Data processing method and device, computer equipment and storage medium

Abstract

The invention provides a data processing method and device, computer equipment and a storage medium, the method is applied to a gateway system, the gateway system is deployed in a trusted execution environment of a server, and the method comprises the following steps: receiving a dialogue request sent by a user side; performing transformation processing on to-be-processed data included in the dialogue request to generate a processed dialogue request, the to-be-processed data being data having security requirements; sending the processed dialogue request to a third-party server deployed with a language network model, and receiving initial response data returned by the third-party server, the initial response data being generated by the third-party server by using the language network model in response to the processed dialogue request; and based on the to-be-processed data in the dialogue request, adjusting the initial response data to generate target response data, and sending the target response data to the user side.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a data processing method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of technology, artificial intelligence large language models (LLM) have been widely used in many industries, such as language translation industry, game industry, etc. Among them, by calling the network interface of LLM service, a dialogue with LLM can be realized to obtain the desired results. However, the above method has the problem of terminal data leakage, which makes the dialogue process with LLM less secure. Summary of the invention

[0003] The embodiments of the present disclosure at least provide a data processing method, apparatus, computer equipment, and storage medium.

[0004] In a first aspect, an embodiment of the present disclosure provides a data processing method, which is applied to a gateway system, wherein the gateway system is deployed in a trusted execution environment of a server, and the method includes:

[0005] Receive a conversation request sent by the user end;

[0006] Transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements;

[0007] Sending the processed dialogue request to a third-party server deployed with a language network model, and receiving initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request;

[0008] Based on the data to be processed in the dialog request, the initial response data is adjusted to generate target response data, and the target response data is sent to the user terminal.

[0009] In an optional implementation manner, the dialogue request includes a data tag for indicating the data to be processed; and the transforming the data to be processed included in the dialogue request to generate a processed dialogue request includes:

[0010] Determine the data type and transformation level of the data to be processed indicated by the data tag based on the information table included in the dialogue request; or determine the data type and transformation level of the data to be processed indicated by the data tag based on the tag type of the data tag included in the dialogue request;

[0011] Determining a target processing algorithm corresponding to the data to be processed based on the data type and the transformation level;

[0012] The target processing algorithm is used to transform the data to be processed indicated by the data tag to generate a post-processing dialogue request.

[0013] In an optional implementation manner, the using the target processing algorithm to transform the data to be processed indicated by the data tag to generate a post-processing dialogue request includes:

[0014] Using the target processing algorithm, transform the data to be processed to generate processed data corresponding to the data to be processed;

[0015] A processed dialog request is generated based on other data in the dialog request except the to-be-processed data, the processed data, and preset instruction data for indicating that the data mark is retained.

[0016] In an optional implementation manner, the initial response data packet contains the data tag, and the step of adjusting the initial response data based on the to-be-processed data in the dialogue request to generate the target response data includes:

[0017] Determining processed data included in the initial response data based on the data tag included in the initial response data;

[0018] The processed data in the initial response data is replaced with the corresponding data to be processed to generate target response data.

[0019] In an optional implementation manner, after receiving the conversation request sent by the user terminal, the method further includes: performing authority verification on the user terminal based on the user terminal identifier carried in the conversation request to obtain an authority verification result;

[0020] The transforming the data to be processed included in the dialog request to generate a processed dialog request includes: when the authority verification result indicates that the user terminal has the use authority, transforming the data to be processed included in the dialog request to generate a processed dialog request.

[0021] In an optional implementation manner, before receiving the dialog request sent by the user terminal, the method further includes:

[0022] Receive the data to be verified sent by the user end;

[0023] Generate target verification data based on the data to be verified and the trust root module included in the trusted execution environment;

[0024] The target verification data is sent to the user terminal, and the user terminal is used to verify the target verification data and generate a verification result indicating whether the gateway system is running in a trusted execution environment.

[0025] In an optional implementation manner, the data to be verified is generated based on the initialization data generated by the user terminal and the first public key information included in the gateway system; the method further includes: receiving the second public key information sent by the user terminal;

[0026] The generating target verification data based on the data to be verified and the trust root module included in the trusted execution environment includes:

[0027] Using the first private key information contained in the gateway system, the data to be verified is parsed to obtain the initialization data;

[0028] Generate report data based on the initialization data and the second public key information;

[0029] The report data is processed using a trust root module included in the trusted execution environment to generate target verification data.

[0030] In an optional implementation manner, the conversation request is encrypted using a determined first session key, where the first session key is generated based on the first public key information and the second private key information; after receiving the conversation request sent by the user terminal, the method further includes:

[0031] Generate a second session key based on the first private key information and the second public key information;

[0032] The conversation request is parsed using the second session key to obtain a parsed conversation request.

