Method for immersive experience of user security and privacy based on homomorphic encryption
By negotiating with the terminal device to generate session keys in the data center, and encrypting user data using zero-trust security system and homomorphic encryption algorithm, the problems of privacy information leakage and data availability losses in the recommendation system are solved, and the security protection of user data is achieved and personalized services.
Patent Information
- Application Number
- CN202411351360.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2024-12-20
AI Technical Summary
In the prior art, the recommendation system has problems of privacy information leakage and data availability loss when processing user data, making it difficult to effectively protect user's privacy information.
Using a method based on homomorphic encryption, we negotiate with the terminal device to generate temporary session keys in the data center, and use the zero-trust security system and homomorphic encryption algorithm to encrypt user privacy information in real-time data to ensure that the encrypted data is calculated. No decryption is required to protect the privacy of user data.
It realizes the security of protecting user privacy information during transmission and storage, while also supports users to enjoy personalized services or recommendations while protecting privacy, avoiding data leakage and availability losses.
Smart Images
Figure CN119172053A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data encryption and privacy protection, and in particular to a method for immersive experience user security and privacy based on homomorphic encryption. Background Art
[0002] With the development and application of computing devices such as mobile terminals, users generate more and more data and information on computing devices such as mobile terminals. Applications such as big data analysis on these data can make these data generate higher value. However, in the existing technology, there are cases of leakage and illegal use of personal privacy information contained in these data.
[0003] As people's awareness of privacy protection increases, the privacy security of user data has received more and more attention, and privacy protection in recommendation systems has become important. Traditional recommendation algorithms often need to collect users' original data and upload it to the server to train a global model for recommendation, but this approach often leads to the problem of user privacy leakage.
[0004] Based on this, a variety of privacy protection technologies have been proposed and applied in recommendation systems. Among them, anonymization is the simplest and most direct privacy protection method, which can prevent the server or attacker from knowing the source user of the information, but the information itself still has the risk of leakage. Differential privacy technology is based on rigorous mathematical principles and has strong privacy protection capabilities, but it will lose data availability.
[0005] Therefore, how to protect the personal privacy information contained in the data during the data processing process has become a technical problem that needs to be solved urgently. Summary of the invention
[0006] The purpose of the present invention is to provide a method for immersive user experience security and privacy based on homomorphic encryption, which allows calculations to be performed on encrypted data without decryption, thereby protecting the privacy of user data. It can also be used to protect sensitive data such as user identity information, location information, and interactive behavior, preventing them from being stolen or abused during transmission or storage. In addition, homomorphic encryption can also support users to enjoy personalized services or recommendations while protecting their privacy.
[0007] To achieve the above object, the present invention provides a method for immersive experience user security and privacy based on homomorphic encryption, comprising the following steps:
[0008] Step S1: The data center generates a temporary session key by negotiating with the terminal device to securely obtain the real-time data generated by the user during the immersive experience process;
[0009] Step S2: When the real-time data of the data center needs to be used, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm.
[0010] Preferably, in step S1, the real-time data is encrypted by the terminal device using a session key and then uploaded to the data center via the access party.
[0011] Preferably, after the real-time data generated by the terminal is uploaded to the data center, the following process is implemented:
[0012] S111, establishing a user basic information database with unique user identification;
[0013] S112: Associating the received real-time data with the user basic information database, and collecting and storing the real-time data.
[0014] Preferably, the data center and the terminal device negotiate to generate an identical session key, specifically comprising the following steps:
[0015] S121. The data center receives the account number sent by the terminal device;
[0016] S122, obtaining a user key corresponding to the account, encrypting the user key and returning it to the terminal device, so that the terminal device can decrypt the user key, and use the user key and a randomly generated number to perform calculation to obtain a public first intermediate value;
[0017] S123. The data center uses the first intermediate value and another randomly generated number to perform calculations to obtain another public second intermediate value, and sends the second intermediate value to the terminal device.
[0018] S124. The terminal device and the server calculate and generate the same session key based on the intermediate value sent by the other party, that is, the terminal device receives the second intermediate value sent by the server, and the server receives the first intermediate value sent by the terminal device.
[0019] Preferably, in step S2, based on the zero-trust security architecture, during the access or decryption process of data by systems at all levels, their own attributes and the authenticity of the data must be verified, thereby protecting the security of data flow within the system.
