Data processing method for secure computing, medium and program product

Abstract

The invention relates to a data processing method for secure computing, a medium and a program product. The method applied to a first party comprises the following steps: sending a first identifier set and a target feature corresponding to the first identifier set to a third party, so that the third party performs homomorphic encryption on the first identifier set and the target feature by using a target key to obtain a first ciphertext, and sending the first ciphertext to the first party; generating a ciphertext of an intersection of the first identification set and the second identification set, a ciphertext of the first feature and a ciphertext of the target label according to the first ciphertext and the second ciphertext; executing a feature fragmentation operation with the second party according to the ciphertext of the first feature to obtain a first fragment of the first feature, and executing a tag fragmentation operation with the second party according to the ciphertext of the target tag to obtain a second fragment of the target tag; and executing the target data processing task based on the first fragment and the second fragment. According to the scheme, the data security can be protected under the scenes of model training, SQL query and the like, and the accuracy is ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of secure multi-party computing, and in particular, to a data processing method, medium, and program product for secure computing. Background Art

[0002] Secure multi-party computing is also known as multi-party secure computing (MPC). Multiple parties can jointly calculate the result of a function without disclosing the input data of each party in the function, and the result of the calculation is open to one or more of the parties. Typical applications of secure multi-party computing include joint statistical analysis of privacy-protected multi-party data and machine learning. The function here is a statistical operation function, a machine learning algorithm, etc. In the process of multi-party secure computing, in order not to disclose the data of each party and the intermediate calculation results, the data or intermediate results can be held by all parties in a shared form. A single party holds a data shard, and the shards held by all parties are merged together to restore the corresponding data. Usually, the calculation is kept in a shared state. In this way, the number of data communications and the amount of communication in multi-party secure computing are important factors affecting the efficiency of secure computing. Summary of the invention

[0003] This summary is provided to introduce concepts in a brief form that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0004] In a first aspect, the present disclosure provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party, and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, and the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, and the third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, h≥1, and the method is applied to the first party, comprising: sending the first identification set and the target feature corresponding to the first identification set to the third party, so that the third party uses a target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set to obtain a first ciphertext, and sending the first ciphertext to the first party, wherein the target feature includes at least one of the h-dimensional features. Partial dimensional features; in response to receiving the first ciphertext and the second ciphertext sent by the second party, generate the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature and the ciphertext of the target label according to the first ciphertext and the second ciphertext, wherein the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; according to the ciphertext of the first feature, perform a feature sharding operation with the second party to obtain a first shard of the first feature, and according to the ciphertext of the target label, perform a label sharding operation with the second party to obtain a second shard of the target label; based on the first shard and the second shard, perform a target data processing task.

[0005] In a second aspect, the present disclosure provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party, and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, and the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, and the third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, h≥1, and the method is applied to the second party, comprising: using a target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext; sending the second ciphertext to the first party, so that the second party can obtain the second ciphertext based on the first ciphertext and the second ciphertext; Ciphertext, generate the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature and the ciphertext of the target label, wherein the first ciphertext is obtained by the third party using the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set, the target features include at least some of the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; perform a feature sharding operation with the first party to obtain a third shard of the first feature, and perform a label sharding operation with the first party to obtain a fourth shard of the target label; based on the third shard and the fourth shard, perform a target data processing task.

[0006] In a third aspect, the present disclosure provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, and the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, and the third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, h≥1, and the method is applied to the third party, comprising: in response to receiving the first identification set and the target feature corresponding to the first identification set sent by the first party, using a target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set to obtain a first ciphertext; wherein the target feature includes at least part of the dimensional features in the h-dimensional feature; and sending the first ciphertext to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target label based on the first ciphertext, wherein the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0007] In a fourth aspect, the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the data processing method for secure computing provided in the first aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the third aspect of the present disclosure.

[0008] In a fifth aspect, the present disclosure provides an electronic device, comprising: a storage device on which a computer program is stored; and a processing device for executing the computer program in the storage device to implement the steps of the data processing method for secure computing provided in the first aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the third aspect of the present disclosure.

[0009] In a sixth aspect, the present disclosure provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the data processing method for secure computing provided in the first aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the second aspect of the present disclosure, or the steps of the data processing method for secure computing provided in the third aspect of the present disclosure.

[0010] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to a third party in the same local area network as the first party, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature label fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and the ciphertext of all the data held by the first party is not involved. There is ciphertext of data, thus, it is also possible to avoid sending the ciphertext of all data held by the first party to the second party. Since there is no need to send the ciphertext of all data held by the first party to the second party, the communication volume between the first party and the second party (belonging to wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than the amount of data of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0011] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale. In the drawings:

[0013] Figure 1 The diagram is a schematic diagram of a data processing system for secure computing according to an exemplary embodiment.

[0014] Figure 2 The invention is a flowchart showing a data processing method for secure computing applied to a first party according to an exemplary embodiment.

[0015] Figure 3 The invention is a flowchart showing a data processing method for secure computing applied to a second party according to an exemplary embodiment.

[0016] Figure 4 The invention is a flowchart showing a data processing method for secure computing applied to a third party according to an exemplary embodiment.

[0017] Figure 5 is a timing diagram showing a data processing method for secure computing according to an exemplary embodiment.

[0018] Figure 6 is a timing diagram showing a data processing method for secure computing according to another exemplary embodiment.