[0033] In a second aspect, an embodiment of the present disclosure further provides a data processing device, which is applied to a gateway system, wherein the gateway system is deployed in a trusted execution environment of a server, and the device includes:

[0034] A receiving module, used for receiving a conversation request sent by a user terminal;

[0035] A processing module, used for transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements;

[0036] a sending module, configured to send the processed dialogue request to a third-party server on which a language network model is deployed, and receive initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request;

[0037] A generating module is used to adjust the initial response data based on the data to be processed in the dialogue request, generate target response data, and send the target response data to the user terminal.

[0038] In a third aspect, an embodiment of the present disclosure further provides a computer device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned first aspect, or any possible implementation of the first aspect are performed.

[0039] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect or any possible implementation of the first aspect are executed.

[0040] The data processing method, device, computer equipment and storage medium provided by the embodiments of the present disclosure are applied to a gateway system, so that the gateway system can manage the interaction process between the user terminal and a third-party server deployed with a language network model, and determine the security of the terminal data (data provided by the user terminal) during the interaction process. In addition, the gateway system is deployed in the trusted execution environment of the server, so that other devices such as the third server cannot obtain the data provided by the user terminal, thereby ensuring the security of the terminal data.

[0041] In specific implementation, in this method, after receiving the dialogue request sent by the user end, the data to be processed contained in the dialogue request can be transformed to generate a processed dialogue request. Since the data to be processed is data with security requirements, the problem of leakage of the data to be processed can be alleviated by transforming the data to be processed, and the security of the data to be processed can be guaranteed, that is, the generated processed dialogue request meets the security requirements. Then, the processed dialogue request can be sent to a third-party server deployed with a language network model, and the initial response data returned by the third-party server is received. Then, based on the data to be processed in the dialogue request, the initial response data is adjusted to generate the target response data, so that the target response data meets the user's needs and improves the accuracy of the target response data.

[0042] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0044] Figure 1 A flow chart of a data processing method provided by an embodiment of the present disclosure is shown;

[0045] Figure 2 A flowchart showing another data processing method provided by an embodiment of the present disclosure is shown;

[0046] Figure 3 A schematic diagram of the structure of a gateway system provided by an embodiment of the present disclosure is shown;

[0047] Figure 4 A schematic diagram of the structure of a data processing device provided by an embodiment of the present disclosure is shown;

[0048] Figure 5 A schematic diagram of the structure of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0050] After research, it was found that the process of communicating with LLM by calling the network interface of the LLM service may cause the terminal data to be leaked, making the communication process with LLM less secure. At the same time, each terminal calls the network interface to communicate with LLM separately, making it difficult to manage the communication process of each terminal, and thus unable to guarantee the security of the terminal data in the communication process.

[0051] Based on the above research, the present disclosure provides a data processing method, which is applied to a gateway system, so that the gateway system can manage the interaction process between the user terminal and a third-party server deployed with a language network model, and determine the security of the terminal data (data provided by the user terminal) during the interaction process. In addition, the gateway system is deployed in the trusted execution environment of the server, so that other devices such as the third server cannot obtain the data provided by the user terminal, thereby ensuring the security of the terminal data.

[0052] In specific implementation, in this method, after receiving the dialogue request sent by the user end, the data to be processed contained in the dialogue request can be transformed to generate a processed dialogue request. Since the data to be processed is data with security requirements, the problem of leakage of the data to be processed can be alleviated by transforming the data to be processed, and the security of the data to be processed can be guaranteed, that is, the generated processed dialogue request meets the security requirements. Then, the processed dialogue request can be sent to a third-party server deployed with a language network model, and the initial response data returned by the third-party server is received. Then, based on the data to be processed in the dialogue request, the initial response data is adjusted to generate the target response data, so that the target response data meets the user's needs and improves the accuracy of the target response data.

[0053] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0054] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0055] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0056] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0057] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0058] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0059] To facilitate understanding of this embodiment, a data processing method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the data processing method provided in the embodiment of the present disclosure may be a gateway system, which is deployed in the trusted execution environment of the server. The server may be connected to one or more user terminals in communication, that is, the user terminal and the server with the gateway system deployed are located in the same target domain, while the third-party server with the language network model deployed is located outside the target domain. In some possible implementations, the data processing method may be implemented by a processor calling a computer-readable instruction stored in a memory.

[0060] See also Figure 1 FIG. 1 is a flowchart of a data processing method provided by an embodiment of the present disclosure, wherein the method includes S101 to S104, wherein:

[0061] S101, receiving a conversation request sent by a user terminal;

[0062] S102, transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements;

[0063] S103, sending the processed dialogue request to a third-party server on which a language network model is deployed, and receiving initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request;

[0064] S104, adjusting the initial response data based on the to-be-processed data in the dialogue request, generating target response data, and sending the target response data to the user terminal.

[0065] The following is a detailed description of S101-S104.

[0066] For S101:

[0067] During implementation, the user terminal can input the conversation content on the terminal interface, the conversation content includes multiple data, generate a conversation request according to the conversation content, and send the conversation request to the gateway system of the server. For example, the conversation request may include "xxxxxdata1, xxxdata2xxxxx, xxdata3xxxxx", etc., where data1, data2, and data3 can be data to be processed with security requirements, and "xx..." can represent other data without security requirements.

