figure 4A flow chart of a data processing method applied to a second device is provided in an embodiment of the present application.

[0078] Figure 5 A structure diagram of a data processing device applied to a second device is provided in an embodiment of the present application.

[0079] Figure 6 A structure diagram of an electronic device is provided in an embodiment of the present application. DETAILED DESCRIPTION

[0080] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application. The embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily without conflict. And, although a logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0081] The terms "first" and "second" in the specification and claims of the present application and the above drawings are used to distinguish different objects, and are not used to describe a specific order. In addition, the term "comprising" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0082] Exemplary embodiments of the present application are described below with reference to the accompanying drawings, which include various details of the embodiments of the present application to help understanding, and should be considered as merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present disclosure. Also, for the sake of clarity and conciseness, the description below omits the description of well-known functions and structures. It should be noted that in the embodiments of the present application, some software, components, models and other industry solutions may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but does not mean that the applicant has or will necessarily use the solutions.

[0083] In the technical solutions of the present application, the acquisition, transmission, storage, and use of data comply with relevant national laws and regulations.

[0084] For ease of understanding, the technologies involved in the present application are explained below:

[0085] (1) Private Complementary Set Computation: Assuming A and B are two sets, the complement of A in B is a set whose elements belong to B but not to A, Private Complementary Set Computation refers to the calculation of the complement of the sets of both parties through cryptographic protocols and other methods when each party holds sets A and B, while not revealing the intersection and other data belonging to the party.

[0086] (2) Elliptic Curve: A mathematical object composed of points that satisfy y 2 = x 3 + ax + b; Elliptic curves are widely used in the field of cryptography, such as network security, electronic signatures, etc. Compared with traditional encryption algorithms, elliptic curve encryption algorithms have the following advantages: using smaller key lengths can achieve the same security level; and efficient operations can be performed.

[0087] (3) Elliptic Curve Cryptography (ECC): A public key encryption algorithm based on elliptic curve mathematics. It uses rational points on an elliptic curve to construct the computational difficulty of elliptic discrete logarithms on an Abel additive group, thereby implementing encryption and decryption operations. The Elliptic Curve Discrete Logarithm Problem (ECDLP) is the basis for the security of the elliptic curve encryption algorithm. Simply put, given two points P and Q on an elliptic curve, find an integer k such that P = kQ, which is a very difficult problem. Therefore, by utilizing the difficulty of the elliptic curve discrete logarithm problem, secure encryption and decryption can be achieved.

[0088] The process of the elliptic curve encryption algorithm mainly includes the following steps:

[0089] Encryption: The sender selects a random number r, calculates the ciphertext C1 = M + rK (M is the plaintext) and C2 = rG, and then sends the ciphertext C1, C2 to the receiver.

[0090] Decryption: After receiving the ciphertext C1, C2, the receiver calculates M' = C1-kC2 = M+rK-krG = M+rK-rK = M, where k is the private key of the receiver. Therefore, only when the receiver has the private key k, can the M be decrypted.

[0091] Hash to Curve: refers to calculating the Hash value of an arbitrary numerical value or string, and then mapping it to a point on the elliptic curve. The Hash to Curve operator is usually denoted as Hash G or H G .

[0092] (4) Elliptic Curve Diffie-Hellman (ECDH): is a key agreement protocol based on elliptic curve encryption algorithm, which defines how to generate and exchange keys between two communicating parties.

[0093] The ECDH protocol process is as follows:

[0094] A and B use the same elliptic curve to generate their own private keys and public keys. The private key of A is k A , and the public key is K A = k A G. The private key of B is k B , and the public key is K B = k B G. Note that A and B need to use the same main parameters, i.e. select the same base point G on the same finite field of the same curve.

[0095] A and B exchange their public keys K A and K B through an insecure channel. An intermediate person can obtain K A and K B , but cannot obtain k A and k B without breaking the discrete logarithm problem.