[0019] Figure 7 The invention is a block diagram showing a data processing device for secure computing applied to a first party according to an exemplary embodiment.

[0020] Figure 8 The invention is a block diagram showing a data processing device for secure computing applied to a second party according to an exemplary embodiment.

[0021] Fig. 9 The invention is a block diagram showing a data processing device for secure computing applied to a third party according to an exemplary embodiment.

[0022] Fig.10 The diagram is a schematic structural diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0023] Before introducing the specific embodiments of the present disclosure, the terms involved in the present disclosure and the specific application scenarios of multi-party secure computing are first introduced and explained.

[0024] Ring: refers to a set that defines two operations, addition and multiplication, and forms a commutative group (i.e., Abelian group) for addition, a semigroup for multiplication for elements other than 0, and multiplication satisfies the distributive law for addition.

[0025] Secret Sharing is also called secret splitting or secret sharing. Its basic principle is to split secrets (such as keys, private data, etc.) into multiple shares (Shares) and give them to different data parties for safekeeping. Only when parties exceeding a threshold number merge their shards can the secret be restored; Shares obtained from parties less than the threshold number cannot restore any information of the secret. In multi-party secure computing, the threshold number is usually the same as the number of participants, and the shares into which the secret is split can also be called shards. Among them, private data is the data that you do not want other parties to know in multi-party secure computing.

[0026] Homomorphic encryption is a technology that allows calculations to be performed on encrypted data (i.e., ciphertext) and then decrypted to obtain the result. The result of homomorphic encryption is the same as the result of direct calculation on the original data (i.e., plaintext), but the entire calculation process is performed on the encrypted data. There are many encryption algorithms that can be used to implement homomorphic encryption, among which BFV is one of them, and it is called BFV homomorphic encryption at this time.

[0027] Private Set Intersection (PSI) is a proprietary protocol in the field of secure multi-party computing, which allows both parties to input private sets to jointly calculate the intersection of sets, and ensures that no additional element information is leaked except the set intersection result.

[0028] Communication volume: Since the data of the participants in secure computing are on different machines, they need to interact through network communication. During the calculation process, encrypted data will be transmitted on the network, and the amount of data transmitted is the communication volume.

[0029] A Trusted Execution Environment (TEE) is a secure hardware or software environment that provides protection for sensitive data and code to prevent unauthorized access and modification. The design goal of TEE is to ensure that data and code are protected during execution and remain secure even if the operating system or application is attacked.

[0030] TEE generally includes the following key features and functions:

[0031] Secure isolation: TEE provides an isolated execution environment, ensuring that sensitive data and code are protected during execution without interference from the operating system or other processes.

[0032] Secure boot: The TEE verifies its integrity and authenticity at boot time to ensure that the environment has not been tampered with or infiltrated with malware.

[0033] Secure storage: TEE provides a secure storage mechanism that can be used to store encryption keys, certificates, sensitive data, etc. to prevent data leakage and tampering.

[0034] Secure communication: TEE supports secure communication mechanisms to ensure that data is protected during transmission and prevent man-in-the-middle attacks and data theft.

[0035] Secure operating environment: TEE provides a trusted execution environment in which sensitive code can be run, such as encryption algorithms, digital signatures, etc., to ensure the security and integrity of the code.

[0036] TEE is widely used in security chips, smart phones, cloud computing environments and other fields to protect user data, financial transaction information, digital copyright content, etc. The development and application of TEE technology provides strong support for data security and privacy protection.

[0037] In the field of secure computing, the terms semi-honest and honest describe different behavioral characteristics of participants when executing a protocol. Semi-honest participants will abide by the rules of the protocol and be curious, that is, semi-honest participants will act according to the rules of the protocol and will not deliberately violate the steps or operations of the protocol. Despite abiding by the rules of the protocol, semi-honest participants may try to obtain additional information from the execution of the protocol, for example, analyzing the received information, or trying to infer the input information of other participants from the output of the protocol. Honest participants not only abide by the rules of the protocol, but also will not be curious about the input of other participants or the internal state of the protocol, that is, honest participants act completely in accordance with the requirements of the protocol and will not perform any operations beyond the provisions of the protocol, for example, they will not try to obtain any additional information from the execution of the protocol.

[0038] ElGamal encryption is a public key encryption algorithm based on the discrete logarithm problem. ElGamal encryption based on elliptic curves (hereinafter referred to as elliptic curve encryption) is a variant of the ElGamal encryption algorithm applied to elliptic curves, which is used to achieve a more efficient and secure encryption mechanism.

[0039] The implementation method of the ElGamal encryption mechanism based on elliptic curve is as follows:

[0040] S1, parameter setting: select appropriate elliptic curve parameters, including curve equation, base point, order and other parameters.

[0041] S2, key generation: randomly select a private key d and calculate the public key Q = d*G, where G is the base point of the elliptic curve.

[0042] S3, encryption: select a random number k, calculate the points C1=k*G and C2=B+k*Q, where B is the message to be encrypted, and C1 and C2 are the encrypted ciphertext.

[0043] S4, decryption: Based on the private key d and the ciphertexts C1 and C2, the original message B=C2-d*C1 can be calculated.

[0044] Compared with traditional ElGamal encryption, ElGamal encryption based on elliptic curves has higher security and smaller key length, and also provides higher encryption efficiency. It is widely used in secure communications, digital signatures, identity authentication and other fields, providing a reliable encryption solution for protecting the confidentiality and integrity of data.