[0020] Preferably, the real-time data of the data center includes the following types:
[0021] (1) The access direction sends real-time data to the data center;
[0022] (2) The access direction requests the data center to retain the data;
[0023] (3) The data center verifies the data calculation results with the access party.
[0024] Preferably, when the access party sends real-time data to the data center, the access rights to the real-time data are controlled based on the zero-trust security system, including: when the data center receives the real-time data uploaded by the access party, the authenticity of the real-time data is verified through a temporary session key generated by negotiation between the data center and the terminal device; if the real-time data passes the verification, the unique user identifier corresponding to the real-time data is collected and saved.
[0025] Preferably, when the access direction applies to the data center for data retention, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using a data desensitization algorithm. The specific process is as follows:
[0026] A. Receive the data retention application initiated by the access party to the data center, and verify the data access rights of the access party based on the zero-trust security system;
[0027] B. If the access party passes the verification, the ciphertext data obtained by encrypting the data required for the retained data application using the data desensitization algorithm will be returned to the access party.
[0028] Preferably, when the data center verifies the data calculation results with the access party, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm. The specific process is as follows:
[0029] a. The data center uses a homomorphic encryption algorithm to encrypt the real-time data that the access party wants to retain, and sends the encrypted real-time data to the access party for retention;
[0030] b. The data center obtains the encrypted calculation results obtained by the access party through mathematical operations on the retained real-time data;
[0031] c. The data center performs the same mathematical operation on the plaintext data corresponding to the real-time data used in the encrypted calculation result to obtain the plaintext calculation result;
[0032] d. Decrypt the encrypted calculation result and verify the decrypted encrypted calculation result according to the plaintext calculation result.
[0033] Therefore, the present invention adopts the above-mentioned method of immersive experience user security and privacy based on homomorphic encryption, allowing calculations to be performed on encrypted data without decryption, thereby protecting the privacy of user data, and can also be used to protect sensitive data such as user identity information, location information, and interactive behavior to prevent them from being stolen or abused during transmission or storage. In addition, homomorphic encryption can also support users to enjoy personalized services or recommendations while protecting their privacy.
[0034] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 It is an implementation flow chart of a method for immersive experience user security and privacy based on homomorphic encryption of the present invention. DETAILED DESCRIPTION
[0036] The technical solution of the present invention is further described below through the accompanying drawings and embodiments.
[0037] like Figure 1 As shown, the present invention provides a method for immersive experience user security and privacy based on homomorphic encryption, comprising the following steps:
[0038] Step S1: The data center generates a temporary session key by negotiating with the terminal device to securely obtain the real-time data generated by the user during the immersive experience process;
[0039] Step S2: When the real-time data of the data center needs to be used, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm.
[0040] Example
[0041] Step S1: The data center generates a temporary session key by negotiating with the terminal device to securely obtain real-time data generated by the user during the immersive experience process.
[0042] The real-time data is encrypted by the terminal device using the session key and then uploaded to the data center via the access party.
[0043] S11. After the real-time data generated by the terminal is uploaded to the data center, the following process is implemented:
[0044] S111, establishing a user basic information database with unique user identification;
[0045] S112: Associating the received real-time data with the user basic information database, and collecting and storing the real-time data.
[0046] S12: The data center and the terminal device negotiate to generate an identical session key, which specifically includes the following steps:
[0047] S121. The data center receives the account number sent by the terminal device;
[0048] S122, obtaining a user key corresponding to the account, encrypting the user key and returning it to the terminal device, so that the terminal device can decrypt the user key, and use the user key and a randomly generated number to perform calculation to obtain a public first intermediate value;
[0049] S123. The data center uses the first intermediate value and another randomly generated number to perform calculations to obtain another public second intermediate value, and sends the second intermediate value to the terminal device.
[0050] S124. The terminal device and the server respectively calculate and generate the same session key according to the intermediate value sent by the other party (ie, the terminal device receives the second intermediate value sent by the server, and the server receives the first intermediate value sent by the terminal device).
[0051] It can be seen that in the above-mentioned session key negotiation and generation process, the key is obtained by calculating the intermediate value, so that one-time one-key can be achieved, that is, the key used for each real-time data generated is generated instantly and destroyed after the encryption is completed. When the key is needed next time real-time data is generated, a new session key can be regenerated, thereby ensuring data security.