[0096] A uses its own private key and B's public key to calculate S A = k A K B , and B uses its own private key and Alice's public key to calculate S B = k B K A . Because S A = k A K B = k A (k B G) = k B (k A G) = k B K A = S BSo both parties get the same S A So both parties get the same S B A B So both parties get the same S

[0097] Before introducing the data processing method provided by the embodiments of the present application, in order to facilitate understanding, first, the technical background of the embodiments of the present application is introduced in detail.

[0098] With the rapid development of economy, in order to meet the growing demand for business, different institutions usually need to transmit data to obtain complete business data. For example, when two institutions have part of the data of the same business, one party may need the other party to transmit the data of the business it saves to the party to obtain complete data of the business to meet the subsequent business requirements. When transmitting data, the security of data is particularly important. Therefore, in order to prevent the leakage of business data of each institution, when transmitting data, the two institutions need a method to ensure the security of data transmission.

[0099] To solve the above problems, the embodiments of the present application provide a business processing method, which includes a first device and a second device, wherein the first device is a party that needs to perform privacy complement calculation on the data of a certain business (i.e. target business), and the second device is a party that sends its business data (i.e. second data set) to the first device for complement calculation by the first device. Wherein the first device holds a first data set A of the target business, the second device holds a second data set B of the target business, and the target of the first device is to determine the complement of set A in set B.

[0100] In some embodiments, the first data set and the second data set have the same data structure, and the first data set includes at least one first data, and the second data set includes at least one second data.

[0101] In some embodiments, when determining the first data set, the first device first receives a first initial data set corresponding to the target business, the first initial data set includes at least one first initial data, and each first initial data includes a plurality of sub data corresponding to each primary key; each primary key corresponds to a different attribute parameter of the first initial data; then, for each first initial data, the sub data in the first initial data is spliced according to the preset arrangement order of each primary key, to obtain the first data corresponding to the first initial data.

[0102] It should be noted that the specific content and arrangement order of each primary key can be based on demand, and the embodiments of the present application do not limit. ​​

[0103] In specific implementation, the aforementioned first initial data set can be a table structure, which includes multiple columns corresponding to each primary key. Each column corresponds to different attribute parameters. For example, when the first initial data set is information about multiple objects corresponding to a certain business, each first initial data set can correspond to one object, and the columns can include ID (object identifier) ​​and AGE (object age), etc.

[0104] For example, when generating the first data set, the sub-data corresponding to each column is first obtained from the first initial data set, and the sub-data corresponding to the ID column is denoted as: id1, id2, ..., id n The sub-data corresponding to the AGE column are denoted as: age1, age2, ..., age n , where id i and age i Let ID and AGE represent the ID and AGE corresponding to the i-th initial data, respectively, and n be the number of initial data in the initial data set. Then, feature concatenation is performed on the sub-data corresponding to each initial data. Specifically, for each i-th initial data, its corresponding ID is... i and age i Concatenate strings, removing leading and trailing spaces to ensure accuracy.

[0105] In some embodiments, when the order of the primary keys is ID and AGE, the concatenation process can be as follows: id i ||age i This will give us the first data corresponding to the i-th initial data; where || is the concatenation symbol.

[0106] The process for determining the second data set by the second device is similar and will not be elaborated here. It should be noted that, in order to ensure the accuracy of subsequent complement calculations, the initial data sets of the first and second devices need to have the same data structure, and the first and second devices need to use the same primary key arrangement order when concatenating data.

[0107] Figure 1 A flowchart of a data processing method provided in an embodiment of this application is shown below. Figure 1 As shown in the figure, this application embodiment provides a data processing method, the processing procedure of which is as follows:

[0108] Step S101: The second device sends the second public key to the first device;

[0109] In some embodiments, before the second device sends the second public key to the first device, a key generation process needs to be performed, i.e., a second private key and a second public key corresponding to the second device are generated. Meanwhile, the first device also needs to generate a first private key and a first public key corresponding to the first device.

[0110] In the embodiments of the present application, the first public key is generated based on the first private key of the first device and a first base point; the second public key is generated based on the second private key of the second device and the first base point; and the first base point is generated based on an elliptic curve encryption algorithm.