[0045] In addition, the ElGamal encryption mechanism based on elliptic curves has the ±1 homomorphic property, that is, for any point H on the elliptic curve, there is Dec((-1) w Enc(H))=(-1) w H, It is a binary field composed of 0 and 1, Dec represents elliptic curve decryption, and Enc(H) represents elliptic curve encryption of H.

[0046] In practical applications, for the purpose of privacy protection, multi-party secure computing algorithms are usually black box algorithms, and the data transmission behavior between the computing nodes equipped with multi-party secure computing algorithms is opaque. As discussed in the background technology, typical applications of multi-party secure computing include machine learning, among which multi-party secure computing technology can be used to protect privacy data during the reasoning and training stages of machine learning, mainly involving the protection of model parameters and the protection of the data of each participant during the training process.

[0047] At present, common privacy-preserving machine learning solutions based on secure multi-party computing include: privacy-preserving machine learning protocols based on obfuscated circuits, oblivious transmission and other technologies, and executing secure multi-party computing protocols to complete nonlinear operation calculations such as activation functions. Based on secret sharing technology, multiple parties are allowed to participate in machine learning network model training or prediction, and the process will not disclose data or model information.

[0048] In addition to the above application areas, multi-party secure computing can also be applied to privacy-protected network security detection, joint statistical analysis of privacy-protected multi-party data, spam cleaning and filtering of encrypted emails, advertising conversion and other fields.

[0049] Among them, bilateral secure computing is usually used for joint statistical analysis of the two-party data with privacy protection, that is, to query across the two-party databases while protecting the private data of the two parties.

[0050] For example, consider the following Structure Query Language (SQL) statement:

[0051] select avg(a.key),sum(bs=0)from a join b on a.id=b.id;

[0052] This SQL statement is used to align table a and table b according to the id column, calculate the average value of a.key based on the aligned table, and count the number of bs=0 to obtain the query result. Among them, table a is stored in the first party P0, table a includes an id column and at least one feature column, table b is stored in the second party P1, table b includes an id column and a feature column (i.e., bs, which can be a label column with a value of 0 or 1), and the feature column and at least one feature column in table a belong to features of different dimensions. P0 and P1 perform SQL queries through the secure computing technology of both parties, and do not expose their own privacy data to each other. After the query is completed, only the query results are exposed to the querying party, and the query results are stored in P0 and P1 in the form of shards.

[0053] Specifically, P0 and P1 align table a and table b according to the id column in the following way (which can be called PSI toshare): first, both parties obtain the intersection of the id columns of the two parties through PSI, where the intersection is held by P1 alone and is not exposed to P0; then, feature sharding is performed, that is, the features held by P0 and corresponding to the intersection are stored in P0 and P1 in the form of shards, and the features held by P1 and corresponding to the intersection are stored in P0 and P1 in the form of shards, so that both parties can perform SQL queries based on the feature shards they hold.

[0054] In related technologies, feature sharding is usually implemented based on the DDH hypothesis and homomorphic encryption algorithm. The amount of data communication involved in this process is proportional to the data size of the large data volume. When the data volume is large, the communication overhead of feature sharding will be huge.

[0055] For example, P0 has N = 1 billion pieces of data, each piece of data contains h = 1000 features and an identifier (for example, id); P1 has d = 1 million pieces of data, each piece of data includes an identifier (for example, id). Among them, P0 is the party with a large amount of data. The communication volume involved in feature sharding based on the DDH hypothesis and homomorphic encryption algorithm is at the O(hN) level. It can be seen that the communication overhead of feature sharding is huge.

[0056] In view of this, the present disclosure provides a data processing method, medium and program product for secure computing to reduce the communication volume between two parties during feature sharding.

[0057] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0058] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0059] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0060] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0061] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0062] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0063] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0064] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's information. Thus, the user can autonomously choose whether to provide information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0065] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide information to the electronic device.

[0066] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0067] At the same time, it is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0068] Figure 1 FIG. 1 is a schematic diagram of a data processing system for secure computing according to an exemplary embodiment. Figure 1 As shown, the data processing system may include a first party, a second party and a third party, wherein the third party is a TEE device, and the third party and the first party belong to the same local area network (LAN), that is, the first party communicates with the third party through the LAN, the second party communicates with the third party through the wide area network (WAN), and the first party and the second party also communicate through the WAN.

[0069] The participants of secure computing include a first party, a second party and a third party. Among them, the first party holds a first identification set, and the first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and the second identification in the second identification set corresponds to a label, h≥1, that is, each identification in the first identification set corresponds to at least one-dimensional feature. The first identification set and the second identification set both contain at least one identification, and the first identification set is different from the second identification set. In one embodiment, the number of first identifications in the first identification set is much larger than the number of second identifications in the second identification set. At this time, the first party is the party with a large amount of data. The label feature can be a binary classification label, and the value of the label can be 0 or 1. By way of example, the first party is the above-mentioned P0, and the second party is the above-mentioned P1.

[0070] The data processing method for secure computing is implemented based on the semi-honest plus assumption (a security model), wherein the third party satisfies the following semi-honest plus assumption:

[0071] A. The third party is honest with the first party: the third party only communicates with the outside world through the first party, and the first party is willing to send private data to the third party;

[0072] B. The third party is semi-honest to the second party: the second party believes that the third party will faithfully execute the agreement, but is unwilling to send its private data to the third party;

[0073] C. The first party also does not want an adversary to be able to recover the first party's private data based on the data in the third party and the data sent by the first party to the third party after breaking into the third party.