[0052] Step S2: When the real-time data of the data center needs to be used, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm.
[0053] The data generated by users when using terminal devices is uploaded to the data center for unified management, and the use of this data is controlled by a zero-trust security system, and data encryption protection is performed to ensure that the user's privacy information in the data will not be leaked at any stage of data use.
[0054] Among them, the zero-trust security system means that for the system including data centers, access parties and terminal devices, no one or anything in the data center and access party will be automatically trusted.
[0055] Based on this zero-trust security architecture, when accessing or decrypting data, systems at all levels need to verify their own attributes and the authenticity of the data, thereby protecting the security of data flow within the system and being able to extend it externally.
[0056] The real-time data of the data center includes the following types:
[0057] (1) The access direction sends real-time data to the data center.
[0058] When the access direction sends real-time data to the data center, the access rights to the real-time data are controlled based on the zero-trust security system, including:
[0059] When the data center receives real-time data uploaded by the access party, the authenticity of the real-time data is verified through a temporary session key generated by negotiation between the data center and the terminal device; if the real-time data passes the verification, the unique user identifier corresponding to the real-time data is collected and saved.
[0060] It can be seen from this that when real-time data flows in the system, the zero-trust security system will also verify the authenticity of the data to ensure the security of the data.
[0061] (2) The access direction applies to the data center for data retention.
[0062] When the access direction applies to the data center for data retention, the access rights to real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the data desensitization algorithm. The specific process is as follows:
[0063] A. Receive the data retention application initiated by the access party to the data center, and verify the data access rights of the access party based on the zero-trust security system;
[0064] B. If the access party passes the verification, the ciphertext data obtained by encrypting the data required for the retained data application using the data desensitization algorithm will be returned to the access party.
[0065] It is worth noting that when the access party applies for data retention, it obtains the privacy-processed data from the data center through the verification of the zero-trust security system, such as encrypting the privacy data with a data desensitization algorithm or a homomorphic encryption algorithm. Therefore, the access party can analyze the data but cannot access the real user privacy data.
[0066] Among them, the data desensitization algorithm processes the data, that is, deforms the sensitive privacy data in a specific form, to achieve the protection of sensitive privacy data, so that the sensitive data can be used normally without being illegally used, thereby enhancing the security of the data.
[0067] For example, real-time data contains information such as serial number, name, gender, age, ID number and mobile phone number of a natural person. Name, ID number and mobile phone number are private data of the user. The data desensitization algorithm is used to replace the name, confuse the ID number, and hide the middle digits of the mobile phone number, while other fields remain unchanged. In this way, the desensitization transformation of a piece of data is achieved without changing the serial number.
[0068] (3) The data center verifies the data calculation results with the access party.
[0069] When the data center verifies the data calculation results with the access party, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm. The specific process is as follows:
[0070] a. The data center uses a homomorphic encryption algorithm to encrypt the real-time data that the access party wants to retain, and sends the encrypted real-time data to the access party for retention;
[0071] b. The data center obtains the encrypted calculation results obtained by the access party through mathematical operations on the retained real-time data;
[0072] c. The data center performs the same mathematical operation on the plaintext data corresponding to the real-time data used in the encrypted calculation result to obtain the plaintext calculation result;
[0073] d. Decrypt the encrypted calculation result and verify the decrypted encrypted calculation result according to the plaintext calculation result.
[0074] If the result obtained by processing the encrypted data is still consistent with the result obtained by performing the same processing on the unencrypted data, the consistency here is the concept of homomorphism, which is applicable to numerical data that are subject to mathematical operations, so that the encrypted data can still have the value of data analysis; if the encrypted calculation result is inconsistent with the plaintext calculation result of the data center, the verification result will be fed back to the access party, so that the access party can activate the corresponding exception mechanism for processing.
[0075] In practice, the above process can be used for reconciliation. For example, when the data center and the receiver both obtain transaction data within a time period, the data center has the plaintext data, and the receiver can only obtain the homomorphically encrypted data. In this way, both sides can calculate and verify the amount at the same time to complete a reconciliation. Among them, the data center has the highest authority and can decrypt the ciphertext calculation results of the data uploaded by the access party.