[0111] In some embodiments, the first device and the second device can generate their respective public keys and private keys through elliptic curve key agreement. In specific implementations, the first device and the second device can select the same first base point G on the same finite field of the same curve based on the same main parameters, and use the same elliptic curve to generate their respective public keys and private keys, i.e., the first private key k A A of the first device and the first public key K A A are k A G; and the second private key k B B of the second device and the second public key K B B are k B G.

[0112] Then, the first device and the second device can send their respective public keys to the other device through the ECDH key agreement algorithm, specifically, the first device sends the first public key K A A to the second device, and the second device sends the second public key K B B to the first device.

[0113] Meanwhile, after the first device and the second device receive the public key sent by the other device, they can generate a negotiation key S based on their own private key and the received public key, specifically, the first device can generate the negotiation key based on the first private key and the second public key, i.e., S=k A K B ; and the second device can generate the negotiation key based on the second private key and the first public key, i.e., S=k B K A .

[0114] In step S102, the first device encrypts the first data set based on the first private key of the first device to obtain a first encrypted data set.

[0115] In some embodiments, the first device can determine the first encrypted data set based on the following manner:

[0116] The first data set is encrypted based on the first private key and the order of the first base point to obtain the first encrypted data set.

[0117] In specific implementation, the first private key and the order of the first base point can be subjected to a modulo operation first; then each first data is respectively encrypted based on the result of the modulo operation to obtain first encrypted data corresponding to each first data respectively, and a first encrypted data set is formed based on the first encrypted data.

[0118] In some embodiments, to further ensure the security of data transmission, in the present application, when the first encrypted data set is generated, the hash value of each first data can be calculated based on a hash function first, and then the hash value of each first data is respectively encrypted based on the first private key and the order of the first base point. That is, the first encrypted data in the embodiments of the present application is: kt_a i =hash_a i ·k A mod h; wherein kt_a i is the i-th first encrypted data in the first encrypted data set, hash_a i is the hash value of the i-th first data in the first data set, and h is the order of the first base point.

[0119] It should be noted that the hash function is not limited in the embodiments of the present application, and in some embodiments, the hash function can be Hash to Curve.

[0120] In specific implementation, when the hash value of each first data is calculated based on the hash function, the hash value Hash(S) of the negotiation key S can be calculated based on the hash function, and the Hash(S) is taken as a salt value, and the hash value of each first data is calculated based on the hash function.

[0121] In step S103, the first device encrypts the first encrypted data set based on the second public key of the second device to obtain a first target data set.

[0122] In some embodiments, the first device can respectively encrypt each first encrypted data in the first encrypted data set based on the received second public key to obtain the first target data set.

[0123] In step S104, the second device encrypts the second data set based on the second private key and the first base point to obtain a second encrypted data set; the first data set and the second data set are data sets corresponding to the same target service.

[0124] In some embodiments, the second device can determine the second encrypted data set in the following manner:

[0125] The second data set is encrypted based on the second private key and the order of the first base point to obtain an intermediate data set; and the intermediate data set is encrypted based on the first base point to obtain a second encrypted data set.

[0126] In specific implementation, when the intermediate data set is generated, the second private key and the order of the first base point can be subjected to a modulo operation first; then each second data is encrypted based on the result of the modulo operation to obtain an intermediate data corresponding to each second data, and the intermediate data set is composed of the intermediate data.

[0127] In some embodiments, to further ensure the security of data transmission, when the intermediate encrypted data set is generated, the hash value of each second data can be calculated based on a hash function first, and then the hash value of each second data is encrypted based on the second private key and the order of the first base point. That is, the intermediate data in the embodiments of the present application is: kt_b i =hash_b i ·k B mod h; wherein kt_b i is the i th intermediate data in the intermediate data set, hash_b i is the hash value of the i th second data in the second data set, and h is the order of the first base point.

[0128] It should be noted that the hash function is not limited in the embodiments of the present application, and in some embodiments, the hash function can be Hash to Curve.

[0129] In specific implementation, when the hash value of each second data is calculated based on the hash function, the hash value Hash(S) of the negotiation key S can be calculated based on the hash function, and the hash value of each second data is calculated based on the hash function with the Hash(S) as a salt value.

[0130] In step S105, the second device sends the second encrypted data set to the first device.