[0074] Specifically, the second party and the third party communicate only once via the WAN to agree on a key for encryption, namely a target key, wherein the target key may be generated by the third party and sent to the second party via the WAN, or the target key may be generated by the second party and sent to the third party via the WAN.

[0075] The core idea of ​​the data processing method for secure computing is: the first party sends its own first identification set and at least part of the dimensional features corresponding to the first identification set to a third party, so that the third party uses the target key pre-agreed with the second party to homomorphically encrypt the data sent by the first party, and sends the encrypted first ciphertext to the first party; at the same time, the second party uses the target key pre-agreed with the third party to homomorphically encrypt the second identification set it holds and the label corresponding to the second identification set, and sends the encrypted second ciphertext to the first party; the first party receives the first ciphertext sent by the third party and the second ciphertext sent by the second party After the first ciphertext and the second ciphertext are generated, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of at least part of the dimensional features corresponding to the intersection, and the ciphertext of the label corresponding to the intersection are generated based on the first ciphertext and the second ciphertext; then, according to the ciphertext of at least part of the dimensional features corresponding to the intersection, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of at least part of the dimensional features corresponding to the intersection, and according to the ciphertext of the label corresponding to the intersection, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the label corresponding to the intersection; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold.

[0076] Figure 2 FIG. 1 is a flow chart showing a data processing method for secure computing applied to a first party according to an exemplary embodiment. Figure 2As shown, the data processing method for secure computing applied to the first party may include S101 to S104.

[0077] In S101, the first identification set and the target features corresponding to the first identification set are sent to a third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sends the first ciphertext to the first party.

[0078] In the present disclosure, the target feature includes at least some of the h-dimensional features.

[0079] In one embodiment, the target feature includes at least some dimensional features in the h-dimensional feature. In this case, the first party can send the first identification set and the partial dimensional features corresponding to the first identification set to a third party, so that the third party can use the target key to homomorphically encrypt the first identification set and the partial dimensional features corresponding to the first identification set to obtain a first ciphertext, and send the first ciphertext to the first party.

[0080] In another embodiment, the target features include h-dimensional features. In this case, the first party may send the first identification set and the h-dimensional features corresponding to the first identification set to a third party, so that the third party can use the target key to homomorphically encrypt the first identification set and the h-dimensional features corresponding to the first identification set to obtain a first ciphertext, and send the first ciphertext to the first party.

[0081] When the first party executes the above data processing method, it first sends the first identification set and the target features corresponding to the first identification set held by itself to the third party based on the assumption that the third party is honest to the first party; after the third party receives the first identification set and the target features corresponding to the first identification set sent by the first party, it uses the target key pre-agreed with the second party to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain the first ciphertext, and then sends the first ciphertext to the first party; the second party receives the third ciphertext sent by the third party.

[0082] In S102, in response to receiving the first ciphertext and the second ciphertext sent by the second party, a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target tag are generated according to the first ciphertext and the second ciphertext.

[0083] In the present disclosure, the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0084] When the second party executes the above data processing method, firstly based on the assumption of the third party that the second party is semi-honest, in order to avoid data leakage of the second party, the second party locally homomorphically encrypts the data it holds, that is, uses the target key pre-agreed with the third party to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; the first party receives the second ciphertext.

[0085] After receiving the first ciphertext sent by the third party and the second ciphertext sent by the second party, the first party generates the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature, and the ciphertext of the target label based on the first ciphertext and the second ciphertext.

[0086] In S103, a feature fragmentation operation is performed with the second party according to the ciphertext of the first feature to obtain a first fragmentation of the first feature, and a tag fragmentation operation is performed with the second party according to the ciphertext of the target tag to obtain a second fragmentation of the target tag.

[0087] In the present disclosure, after the first party obtains the ciphertext of the first feature and the ciphertext of the target tag, it can jointly perform a feature sharding operation with the second party based on the ciphertext of the first feature to obtain a shard of the first feature (i.e., the first shard and the third shard), and at the same time, jointly perform a label sharding operation with the second party based on the ciphertext of the target tag to obtain a shard of the target tag (i.e., the second shard and the fourth shard).

[0088] In S104, the target data processing task is executed based on the first shard and the second shard.

[0089] Among them, the above-mentioned target data processing task can be a SQL query task or a machine learning model training task.

[0090] In one embodiment, when the target data processing task is an SQL query task, the first party and the second party can jointly perform SQL queries based on the feature slices and label slices they respectively hold to obtain query result slices respectively. After that, both parties respectively feed back the query result slices they obtained to the query party; after the query party receives the query result slices sent by both parties, it merges them to obtain the final query result.

[0091] Specifically, the first party can perform an SQL query together with the second party based on the first shard and the second shard to obtain a first query result shard, and then feed the first query result shard back to the query party; accordingly, the second party can perform an SQL query together with the first party based on the third shard and the fourth shard to obtain a second query result shard, and then feed the second query result shard back to the query party; finally, the query party merges the first query result shard and the second query result shard to obtain the final query result.