[0068] The conversation content may include a data tag for indicating the data to be processed, so that the generated conversation request includes the data tag, and the data tag may be set as needed. For example, the conversation content may include "xxxxx{{data1}}, xxx{{data2}}xxxxx, xx{{data3}}xxxxx", and the data tag may be "{{}}".

[0069] The dialog request may also include the data type and / or transformation level corresponding to the data to be processed. When the dialog request includes the data type but does not include the transformation level, a mapping relationship between the data type and the processing algorithm may be set so that the target processing algorithm for the data to be processed is subsequently determined according to the data type. When the dialog request does not include the data type but includes the transformation level, a mapping relationship between the transformation level and the processing algorithm may be set so that the target processing algorithm for the data to be processed is subsequently determined according to the transformation level. When the dialog request includes the data type and the transformation level, a mapping relationship between the data type and the transformation level and the processing algorithm may be set so that the target processing algorithm for the data to be processed is subsequently determined according to the data type and the transformation level.

[0070] In an optional implementation, the dialog request may further include an information table, in which the data type and transformation level of the to-be-processed data indicated by each data identifier are stored. For example, the dialog request may include "xxxxx{{data1}}, xxx{{data2}}xxxxx, xx{{data3}}xxxxx", with the data marked as "{{}}", and the exemplary information table included in the dialog request may be as follows:

[0071]

[0072]

[0073] According to the above table, the data type of the data to be processed data1 can be the numeric type num, the transformation level is 1, the data type of the data to be processed data2 can be the character type char, the transformation level can be 2, the data type of the data to be processed data3 can be the character type char, the transformation level can be 3, and so on.

[0074] In another optional implementation, the data tags used to indicate the data to be processed in the dialog request may have multiple tag types, and different tag types correspond to different data types and transformation levels. For example, the data tags may include "{}", "{{}}", "{{{}}}", "[]", "[[]]", "[[[]]]", and the data type corresponding to the data tag "{}" may be num, and the transformation level may be 1, and the data type corresponding to the data tag "{{}}" may be num, and the transformation level may be 2, etc. Similarly, the data type corresponding to the data tag "[]" may be char, and the transformation level may be 1, and the data type corresponding to the data tag "[[]]" may be char, and the transformation level may be 2, etc.

[0075] The client may include the second public key information Pub A And the second private key information pri A , and the gateway system may include first public key information and first private key information. Exemplarily, the first public key information and the first private key information may be key information based on an elliptic curve, that is, the first public key information Pub B With the first private key information pri B Has the following relationship: Pub B =[pri B ]×P, where P is the elliptic curve generator.

[0076] During implementation, after the user receives the conversation content, a key negotiation protocol can be used to generate a symmetric key, namely, a first session key and a second session key. The user uses the first session key to sign a conversation request, and the gateway system uses the second session key to parse the conversation request. The first session key is generated based on the first public key information and the second private key information; the second session key is generated based on the second public key information and the first private key information. By setting the session key, the security of the communication process can be guaranteed.

[0077] In an optional implementation, the conversation request is encrypted using a determined first session key, and the first session key is generated based on the first public key information and the second private key information; after receiving the conversation request sent by the user end, the method further includes: generating a second session key based on the first private key information and the second public key information; and parsing the conversation request using the second session key to obtain a parsed conversation request.

[0078] Exemplarily, the first session key is obtained according to the following formula (1):

[0079] Pub AB =[pri A ]×Pub B =(X AB ,Y AB ) (1)

[0080] The second session key is obtained according to the following formula (2):

[0081] Pub AB =[pri B ]×Pub A =(X AB ,Y AB ) (2)

[0082] When implementing, you can also select X AB , or Y AB As the first session key and the second session key. The first session key and the second session key may be set with an effective period, such as a preset time period or the number of conversations.

[0083] After receiving the conversation request sent by the user end, a second session key can be generated first, and the conversation request can be parsed using the second session key to obtain a parsed conversation request. The parsed conversation request contains various data, so that the data to be processed contained in the parsed conversation request can be subsequently transformed and processed.

[0084] In specific implementation, the gateway system can also authorize each user terminal in the target domain during the system initialization phase, so that the conversation request of the user terminal with usage authority can be processed later, thereby improving the security of the method, wherein the authority verification method may include but is not limited to a token, a public key, a certificate, etc. For example, after authorizing each user terminal, a whitelist can be maintained in the gateway system, and the whitelist stores the user terminal identification of each user terminal.

[0085] In an optional implementation manner, after receiving the dialog request sent by the user terminal, the method further includes: performing authority verification on the user terminal based on the user terminal identifier carried in the dialog request to obtain an authority verification result.