[0131] In some embodiments, the process of encrypting the intermediate data set based on the first base point to obtain the second encrypted data set and sending the second encrypted data set to the first device can be realized by the way of ECDH key negotiation between the second device and the first device.

[0132] In a specific implementation, the first private key of the first device is taken as the key of the first device, the intermediate data set of the second device is taken as the key of the second device, ECDH key negotiation is performed between the first device and the second device, the first device sends the first public key to the second device, the second device encrypts each intermediate data in the intermediate data set based on the first base point to obtain a second encrypted data set, and the second device sends the second encrypted data set to the first device.

[0133] In step S106, the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set.

[0134] In some embodiments, the first device encrypts each second encrypted data in the second encrypted data set based on the first private key to obtain the second target data set.

[0135] In step S107, the first device performs complement processing on the first target data set and the second target data set to obtain a data complement.

[0136] In some embodiments, after obtaining the first target data set and the second target data set, the first device can perform complement matching calculation on the first target data set and the second target data set to obtain a data complement corresponding to the first device. The data in the complement belong to the first target data set but do not belong to the second target data set.

[0137] After obtaining the data complement, since the data in the data complement are all encrypted data, each encrypted data can be decrypted based on the inverse process of the above encryption process to obtain the original unencrypted data. Since the decryption process is the inverse process of the above encryption process, it is not described here.

[0138] After obtaining each original data corresponding to the data complement, each original data can be split based on the pre-set arrangement order of each primary key and the above feature splicing rule to obtain initial data corresponding to each original data (i.e., including the sub-data corresponding to each primary key), and a corresponding output file is generated based on the initial data corresponding to each original data.

[0139] The method, the second device generates the second public key based on the first base point and the second private key, and sends the second public key to the first device, ensuring the security of the second private key. The second data set is encrypted by the second private key and the first base point to obtain the second encrypted data set, and the second encrypted data set is sent to the first device, ensuring the transmission security of the second data set. The first device encrypts the first encrypted data set based on the second public key to obtain the first target data set, and encrypts the second encrypted data set based on the first private key to obtain the second target data set, ensuring that the first data set and the second data set are encrypted by the same encryption method, and facilitating subsequent complement calculation. At the same time, in this process, the elliptic curve encryption algorithm used has low computing power requirement, so the result can be obtained quickly.

[0140] In some embodiments, if the second device also has a data complement determination requirement, after the first device generates the first encrypted data set, that is, after the step S102 is executed, the first encrypted data set is encrypted based on the first base point, and the encrypted set is sent to the second device. This process can be realized by the ECDH key negotiation between the second device and the first device.

[0141] In a specific implementation, the first encrypted data set of the first device is used as the key of the first device, the second private key of the second device is used as the key of the second device, the ECDH key negotiation is performed between the first device and the second device, the first encrypted data set in the first encrypted data set is encrypted based on the first base point, and the encrypted set is sent to the second device. The second device sends the second public key to the first device.

[0142] After receiving the encrypted first encrypted set, the second device encrypts it based on the second private key to obtain the third target data set, and encrypts the intermediate encrypted set based on the first public key to obtain the fourth target data set. The complement processing of the fourth target data set and the third target data set can obtain the data complement corresponding to the second device.

[0143] The specific implementation of the above process can be referred to the first device, which will not be described here.

[0144] Based on the same inventive concept, the embodiments of the present application provide a data processing method applied to a first device, please refer to Figure 2 The method comprises:

[0145] Step S201, receiving a second public key sent by a second device, and encrypting a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0146] Step S202, receiving a second encrypted data set sent by the second device, and encrypting the second encrypted data set based on the first private key to obtain a second target data set; the second encrypted data set is obtained by encrypting a second data set based on the second private key and the first base point by the second device; the first data set and the second data set correspond to a same target service;

[0147] Step S203, performing a complement set processing on the first target data set and the second target data set to obtain a data complement set.

[0148] For a specific implementation process of the first device performing data processing, please refer to the related description of Figure 1 , which will not be repeated here.