[0092] In another embodiment, when the target data processing task is a machine learning model training task, the second party can use the features of the first party to perform model training, wherein the first party and the second party can perform model training in an MPC manner based on the feature shards and label shards held by each party to obtain model parameter shards respectively, and then the first party sends the model parameter shards held by itself to the second party, and the second party merges the model parameter shards obtained from the first party with the model parameter shards held by itself to obtain the model parameters of the corresponding model and complete the model training of the second party. In this way, when the second party lacks training data or the training data is insufficient, the features of the first party can be used for model training, which can improve the accuracy of model training while ensuring the privacy of the first party's data.

[0093] Specifically, the first party can jointly perform model training with the second party based on the first shard and the second shard to obtain a first model parameter shard, and then feed the first model parameter shard back to the second party; accordingly, the second party can jointly perform model training with the first party based on the third shard and the fourth shard to obtain a second model parameter shard, and then merge the second model parameter shard with the first model parameter shard received from the first party to obtain a complete model parameter.

[0094] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0095] In a possible implementation, the first ciphertext may include a first sub-ciphertext and a second sub-ciphertext of a target feature corresponding to each first identifier, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by a third party performing pseudo-random encryption on the first identifier set using a target key, the feature ciphertext is obtained by a third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0096] Specifically, after receiving the first identification set and the target features corresponding to the first identification set sent by the first party, the third party can use the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set through the following steps (a1) to (a3):

[0097] Step (a1): Use the target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext.

[0098] Step (a2): Generate a first random number, and use the target key to symmetrically encrypt the first random number to obtain a third ciphertext.

[0099] In the present disclosure, the first random number may be encrypted using a target key and a symmetric encryption algorithm such as Advanced Encryption Standard (AES) or Data Encryption Standard (DES).

[0100] Step (a3): For the target feature corresponding to each first identifier in the first identifier set, the third ciphertext is added to the target feature to obtain the feature ciphertext of the target feature.

[0101] For example, the first ciphertext T0 = {prf k1 (i),E k1 (x): i∈I0,x=F0(i)}. Among them, prf k1 (i) is the ciphertext obtained by pseudo-randomly encrypting the first identifier i in the first identifier set I0 using the target key k1. The ciphertexts corresponding to the first identifiers in the first identifier set constitute the first sub-ciphertext; F0:I0→R m , m is the dimension of the target feature, R is a finite commutative ring, I is the identification space where the first identification set and the second identification set are located, E k1 (x) is the second sub-ciphertext of the target feature F0(i) (i.e., x) corresponding to the first identifier i in the first identifier set, and E k1 (x)=(u,x+g k1 (u)), where g k1(u) represents the third ciphertext obtained by symmetric encryption of the first random number u using the target key k1; x+g k1 (u) is the characteristic ciphertext of the target feature x corresponding to the first identifier i in the first identifier set.

[0102] By using the encryption method shown in the above steps (a1) to (a3), E k1 (x) It has the properties of homomorphic encryption, but the above encryption method is more efficient than ordinary homomorphic encryption, which can improve the encryption efficiency of first-party private data, thereby improving the processing efficiency of target data processing tasks.

[0103] In a possible implementation, the second ciphertext may include a third sub-ciphertext and a fourth sub-ciphertext of a label corresponding to each second identifier, wherein the third sub-ciphertext is obtained by the second party performing pseudo-random encryption on the second identifier set using a target key, and the fourth sub-ciphertext is obtained by the second party performing elliptic curve encryption on the label and target point corresponding to the second identifier using the target key, and the target point is any point on a preset elliptic curve.

[0104] Specifically, the second party can use the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set through the following steps (b1) and (b2) to obtain the second ciphertext:

[0105] Step (b1): Use the target key to pseudo-randomly encrypt the second identification set to obtain a third sub-ciphertext.

[0106] Step (b2): for each tag corresponding to the second identifier in the second identifier set, perform elliptic curve encryption on the tag and the target point using the target key to obtain the fourth sub-ciphertext of the tag.

[0107] In the present disclosure, the target point is any point on a preset elliptic curve, and the second party may randomly select a point on the preset elliptic curve as the target point.

[0108] For example, the second ciphertext T1 = {(prf k1 (j),Enc k1 ((-1) y P)):j∈I1,y=F1(j)}. Among them, prf k1 (j) is the ciphertext obtained by pseudo-randomly encrypting the second identifier j in the second identifier set I1 using the target key k1, and these ciphertexts corresponding to the second identifiers in the second identifier set constitute the third sub-ciphertext; F1: Enc k1 ((-1) yP)) is the fourth sub-ciphertext obtained by using the target key k1 to perform elliptic curve encryption on the label F1(j) (ie, y) corresponding to the second identifier j in the second identifier set and the target point P.

[0109] Among them, a similar method as S1 to S3 in the ElGamal encryption mechanism based on elliptic curve can be adopted to use the target key k1 to perform elliptic curve encryption on the label F1(j) (i.e., y) corresponding to the second identifier j in the second identifier set and the target point P. At this time, (-1) y P is the message to be encrypted, k1 is the private key, that is, d=k1.

[0110] The tags held by the second party are binary tags, and the use of elliptic curve encryption can be more efficient and have a small amount of ciphertext, thereby reducing the amount of communication between the first party and the second party.

[0111] The following is a detailed description of the specific implementation method of generating the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature, and the ciphertext of the target tag according to the first ciphertext and the second ciphertext in the above S102. Specifically, it can be achieved through steps (c1) and (c2):

[0112] Step (c1): Calculate the intersection of the first sub-ciphertext and the third sub-ciphertext to obtain the ciphertext of the intersection of the first identifier set and the second identifier set.