[0086] The conversation request may carry a user terminal identifier. The gateway system performs permission verification on the user terminal based on the user terminal identifier. For example, it may determine from the whitelist whether the user terminal identifier exists. If so, the permission verification result may indicate that the user terminal has permission to use. Otherwise, if not, the permission verification result may indicate that the user terminal does not have permission to use.

[0087] When the authority verification result indicates that the user terminal has the use authority, the data to be processed contained in the dialogue request is transformed to generate a processed dialogue request. When the authority verification result indicates that the user terminal does not have the use authority, no subsequent processing is performed and the dialogue process ends.

[0088] For S102:

[0089] During implementation, the data to be processed included in the conversation request can be determined, and the data to be processed can be transformed to generate processed data, and then a processed conversation request can be generated based on the processed data. The data to be processed can be data with security requirements, and the data to be processed can be set as needed, for example, the data to be processed can be telephone data, email data, etc.

[0090] Exemplarily, if the dialog request includes a data tag, the data to be processed may be determined based on the data tag. And / or, the trained neural network model may be used to detect each data included in the dialog request to determine the data to be processed. And / or, the data to be processed in the dialog request may also be determined based on a regular expression representing the data format of the data to be processed.

[0091] After determining the data to be processed, a preset processing algorithm can be used to transform at least one data to be processed included in the dialog request to generate a processed dialog request. The preset processing algorithm can be set as needed, such as a hash algorithm, an encryption algorithm, etc.

[0092] When the dialogue request includes the data type of the data to be processed, the target processing algorithm corresponding to the data to be processed can be determined based on the data type; when the dialogue request includes the transformation level of the data to be processed, the target processing algorithm corresponding to the data to be processed can be determined based on the transformation level; when the dialogue request includes the data type and transformation level of the data to be processed, the target processing algorithm corresponding to the data to be processed can be determined based on the data type and the transformation level, so that the data to be processed can be transformed by using the target processing algorithm.

[0093] Alternatively, the dialog request may include the data type of the data to be processed and the request level of the dialog request, and the request level is determined as the transformation level of each data to be processed in the dialog request, that is, the transformation level of each data to be processed in the dialog request is the same.

[0094] In an optional implementation manner, the dialog request includes a data tag for indicating the data to be processed; and the transforming the data to be processed included in the dialog request to generate a processed dialog request specifically includes:

[0095] Step A1, based on the information table contained in the dialogue request, determine the data type and transformation level of the data to be processed indicated by the data tag; or, based on the tag type of the data tag contained in the dialogue request, determine the data type and transformation level of the data to be processed indicated by the data tag.

[0096] Step A2, determining a target processing algorithm corresponding to the data to be processed based on the data type and the transformation level;

[0097] Step A3, using the target processing algorithm, transforming the data to be processed indicated by the data tag to generate a processed dialogue request.

[0098] In step A1, in one way, if the dialog request includes an information table, the data type and transformation level of the data to be processed indicated by the data tag can be determined from the information table. The information table includes the data type and transformation level corresponding to each data tag. In another way, multiple data tags of different tag types can be set, and data tags of different tag types correspond to different data types and transformation levels. Therefore, the data type and transformation level of the data to be processed indicated by the data tag can be determined according to the tag type of the data tag included in the dialog request.

[0099] In step A2, a mapping relationship between the transformation level of the data type and the processing algorithm can be set, so that the target processing algorithm matched with the dialog request can be determined according to the data type and transformation level of the data to be processed. For example, the processing algorithm corresponding to different transformation levels can be determined for each data type. The larger the transformation level, the greater the degree of transformation of the data by the corresponding processing algorithm, that is, the greater the degree to which the original semantics of the data are lost after processing, and the greater the difficulty of restoration.

[0100] Exemplarily, for the data type of the numeric type num, three transformation levels can be set. When the transformation level is level one, the corresponding processing algorithm can be a scaling algorithm or a translation algorithm, that is, the scaling algorithm can scale the numerical value, and the translation algorithm can shift the numerical value left or right, etc.; when the transformation level is level two, the corresponding processing algorithm can be an encryption algorithm; when the transformation level is level three, the corresponding processing algorithm can be a rounding algorithm or a truncation algorithm, the rounding algorithm can round the numerical value, and the truncation algorithm can truncate the numerical value, etc.

[0101] For example, for the data type of character type char, three transformation levels can be set. When the transformation level is level one, the corresponding processing algorithm can be an obfuscation algorithm; when the transformation level is level two, the corresponding processing algorithm can be an encryption algorithm, and the encryption algorithm can be selected as needed, such as a symmetric encryption algorithm; when the transformation level is level three, the corresponding processing algorithm can be a hash algorithm, etc.

[0102] According to the data type and transformation level of the data to be processed, as well as the mapping relationship between the transformation level of the determined data type and the processing algorithm, the target processing algorithm matching the data to be processed is determined; for example, if the data type of the data to be processed is char and the transformation level is level 2, the target processing algorithm can be an encryption algorithm. By setting the processing algorithms corresponding to different transformation levels under different data types, the flexibility of transformation processing is higher, and while ensuring data security, the diversity of transformation processing is improved to meet the needs of the user end.