[0076] Therefore, the present invention adopts the above-mentioned method of immersive experience user security and privacy based on homomorphic encryption, allowing calculations to be performed on encrypted data without decryption, thereby protecting the privacy of user data, and can also be used to protect sensitive data such as user identity information, location information, and interactive behavior to prevent them from being stolen or abused during transmission or storage. In addition, homomorphic encryption can also support users to enjoy personalized services or recommendations while protecting their privacy.
[0077] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.
Claims
1. A method for immersive user experience security and privacy based on homomorphic encryption, characterized in that: The following steps are involved: Step S1: The data center generates a temporary session key by negotiating with the terminal device to securely obtain the real-time data generated by the user during the immersive experience process; Step S2: When the real-time data of the data center needs to be used, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm.
2. According to claim 1, a method for immersive experience user security and privacy based on homomorphic encryption is characterized in that: In step S1, the real-time data is encrypted by the terminal device using a session key and then uploaded to the data center via the access party.
3. According to claim 2, a method for immersive user experience security and privacy based on homomorphic encryption is characterized in that: After the real-time data generated by the terminal is uploaded to the data center, the following process is implemented: S111, establishing a user basic information database with unique user identification; S112: Associating the received real-time data with the user basic information database, and collecting and storing the real-time data.
4. According to claim 1, a method for immersive experience user security and privacy based on homomorphic encryption is characterized in that: The data center and the terminal device negotiate to generate an identical session key, which includes the following steps: S121. The data center receives the account number sent by the terminal device; S122, obtaining a user key corresponding to the account, encrypting the user key and returning it to the terminal device, so that the terminal device can decrypt the user key, and use the user key and a randomly generated number to perform calculation to obtain a public first intermediate value; S123. The data center uses the first intermediate value and another randomly generated number to perform calculations to obtain another public second intermediate value, and sends the second intermediate value to the terminal device. S124. The terminal device and the server calculate and generate the same session key based on the intermediate value sent by the other party, that is, the terminal device receives the second intermediate value sent by the server, and the server receives the first intermediate value sent by the terminal device.
5. The method for immersive user experience security and privacy based on homomorphic encryption according to claim 1, characterized in that: In step S2, based on the zero-trust security architecture, when systems at all levels access or decrypt data, they must verify their own attributes and the authenticity of the data, thereby protecting the security of data flow within the system.
6. The method for immersive user experience security and privacy based on homomorphic encryption according to claim 1, characterized in that: The real-time data in the data center includes the following types: (1) The access direction sends real-time data to the data center; (2) The access direction requests the data center to retain the data; (3) The data center verifies the data calculation results with the access party.
7. The method for immersive user experience security and privacy based on homomorphic encryption according to claim 6, characterized in that: When the access party sends real-time data to the data center, the access rights to the real-time data are controlled based on the zero-trust security system, including: when the data center receives the real-time data uploaded by the access party, the authenticity of the real-time data is verified through a temporary session key generated by negotiation between the data center and the terminal device; if the real-time data passes the verification, the unique user identifier corresponding to the real-time data is collected and saved.
8. The method for immersive user experience security and privacy based on homomorphic encryption according to claim 6, characterized in that: When the access direction applies to the data center for data retention, the access rights to real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the data desensitization algorithm. The specific process is as follows: A. Receive the data retention application initiated by the access party to the data center, and verify the data access rights of the access party based on the zero-trust security system; B. If the access party passes the verification, the ciphertext data obtained by encrypting the data required for the retained data application using the data desensitization algorithm will be returned to the access party.
9. The method for immersive user experience security and privacy based on homomorphic encryption according to claim 6, characterized in that: When the data center verifies the data calculation results with the access party, the access rights to the real-time data are controlled based on the zero-trust security system, and the user privacy information in the real-time data is encrypted using the homomorphic encryption algorithm. The specific process is as follows: a. The data center uses a homomorphic encryption algorithm to encrypt the real-time data that the access party wants to retain, and sends the encrypted real-time data to the access party for retention; b. The data center obtains the encrypted calculation results obtained by the access party through mathematical operations on the retained real-time data; c. The data center performs the same mathematical operation on the plaintext data corresponding to the real-time data used in the encrypted calculation result to obtain the plaintext calculation result; d. Decrypt the encrypted calculation result and verify the decrypted encrypted calculation result according to the plaintext calculation result.