[0113] Step (c2): Determine the ciphertext corresponding to the ciphertext of the intersection from all the second sub-ciphertexts to obtain the ciphertext of the first feature, and determine the ciphertext corresponding to the ciphertext of the intersection from all the fourth sub-ciphertexts to obtain the ciphertext of the target label.

[0114] The following is a detailed description of the specific implementation method of performing the feature slicing operation with the second party based on the ciphertext of the first feature in the above S103 to obtain the first slicing of the first feature. Specifically, it can be achieved through steps (d1) and (d2):

[0115] Step (d1): Obtain a first random number in the ciphertext of the first feature, and send the first random number to the second party, so that the second party uses the target key to symmetrically encrypt the first random number to obtain a third fragment of the first feature.

[0116] After obtaining the ciphertext of the first feature, the first party can first extract a first random number from the ciphertext of the first feature, and then send the first random number to the second party; after receiving the first random number, the second party uses the target key to symmetrically encrypt the first random number to obtain a fourth ciphertext, and then inverts the fourth ciphertext to obtain a third fragment of the first feature.

[0117] The second party can use the target key to encrypt the first random number using a symmetric encryption algorithm such as AES and DES, wherein the encryption method used by the second party to symmetrically encrypt the first random number using the target key is the same as the encryption method used by the first party to symmetrically encrypt the first random number using the target key.

[0118] Step (d2): Determine the characteristic ciphertext of the first characteristic as the first fragment of the first characteristic.

[0119] For example, the feature ciphertext of the target feature x corresponding to the first identifier i in the first identifier set is x+g k1 (u), the fourth ciphertext is g k1 (u), after negating the fourth ciphertext, we get -g k1 (u), then the first slice of the first feature is x+g k1 (u), the second fragment of the first feature is -g k1 (u), where x=F0(q) and q∈I0∩I1.

[0120] In this implementation, the first party can send only the first random number to the second party based on the properties of homomorphic encryption. At this time, in the step of performing feature sharding with the second party according to the ciphertext of the first feature, the communication volume between the first party and the second party is λn, where n is the number of second identifiers in the second identifier set, and the first random number is λbit. It can be seen that the communication volume is independent of the dimension m of the target feature, thereby reducing the communication volume between the first party and the second party during feature sharding and label sharding.

[0121] The following is a detailed description of the specific implementation method of performing the label fragmentation operation with the second party according to the ciphertext of the target label in the above S103 to obtain the second fragment of the target label. Specifically, the above label is a binary classification label. In this case, it can be implemented by the following steps (e1) to (e3):

[0122] Step (e1): Generate a second random number, and use the second random number to mask the ciphertext of the target tag to obtain masked data.

[0123] The second random number is 0 or 1.

[0124] For example, the mask data yg=Enc k1 ((-1) y-r P)), where Enc k1 ((-1) y P)):y=F1(q) is the ciphertext of the target tag, and r is the second random number.

[0125] Step (e2): sending the masked data to the second party, so that the second party uses the target key to homomorphically decrypt the masked data and generates a fourth fragment of the target tag according to the homomorphic decryption result.

[0126] Step (e3): Use the second random number as the second fragment of the target tag.

[0127] After obtaining the masked data, the first party sends the masked data to the second party; after receiving the masked data, the second party uses the target key to homomorphically decrypt the masked data. If the homomorphic decryption result is the target point, 0 is determined as the fourth fragment of the target label. If the homomorphic decryption result is not the target point, 1 is determined as the fourth fragment of the target label. At the same time, the first party uses the second random number as the second fragment of the target label.

[0128] For example, mask data Enc k1 ((-1) y-r P)=(-1) r Enc k1 ((-1) y P), and use the above ±1 homomorphic property to perform homomorphic decryption, and the homomorphic decryption result is (-1) y-r P, will (-1) y-r P is compared with P, if (-1) y-r If P is equal to P, 0 is determined as the fourth fragment of the target label. If (-1) y-r If P is not equal to P, 1 is determined as the fourth fragment of the target label.

[0129] In the above steps (e1) to (e3), the first party and the second party only need to transmit the mask data. At this time, the communication volume involved is 512n, wherein the size of the mask data is 512 bits.

[0130] In a possible implementation, the above S101 may include:

[0131] The first identification set and the target features corresponding to the first identification set are sent to a third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and scramble the order of the first ciphertext to obtain a fifth ciphertext, and send the fifth ciphertext to the first party; at this time, the above S102 may include: in response to receiving the fifth ciphertext and the second ciphertext sent by the second party, generating a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label according to the fifth ciphertext and the second ciphertext.

[0132] Specifically, when the first party executes the above-mentioned data processing method, it first sends the first identification set and the target features corresponding to the first identification set held by itself to the third party based on the assumption that the third party is honest to the first party; after the third party receives the first identification set and the target features corresponding to the first identification set sent by the first party, it uses the target key pre-agreed with the second party to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and then scrambles the order of the first ciphertext to obtain a fifth ciphertext, and sends the fifth ciphertext to the first party; the second party receives the fifth ciphertext sent by the third party to generate the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature, and the ciphertext of the target label according to the fifth ciphertext and the second ciphertext sent by the second party.