[0103] In step A3, the data to be processed indicated by the data tag can be determined. For example, if the dialog request contains the data "xxxxxnum{{data1}}", where "{{}}" is the data tag, data1 is the data to be processed. Then, the target processing algorithm corresponding to the data to be processed is used to transform the data to be processed and generate a processed dialog request.

[0104] During implementation, in order to ensure that data is not leaked during the conversation, each data included in the conversation request can also be detected to determine other data to be processed in addition to the data to be processed indicated by the data identifier. For example, it can be identified based on regular expressions, neural network models, etc. For example, for phone number data, a regular expression representing the structure of the phone number can be generated, and the data in the conversation request that meets the regular expression is determined as data to be processed with security requirements. That is, the data to be processed included in the conversation request may include the data to be processed indicated by the data tag and the data to be processed obtained by identification, wherein the data to be processed obtained by identification can be transformed using a preset processing algorithm.

[0105] The target processing algorithm is used to transform the data to be processed indicated by the data tag to obtain processed data, and then a processed dialogue request is generated based on the processed data and other unprocessed data in the dialogue request.

[0106] In a specific implementation, the target processing algorithm is used to transform the data to be processed indicated by the data tag to generate a post-processing dialogue request, including: using the target processing algorithm to transform the data to be processed to generate processed data corresponding to the data to be processed; based on other data in the dialogue request except the data to be processed, the processed data, and preset instruction data for indicating that the data tag is retained, the post-processing dialogue request is generated.

[0107] In order to prevent the data mark in the initial response data received subsequently from being lost, instruction data for indicating that the data mark is retained can be preset. After the data to be processed is transformed and processed by the target processing algorithm to generate processed data corresponding to the data to be processed, the data to be processed and the corresponding processed data can be associated and cached in the cache module. And based on other data in the dialogue request except the data to be processed, the processed data, and the preset instruction data for indicating that the data mark is retained, a processed dialogue request can be generated.

[0108] For S103 and S104:

[0109] After the processed dialogue request is generated, the processed dialogue request is sent to a third-party server where a language network model is deployed; the third-party server responds to the processed dialogue request, calls the language network model to generate initial response data, and returns the initial response data to the gateway system. The language network model is a large model obtained through training.

[0110] During implementation, in order to prevent the data tags in the initial guidance data returned by the language network model from being lost, the trained language network model can be fine-tuned using the training samples to obtain a fine-tuned language network model. The training samples include sample conversation data and sample response data associated with the sample conversation data, and both the sample conversation data and the sample response data include data tags.

[0111] When the processed dialog request indicates instruction data with data tags reserved, the initial response data returned by the fine-tuned language network model may include the data tags. Further, based on the data to be processed in the dialog request, the content indicated by the data tags of the initial response data may be adjusted, such as adjusting the content indicated by the data tags to the data to be processed, obtaining target response data, and returning the target response data to the user end.

[0112] Alternatively, if the initial response data does not include a data tag, the initial response data may be detected to determine the processed data included in the initial response data, and then the processed data may be replaced with the unprocessed data in the dialogue request to generate the target response data.

[0113] In an optional implementation, the initial response data packet contains the data tag, and the initial response data is adjusted based on the data to be processed in the dialogue request to generate target response data, including: determining the processed data contained in the initial response data based on the data tag contained in the initial response data; replacing the processed data in the initial response data with the corresponding data to be processed to generate target response data.

[0114] The processed data can be determined based on the data tags included in the initial response data; or the processed data included in the initial response data can be determined based on the stored data to be processed and the associated processed data. Then the processed data in the initial response data is replaced with the corresponding data to be processed to generate the target response data.

[0115] If the initial response data does not include the processed data, the initial response data may be directly sent to the user end as the target response data.

[0116] Here, the target response data is obtained by restoring the processed data in the initial response data to the data to be processed, thereby ensuring the accuracy of the feedback data (ie, the target response data) of the dialogue request received by the user end.

[0117] After the gateway system is deployed in the trusted execution environment of the server, the client can verify the gateway system to determine whether the gateway system is running in the trusted execution environment (TEE).

[0118] In an optional implementation manner, before receiving the dialog request sent by the user terminal, the method further includes:

[0119] Step B1, receiving the data to be verified sent by the user terminal;

[0120] Step B2, generating target verification data based on the data to be verified and the trust root module included in the trusted execution environment;

[0121] Step B3: sending the target verification data to the user terminal, and the user terminal is used to verify the target verification data and generate a verification result indicating whether the gateway system is running in a trusted execution environment.