[0149] Based on the same inventive concept, the embodiment of the present application provides a data processing device applied to a first device, please refer to Figure 3 , which comprises:

[0150] A first receiving module 301 is configured to receive a second public key sent by a second device, and encrypt a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0151] A second receiving module 302 is configured to receive a second encrypted data set sent by the second device, and encrypt the second encrypted data set based on the first private key to obtain a second target data set; the second encrypted data set is obtained by encrypting a second data set based on the second private key and the first base point by the second device; the first data set and the second data set correspond to a same target service;

[0152] A complement set processing module 302 is configured to perform a complement set processing on the first target data set and the second target data set to obtain a data complement set.

[0153] In a possible implementation, the apparatus further includes a first set determining module configured to determine the first encrypted data set based on the following manner:

[0154] encrypt each first data in the first data set based on the first private key and the order of the first base point to obtain the first encrypted data set.

[0155] In a possible implementation, the first set determining module is specifically configured to:

[0156] perform a modulo operation on the first private key and the order of the first base point;

[0157] encrypt each first data based on the result of the modulo operation to obtain a first encrypted data corresponding to the first data.

[0158] In a possible implementation, the first set determining module is specifically configured to:

[0159] generate a negotiated key based on the second public key and the first private key, and calculate a hash value of the negotiated key based on a hash function;

[0160] calculate a hash value of each first data based on the hash function by taking the hash value of the negotiated key as a salt value;

[0161] encrypt the hash value of each first data based on the first private key and the order of the first base point.

[0162] In a possible implementation, the first data set includes at least one first data, and the first set determining module is further configured to determine the first data set based on the following manner:

[0163] receive a first initial data set corresponding to the target service, the first initial data set including at least one first initial data, and each first initial data including a plurality of sub data corresponding to each primary key, and each primary key corresponding to a different attribute parameter of the first initial data;

[0164] for each first initial data, splice each sub data in the first initial data according to a preset arrangement order of each primary key to obtain a first data corresponding to the first initial data.

[0165] Based on the same inventive concept, the embodiments of the present application provide a data processing method applied to a second device. Please refer to Figure 4 The method includes:

[0166] Step S401, sending the second public key to the first device, so that the first device encrypts the first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting the first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0167] Step S402, sending the second encrypted data set to the first device, so that the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set, and performs a complement set processing on the first target data set and the second target data set to obtain a data complement set; the second encrypted data set is obtained by encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service.

[0168] The specific implementation process of the second device performing data processing is described in the foregoing Figure 1 , and details are not described herein.

[0169] Based on the same inventive concept, the embodiment of the present application provides a data processing apparatus applied to a second device, please refer to Figure 5 , the apparatus comprises:

[0170] The first sending module 501 is configured to send the second public key to the first device, so that the first device encrypts the first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting the first data set based on a first private key of the first device; the second public key is generated based on a second private key of the second device and a first base point; the first base point is generated based on an elliptic curve encryption algorithm;

[0171] The second sending module 502 is configured to send the second encrypted data set to the first device, so that the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set, and performs a complement set processing on the first target data set and the second target data set to obtain a data complement set; the second encrypted data set is obtained by encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service.

[0172] In a possible implementation, the apparatus further comprises a second set determining module configured to determine the second encrypted data set in the following manner:

[0173] encrypt each second data in the second data set based on the second private key and an order of the first base point, to obtain an intermediate data set;

[0174] encrypt the intermediate data set based on the first base point, to obtain the second encrypted data set.

[0175] In a possible implementation, the second set determining module is specifically configured to:

[0176] perform a modulo operation on the second private key and the order of the first base point;

[0177] encrypt each second data based on a result of the modulo operation, to obtain an intermediate data corresponding to the second data.

[0178] In a possible implementation, the second set determining module is specifically configured to:

[0179] generate a negotiated key based on the first public key and the second private key, and calculate a hash value of the negotiated key based on a hash function; the first public key is generated based on the first private key and the first base point;

[0180] calculate a hash value of each second data based on the hash function, with the hash value of the negotiated key as a salt value;

[0181] encrypt the hash value of each second data based on the second private key and the order of the first base point.