[0133] In the above-mentioned embodiment, after the first identification set and the target features corresponding to the first identification set are homomorphically encrypted using the target key, the homomorphic encryption result is not sent directly to the first party, but the order of the homomorphic encryption result (i.e., the fifth ciphertext) is first disrupted, and the ciphertext obtained after the disrupted order (i.e., the first ciphertext) is sent to the first party. In this way, the first party can avoid deriving the target key by matching the first ciphertext with the data it holds, thereby avoiding the problem of second party data leakage caused by cracking the second ciphertext due to knowing the target key.

[0134] In a possible implementation, the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the labels corresponding to the second identification set, and scrambling the order of the homomorphic encryption results.

[0135] Specifically, when the second party executes the above data processing method, based on the assumption that the third party is semi-honest to the second party, in order to avoid data leakage of the second party, the second party locally homomorphically encrypts the data it holds, that is, uses the target key pre-agreed with the third party to homomorphically encrypt the second identification set and the label corresponding to the second identification set held by itself to obtain the second ciphertext, and then scrambles the order of the second ciphertext to obtain the sixth ciphertext, and determines the sixth ciphertext as the second ciphertext, that is, determines the homomorphic encryption result (that is, the sixth ciphertext) obtained after the scrambling as the new second ciphertext, and sends the new second ciphertext to the first party; the first party receives the second ciphertext.

[0136] In the above-mentioned implementation, after the second identification set and the units corresponding to the second identification set are homomorphically encrypted using the target key, the homomorphic encryption results are not sent directly to the first party, but the order of the homomorphic encryption results is first scrambled, and the ciphertext obtained after the scrambled order (i.e., the sixth ciphertext) is sent to the first party. In this way, the first party can avoid obtaining the order of the plaintext corresponding to the second ciphertext, thereby avoiding data leakage of the second party.

[0137] Figure 3FIG. 1 is a flow chart showing a data processing method for secure computing applied to a second party according to an exemplary embodiment. Figure 3 As shown, the data processing method for secure computing applied to the second party may include S201 to S204.

[0138] In S201, the second identification set and the label corresponding to the second identification set are homomorphically encrypted using the target key to obtain a second ciphertext.

[0139] In S202, the second ciphertext is sent to the first party, so that the second party generates a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target tag based on the first ciphertext and the second ciphertext.

[0140] Among them, the first ciphertext is obtained by a third party using a target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set, the target features include at least some dimensional features in the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection.

[0141] In S203, a feature slicing operation is performed with the first party to obtain a third slicing of the first feature, and a tag slicing operation is performed with the first party to obtain a fourth slicing of the target tag.

[0142] In S204, the target data processing task is executed based on the third shard and the fourth shard.

[0143] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0144] Optionally, the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identifier, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by a third party performing pseudo-random encryption on the first identifier set using a target key, the feature ciphertext is obtained by a third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0145] Optionally, performing a feature sharding operation with the first party to obtain a third shard of the first feature includes:

[0146] In response to receiving a first random number sent by the first party, symmetrically encrypting the first random number using the target key to obtain a fourth ciphertext;

[0147] The fourth ciphertext is inverted to obtain the third fragment of the first feature.

[0148] Optionally, using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext includes:

[0149] Using the target key to pseudo-randomly encrypt the second identification set to obtain a third sub-ciphertext;

[0150] For each tag corresponding to the second identifier, use the target key to perform elliptic curve encryption on the tag and the target point to obtain a fourth sub-ciphertext of the tag, wherein the target point is any point on the preset elliptic curve;

[0151] The second ciphertext includes the third sub-ciphertext and the fourth sub-ciphertext of the tag corresponding to each second identifier.

[0152] Optionally, the label is a binary classification label;

[0153] Performing a label sharding operation with the first party to obtain a fourth shard of the target label, including:

[0154] In response to receiving the masked data sent by the first party, using the target key to homomorphically decrypt the masked data, wherein the masked data is obtained by the first party masking the ciphertext of the target tag using a second random number, and the second random number is 0 or 1;

[0155] If the homomorphic decryption result is the target point, 0 is determined as the fourth fragment;

[0156] If the homomorphic decryption result is not the target point, 1 is determined as the fourth fragment.

[0157] Optionally, before the step of sending the second ciphertext to the first party, the data processing method for secure computing applied to the second party further includes:

[0158] Disrupt the order of the second ciphertext to obtain a sixth ciphertext;

[0159] The sixth ciphertext is determined as the second ciphertext.

[0160] Optionally, the target data processing task is a structured query language query task or a machine learning model training task.

[0161] The specific implementation methods of each step in the data processing method for secure computing applied to the second party according to the embodiment of the present disclosure have been described in detail in the data processing method for secure computing applied to the first party according to the embodiment of the present disclosure, and will not be repeated here.

[0162] Figure 4 FIG. 1 is a flow chart showing a data processing method for secure computing applied to a third party according to an exemplary embodiment. Figure 4 As shown, the data processing method for secure computing applied to a third party may include S301 and S302.

[0163] In S301, in response to receiving a first identification set and a target feature corresponding to the first identification set sent by a first party, the first identification set and the target feature corresponding to the first identification set are homomorphically encrypted using a target key to obtain a first ciphertext.

[0164] The target feature includes at least some of the h-dimensional features.

[0165] In S302, the first ciphertext is sent to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the first ciphertext.

[0166] Among them, the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0167] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0168] Optionally, homomorphically encrypting the first identification set and the target features corresponding to the first identification set using the target key to obtain a first ciphertext includes:

[0169] Using the target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext;

[0170] Generate a first random number, and symmetrically encrypt the first random number using the target key to obtain a third ciphertext;

[0171] For each target feature corresponding to the first identifier, add the third ciphertext to the target feature to obtain a feature ciphertext of the target feature;

[0172] The first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of a target feature corresponding to each first identifier, and the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier.