[0122] The data to be verified can be generated by the user end according to the agreed rules and agreed algorithms. For example, the user end can generate initialization data (such as a randomly generated string of specific bytes), and then use an encryption algorithm such as an elliptic curve encryption algorithm and the first public key information to encrypt the initialization data to generate the data to be verified. That is, the data to be verified is generated based on the initialization data generated by the user end and the first public key information contained in the gateway system.

[0123] Furthermore, the trusted root module included in the trusted execution environment can process the data to be verified, generate target verification data, and send the target verification data to the user end so that the user end can verify the target verification data and generate a verification result indicating whether the gateway system is running in the trusted execution environment.

[0124] In an optional implementation, the user terminal may also send a second public key information to the gateway system; step B2, generating target verification data based on the data to be verified and the trusted root module included in the trusted execution environment, specifically includes: using the first private key information included in the gateway system to parse the data to be verified to obtain the initialization data; generating report data based on the initialization data and the second public key information; using the trusted root module included in the trusted execution environment to process the report data to generate target verification data.

[0125] When the data to be verified is encrypted using the first public key information, the first private key information can be used to parse the data to be verified to obtain the initialization data. Here, the security of the data can be guaranteed by encrypting the initialization data and transmitting it to avoid tampering. The initialization data and the second public key information can then be processed to generate report data, such as performing hash processing on the initialization data and the second public key information to generate report data. The trust root module included in the trusted execution environment can then be used to process the report data to generate target verification data.

[0126] See also Figure 2 As shown, combined Figure 2 The data processing method is exemplarily described. The method includes:

[0127] S201, accepting a dialog request sent by a user terminal.

[0128] S202, determining whether the user terminal has the use authority.

[0129] For example, based on the user terminal identifier carried in the dialog request, the user terminal can be authenticated to obtain an authentication result. When the authentication result indicates that the user terminal does not have the use authority, the process ends. When the authentication result indicates that the user terminal has the use authority, step S203 is executed.

[0130] S203, parsing to obtain the data to be processed, the data type and the transformation level.

[0131] The dialog request includes a data tag, and the dialog request is parsed to obtain the data to be processed indicated by the data tag. The data type and transformation level of the data to be processed indicated by the data tag can be obtained according to the information table included in the dialog request. Alternatively, the data type and transformation level of the data to be processed indicated by the data tag can be determined according to the tag type of the data tag.

[0132] S204, using a built-in preset algorithm to check and fill in gaps in the dialogue request.

[0133] For example, a preset algorithm such as a regular expression, a neural network model, etc. is used to identify data in the dialog request other than the data to be processed indicated by the data tag, and determine other data to be processed. The data to be processed indicated by the data tag and the identified other data to be processed constitute the data to be processed included in the dialog request.

[0134] S205, transforming the data to be processed in the dialog request to obtain a processed dialog request.

[0135] For example, a target processing algorithm may be determined based on the data type and transformation level, and the target processing algorithm may be used to transform the data to be processed indicated by the data tag to generate processed data; and / or, a preset processing algorithm may be used to transform the identified data to be processed to generate processed data; and further, a processed dialogue request may be generated based on the processed data and unprocessed data in the dialogue request.

[0136] S206, sending the processed dialogue request to a third-party server where a language network model is deployed.

[0137] S207, receiving initial response data returned by the third-party server.

[0138] S208, adjusting the initial response data based on the data to be processed in the dialogue request, generating target response data, and sending the target response data to the user end.

[0139] The following is an exemplary description of the gateway system, see Figure 3 As shown, the gateway system is deployed in the trusted execution environment of the server, and the gateway system includes: a dialogue management module 301, a data processing module 302, and a data recovery module 303; the dialogue management module 302 is respectively connected to the data processing module 302 and the data recovery module 303. The dialogue management module 301 includes a permission management module 311 and a cache module 312.

[0140] The authority management module 311 is used to receive the conversation request sent by the user end, and call the data processing module 302 to transform the data to be processed contained in the conversation request to generate processed data corresponding to the data to be processed. The data to be processed and the corresponding processed data are associated and cached in the cache module 312. The cache module 312 can cache the data under the current conversation request. After the current conversation request ends, the cache module can delete the data under the current conversation request.

[0141] The authority management module 311 is further used to generate a post-processing dialog request based on other data in the dialog request except the data to be processed and the processed data. Alternatively, the post-processing dialog request can also be generated based on other data in the dialog request except the data to be processed, the processed data, and preset instruction data for indicating that the data mark is retained.

[0142] The authority management module 311 is also used to send the processed dialogue request to the third-party server deployed with the language network model, and receive the initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request.

[0143] The authority management module 311 is also used to call the data recovery module 303, adjust the initial response data according to the pending data cached by the cache module 312 and the corresponding processed data, generate target response data, and send the target response data to the user end.

[0144] The dialogue management module 301 may also include a log module 313, which stores record information of dialogue requests, such as the user-side information initiating the dialogue request, the IP of the request source, the request time, etc. The log module will not record the user-side dialogue request and the initial response data and target response data.