[0182] Based on the same inventive concept, an electronic device is provided, which can implement the functions of the data processing device discussed above. Please refer to Figure 6 The device includes at least one processor 601 and a memory 602 connected with the at least one processor. In the embodiments of the present application, the specific connection medium between the processor 601 and the memory 602 is not limited, Figure 6 The processor 601 and the memory 602 can be connected through a bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 6 In the embodiments of the present application, only one line is used to represent, but it does not mean that there is only one bus or only one type of bus.

[0183] The processor 601 is the control center of the electronic device, can connect various parts of the electronic device through various interfaces and lines, and realize data processing by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Optionally, the processor 601 can include one or more processing units, and the processor 601 can integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and an application program, and the modem processor mainly processes an issued instruction. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 can be implemented on the same chip, and in some embodiments, they can also be respectively implemented on independent chips.

[0184] The processor 601 can be a general-purpose processor, for example, a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in combination with the data processing method embodiment can be directly embodied as hardware processor execution or executed by a combination of hardware and software modules in the processor.

[0185] The memory 602 is a nonvolatile computer readable storage medium, which can be used to store nonvolatile software programs, nonvolatile computer executable programs and modules. The memory 602 can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card type memory, random access memory (RAM), static random access memory (SRAM), programmable read only memory (PROM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. The memory 602 is any other medium capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by a computer, but is not limited to this. The memory 602 in the embodiments of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and / or data.

[0186] In the embodiments of the present application, the memory 602 stores a computer program, when the program is executed by the processor 601, the processor 601 executes the steps of the data processing method described above.

[0187] Based on the same inventive concept, the embodiments of the present application provide a computer readable storage medium, a computer program product includes: computer program code, when the computer program code runs on the computer, the computer executes any of the data processing methods discussed above. Since the above-mentioned computer readable storage medium solves the problem similar to the data processing method, therefore the implementation of the above-mentioned computer readable storage medium can be referred to the implementation of the method, and the repeated part will not be repeated.

[0188] Based on the same inventive concept, the embodiments of the present application also provide a computer program product, the computer program product includes: computer program code, when the computer program code runs on the computer, the computer executes any of the data processing methods discussed above. Since the above-mentioned computer program product solves the problem similar to the data processing method, therefore the implementation of the above-mentioned computer program product can be referred to the implementation of the method, and the repeated part will not be repeated.

[0189] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, and the like) embodying computer readable program code.

[0190] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0191] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0193] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A data processing method, characterized in that, Applied to the first device, including: The system receives a second public key sent by a second device and encrypts a first encrypted data set based on the second public key to obtain a first target data set. The first encrypted data set is obtained by encrypting a first data set based on the first private key of the first device. The second public key is generated based on the second private key of the second device and a first base point. The first base point is generated based on an elliptic curve cryptography algorithm. The system receives a second encrypted data set sent by the second device and encrypts the second encrypted data set based on the first private key to obtain a second target data set; the second encrypted data set is obtained by the second device encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service; The first target data set and the second target data set are complemented to obtain the data complement.

2. The method as described in claim 1, characterized in that, The first encrypted data set is determined based on the following method: Based on the first private key and the order of the first base point, each first data in the first data set is encrypted to obtain the first encrypted data set.

3. The method as described in claim 2, characterized in that, The encryption of each piece of first data in the first data set based on the first private key and the order of the first base point includes: Perform a modulo operation on the first private key and the order of the first base point; Based on the result of the modulo operation, each first data is encrypted to obtain the first encrypted data corresponding to each first data.

4. The method as described in claim 2, characterized in that, The encryption of each piece of first data in the first data set based on the first private key and the order of the first base point includes: Based on the second public key and the first private key, a negotiation key is generated, and the hash value of the negotiation key is calculated based on a hash function; Using the hash value of the negotiated key as the salt, the hash value of each piece of first data is calculated based on the hash function; Based on the first private key and the order of the first base point, the hash values ​​of each of the first data are encrypted respectively.