[0145] During implementation, the gateway system further includes a security verification module 304 , and the security verification module 304 is connected to the session management module 301 .

[0146] The session management module 301 is further configured to receive the data to be verified sent by the user terminal, and send the data to be verified to the security verification module 304 .

[0147] The security verification module 304 is used to generate target verification data based on the data to be verified and the trust root module included in the trusted execution environment; and send the target verification data to the session management module 301.

[0148] The session management module 301 is used to send the target verification data to the user end, and the user end is used to verify the target verification data and generate a verification result indicating whether the gateway system is running in a trusted execution environment.

[0149] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0150] Based on the same inventive concept, a data processing device corresponding to the data processing method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned data processing method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0151] Reference Figure 4 , which is a schematic diagram of the structure of a data processing device provided by an embodiment of the present disclosure, the device includes: a receiving module 401, a processing module 402, a sending module 403, and a generating module 404; wherein:

[0152] The receiving module 401 is used to receive a conversation request sent by a user terminal;

[0153] The processing module 402 is used to transform the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements;

[0154] A sending module 403 is used to send the processed dialogue request to a third-party server on which a language network model is deployed, and receive initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request;

[0155] The generating module 404 is used to adjust the initial response data based on the data to be processed in the dialogue request, generate target response data, and send the target response data to the user terminal.

[0156] In an optional implementation, the dialog request includes a data tag for indicating the data to be processed; the processing module 402, when transforming the data to be processed included in the dialog request to generate a processed dialog request, is used to:

[0157] Determine the data type and transformation level of the data to be processed indicated by the data tag based on the information table included in the dialogue request; or determine the data type and transformation level of the data to be processed indicated by the data tag based on the tag type of the data tag included in the dialogue request;

[0158] Determining a target processing algorithm corresponding to the data to be processed based on the data type and the transformation level;

[0159] The target processing algorithm is used to transform the data to be processed indicated by the data tag to generate a post-processing dialogue request.

[0160] In an optional implementation manner, the processing module 402, when using the target processing algorithm to transform the data to be processed indicated by the data tag to generate a processed dialogue request, is used to:

[0161] Using the target processing algorithm, transform the data to be processed to generate processed data corresponding to the data to be processed;

[0162] A processed dialog request is generated based on other data in the dialog request except the to-be-processed data, the processed data, and preset instruction data for indicating that the data mark is retained.

[0163] In an optional implementation, the initial response data packet contains the data tag, and the generation module 404, when adjusting the initial response data based on the data to be processed in the dialogue request to generate the target response data, is used to: determine the processed data contained in the initial response data based on the data tag contained in the initial response data; and replace the processed data in the initial response data with the corresponding data to be processed to generate the target response data.

[0164] In an optional implementation, after receiving the conversation request sent by the user terminal, the device further includes: a first verification module 405, configured to perform authority verification on the user terminal based on the user terminal identifier carried in the conversation request to obtain an authority verification result;

[0165] The processing module 402, when transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, is used to: when the authority verification result indicates that the user terminal has the use authority, transform the data to be processed contained in the dialogue request to generate a processed dialogue request.

[0166] In an optional implementation manner, before receiving the dialog request sent by the user terminal, the device further includes: a second verification module 406, which is used to:

[0167] Receive the data to be verified sent by the user end;

[0168] Generate target verification data based on the data to be verified and the trust root module included in the trusted execution environment;

[0169] The target verification data is sent to the user terminal, and the user terminal is used to verify the target verification data and generate a verification result indicating whether the gateway system is running in a trusted execution environment.

[0170] In an optional implementation manner, the data to be verified is generated based on the initialization data generated by the user terminal and the first public key information included in the gateway system; the receiving module 401 is further used to: receive the second public key information sent by the user terminal;

[0171] The second verification module 406, when generating target verification data based on the data to be verified and the trust root module included in the trusted execution environment, is used to:

[0172] Using the first private key information contained in the gateway system, the data to be verified is parsed to obtain the initialization data;

[0173] Generate report data based on the initialization data and the second public key information;

[0174] The report data is processed using a trust root module included in the trusted execution environment to generate target verification data.

[0175] In an optional implementation manner, the conversation request is encrypted using a determined first session key, where the first session key is generated based on the first public key information and the second private key information; after receiving the conversation request sent by the user terminal, the device further includes: a parsing module 407, which is used to:

[0176] Generate a second session key based on the first private key information and the second public key information;

[0177] The conversation request is parsed using the second session key to obtain a parsed conversation request.

[0178] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0179] Based on the same technical concept, the embodiment of the present disclosure also provides a computer device. Figure 5As shown, it is a schematic diagram of the structure of a computer device 500 provided in an embodiment of the present disclosure, including a processor 501, a memory 502, and a bus 503. Among them, the memory 502 is used to store execution instructions, including a memory 5021 and an external memory 5022; the memory 5021 here is also called an internal memory, which is used to temporarily store the operation data in the processor 501, and the data exchanged with the external memory 5022 such as a hard disk. The processor 501 exchanges data with the external memory 5022 through the memory 5021. When the computer device 500 is running, the processor 501 communicates with the memory 502 through the bus 503, so that the processor 501 executes the following instructions:

[0180] Receive a conversation request sent by the user end;

[0181] Transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements;

[0182] Sending the processed dialogue request to a third-party server deployed with a language network model, and receiving initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request;

[0183] Based on the data to be processed in the dialog request, the initial response data is adjusted to generate target response data, and the target response data is sent to the user terminal.

[0184] The present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the data processing method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0185] The present disclosure also provides a computer program product that carries a program code. The program code includes instructions that can be used to execute the steps of the data processing method described in the above method embodiment. For details, please refer to the above method embodiment, which will not be repeated here.

[0186] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0187] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0188] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0189] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0190] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0191] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: Applied to a gateway system, the gateway system is deployed in a trusted execution environment of a server, and the method includes: Receive a conversation request sent by the user end; Transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements; Sending the processed dialogue request to a third-party server deployed with a language network model, and receiving initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request; Based on the data to be processed in the dialog request, the initial response data is adjusted to generate target response data, and the target response data is sent to the user terminal.

2. The method according to claim 1, characterized in that The dialog request includes a data tag for indicating the data to be processed; the transforming process is performed on the data to be processed included in the dialog request to generate a processed dialog request, including: Determine the data type and transformation level of the data to be processed indicated by the data tag based on the information table included in the dialogue request; or determine the data type and transformation level of the data to be processed indicated by the data tag based on the tag type of the data tag included in the dialogue request; Determining a target processing algorithm corresponding to the data to be processed based on the data type and the transformation level; The target processing algorithm is used to transform the data to be processed indicated by the data tag to generate a post-processing dialogue request.

3. The method according to claim 2, characterized in that The step of transforming the data to be processed indicated by the data tag using the target processing algorithm to generate a post-processing dialogue request includes: Using the target processing algorithm, transform the data to be processed to generate processed data corresponding to the data to be processed; A processed dialog request is generated based on other data in the dialog request except the to-be-processed data, the processed data, and preset instruction data for indicating that the data mark is retained.

4. The method according to claim 3, characterized in that The initial response data packet contains the data tag, and the initial response data is adjusted based on the to-be-processed data in the dialogue request to generate the target response data, including: Determining processed data included in the initial response data based on the data tag included in the initial response data; The processed data in the initial response data is replaced with the corresponding data to be processed to generate target response data.

5. The method according to claim 1, characterized in that After receiving the dialog request sent by the user terminal, the method further includes: Based on the user terminal identifier carried in the dialogue request, performing authority verification on the user terminal to obtain an authority verification result; The transforming the data to be processed contained in the dialogue request to generate a processed dialogue request includes: When the authority verification result indicates that the user terminal has the use authority, the data to be processed included in the dialogue request is transformed to generate a processed dialogue request.

6. The method according to claim 1, characterized in that Before receiving the dialog request sent by the user terminal, the method further includes: Receive the data to be verified sent by the user end; Generate target verification data based on the data to be verified and the trust root module included in the trusted execution environment; The target verification data is sent to the user terminal, and the user terminal is used to verify the target verification data and generate a verification result indicating whether the gateway system is running in a trusted execution environment.

7. The method according to claim 6, characterized in that The data to be verified is generated based on the initialization data generated by the user terminal and the first public key information contained in the gateway system; the method further includes: receiving the second public key information sent by the user terminal; The generating target verification data based on the data to be verified and the trust root module included in the trusted execution environment includes: Using the first private key information contained in the gateway system, the data to be verified is parsed to obtain the initialization data; Generate report data based on the initialization data and the second public key information; The report data is processed using a trust root module included in the trusted execution environment to generate target verification data.

8. The method according to claim 7, characterized in that The conversation request is encrypted using a determined first session key, where the first session key is generated based on the first public key information and the second private key information; After receiving the dialog request sent by the user terminal, the method further includes: Generate a second session key based on the first private key information and the second public key information; The conversation request is parsed using the second session key to obtain a parsed conversation request.

9. A data processing device, characterized in that: Applied to a gateway system, the gateway system is deployed in a trusted execution environment of a server, and the device includes: A receiving module, used for receiving a conversation request sent by a user terminal; A processing module, used for transforming the data to be processed contained in the dialogue request to generate a processed dialogue request, wherein the data to be processed is data with security requirements; a sending module, configured to send the processed dialogue request to a third-party server on which a language network model is deployed, and receive initial response data returned by the third-party server, wherein the initial response data is generated by the third-party server using the language network model in response to the processed dialogue request; A generating module is used to adjust the initial response data based on the data to be processed in the dialogue request, generate target response data, and send the target response data to the user terminal.

10. A computer device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the data processing method according to any one of claims 1 to 8 are performed.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 8 are executed.

Images