5. The method according to any one of claims 1 to 3, characterized in that, The first data set includes at least one first data point; the first data set is determined based on the following method: Receive a first initial data set corresponding to the target service. The first initial data set includes at least one first initial data, and each first initial data includes multiple sub-data corresponding to each primary key. Each primary key corresponds to different attribute parameters of the first initial data. For each initial data set, the sub-data sets in the initial data set are concatenated according to the preset order of the primary keys to obtain the first data set corresponding to the initial data set.

6. A data processing method, characterized in that, Applied to a second device, including: A second public key is sent to a first device, enabling the first device to encrypt a first encrypted data set based on the second public key, thereby obtaining a first target data set; the first encrypted data set is obtained by the first device encrypting a first data set based on the first device's first private key; the second public key is generated based on the second device's second private key and a first base point; the first base point is generated based on an elliptic curve cryptography algorithm; A second encrypted data set is sent to the first device so that the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set, and performs a complement process on the first target data set and the second target data set to obtain a data complement set; the second encrypted data set is obtained by encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service.

7. The method as described in claim 6, characterized in that, The second encrypted data set is determined based on the following method: Based on the second private key and the order of the first base point, each second data in the second data set is encrypted to obtain an intermediate data set. The intermediate data set is encrypted based on the first base point to obtain the second encrypted data set.

8. The method as described in claim 7, characterized in that, The encryption of each piece of second data in the second data set based on the second private key and the order of the first base point includes: Perform a modulo operation on the second private key and the order of the first base point; Based on the result of the modulo operation, each second data is encrypted to obtain the intermediate data corresponding to each second data.

9. The method as described in claim 7, characterized in that, The encryption of each piece of second data in the second data set based on the second private key and the order of the first base point includes: A negotiation key is generated based on the first public key and the second private key, and the hash value of the negotiation key is calculated based on a hash function; the first public key is generated based on the first private key and the first base point; Using the hash value of the negotiated key as the salt, the hash value of each second data item is calculated based on the hash function; Based on the second private key and the order of the first base point, the hash values ​​of each of the second data are encrypted respectively.

10. A data processing method, characterized in that, The method includes: The first data set is encrypted using the first private key of the first device to obtain the first encrypted data set, and the first encrypted data set is then encrypted using the second public key of the second device to obtain the first target data set; the second public key is generated based on the second private key of the second device and the first base point; the first base point is generated based on the elliptic curve cryptography algorithm; Based on the second private key and the first base point, the second data set is encrypted to obtain a second encrypted data set, and the second encrypted data set is encrypted again based on the first private key to obtain a second target data set; the first data set and the second data set correspond to the same target service; The first target data set and the second target data set are complemented to obtain the data complement.

11. A data processing apparatus, characterized in that, Applied to the first device, including: The first receiving module is configured to receive a second public key sent by the second device, and encrypt a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by encrypting a first data set based on the first private key of the first device; the second public key is generated based on the second private key of the second device and a first base point; the first base point is generated based on an elliptic curve cryptography algorithm; The second receiving module is used to receive the second encrypted data set sent by the second device, and encrypt the second encrypted data set based on the first private key to obtain the second target data set; the second encrypted data set is obtained by the second device encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service; The complement processing module is used to perform complement processing on the first target data set and the second target data set to obtain the data complement.

12. A data processing apparatus, characterized in that, Applied to a second device, including: A first sending module is configured to send a second public key to a first device, so that the first device encrypts a first encrypted data set based on the second public key to obtain a first target data set; the first encrypted data set is obtained by the first device encrypting a first data set based on the first device's first private key; the second public key is generated based on the second device's second private key and a first base point; the first base point is generated based on an elliptic curve cryptography algorithm; The second sending module is used to send a second encrypted data set to the first device, so that the first device encrypts the second encrypted data set based on the first private key to obtain a second target data set, and performs a complement processing on the first target data set and the second target data set to obtain a data complement set; the second encrypted data set is obtained by encrypting the second data set based on the second private key and the first base point; the first data set and the second data set correspond to the same target service.

13. An electronic device, characterized in that, include: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method according to any one of claims 1-10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-10.

15. A computer program product, characterized in that, The computer program product includes: computer program code, which, when run on a computer, causes the computer to perform the method described in any one of claims 1-10.

Images