[0173] Optionally, before the step of sending the first ciphertext to the first party, the data processing method for secure computing applied to the third party further includes:

[0174] Disrupt the order of the first ciphertext to obtain the fifth ciphertext;

[0175] The first ciphertext is sent to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the first ciphertext, including:

[0176] The fifth ciphertext is sent to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the fifth ciphertext.

[0177] The specific implementation methods of each step in the data processing method for secure computing applied to a third party according to an embodiment of the present disclosure have been described in detail in the data processing method for secure computing applied to a first party according to an embodiment of the present disclosure, and will not be repeated here.

[0178] Figure 5 FIG. 1 is a timing diagram of a data processing method for secure computing according to an exemplary embodiment. Figure 5 As shown, the data processing method for secure computing may include the following S401 to S410.

[0179] In S401, the first identification set and the target features corresponding to the first identification set are sent to a third party.

[0180] In S402, the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext.

[0181] In S403, the third party sends the first ciphertext to the first party.

[0182] In S404, the second party uses the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext.

[0183] In S405, the second party sends the second ciphertext to the first party.

[0184] In S406, the first party generates a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target tag based on the first ciphertext and the second ciphertext.

[0185] In S407, the first party performs a feature fragmentation operation with the second party according to the ciphertext of the first feature to obtain a first fragmentation of the first feature, and performs a tag fragmentation operation with the second party according to the ciphertext of the target tag to obtain a second fragmentation of the target tag.

[0186] In S408, the second party performs a feature slicing operation with the first party to obtain a third slicing of the first feature, and performs a tag slicing operation with the first party to obtain a fourth slicing of the target tag.

[0187] In S409, the first party performs the target data processing task based on the first shard and the second shard.

[0188] In S410, the second party performs the target data processing task based on the third shard and the fourth shard.

[0189] The specific implementation of the above S401 to S410 has been described in detail in the data processing method for secure computing applied to the first party according to the embodiment of the present disclosure, and will not be repeated here.

[0190] Figure 6 FIG. 1 is a timing diagram of a data processing method for secure computing according to another exemplary embodiment. Figure 6 As shown, the data processing method for secure computing may include the following S501 to S522.

[0191] In S501, the first party sends a first identification set and target features corresponding to the first identification set to a third party.

[0192] In S502, the third party uses the target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext.

[0193] In S503, the third party generates a first random number, and symmetrically encrypts the first random number using the target key to obtain a third ciphertext.

[0194] In S504, the third party adds the third ciphertext to the target feature corresponding to each first identifier to obtain a feature ciphertext of the target feature.

[0195] In S505, the third party sends the first ciphertext to the first party, wherein the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identifier, and the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier.

[0196] In S506, the second party uses the target key to pseudo-randomly encrypt the second identification set to obtain a third sub-ciphertext.

[0197] In S507, the second party performs elliptic curve encryption on the label and the target point for each label corresponding to the second identifier using the target key to obtain a fourth sub-ciphertext of the label.

[0198] In S508, the second party sends the second ciphertext to the first party, where the second ciphertext includes the third sub-ciphertext and a fourth sub-ciphertext of the tag corresponding to each second identifier.

[0199] In S509, the first party calculates the intersection of the first sub-ciphertext and the third sub-ciphertext to obtain the ciphertext of the intersection of the first identifier set and the second identifier set.

[0200] In S510, the first party determines the ciphertext corresponding to the ciphertext of the intersection from all the second sub-ciphertexts to obtain the ciphertext of the first feature, and determines the ciphertext corresponding to the ciphertext of the intersection from all the fourth sub-ciphertexts to obtain the ciphertext of the target tag.

[0201] In S511, the first party obtains a first random number in the ciphertext of the first feature.

[0202] In S512, the first party sends the first random number to the second party.

[0203] In S513, the first party determines the characteristic ciphertext of the first characteristic as the first fragment of the first characteristic.

[0204] In S514, the second party uses the target key to symmetrically encrypt the first random number to obtain a fourth ciphertext.

[0205] In S515, the second party performs a negation operation on the fourth ciphertext to obtain a third fragment of the first feature.

[0206] In S516, the first party generates a second random number, and uses the second random number to mask the ciphertext of the target tag to obtain masked data.

[0207] The second random number is 0 or 1.

[0208] In S517 , the first party sends the masked data to the second party.

[0209] In S518, the first party uses the second random number as the second fragment of the target tag.

[0210] In S519 , the second party uses the target key to homomorphically decrypt the masked data.

[0211] In S520, if the second party determines that the homomorphic decryption result is the target point, 0 is determined as the fourth fragment; if it is determined that the homomorphic decryption result is not the target point, 1 is determined as the fourth fragment.

[0212] In S521, the first party performs a target data processing task based on the first shard and the second shard.

[0213] In S522, the second party performs the target data processing task based on the third shard and the fourth shard.

[0214] In S501, the LAN communication volume between the first party and the third party is (logI|+64m)N, and the communication round is 1, where N is the number of first identifiers in the first identifier set, and the target feature is 64 bits; in S505, the LAN communication volume between the first party and the third party is (λ+64m)N, and the communication round is 1; in S508, the WAN communication volume between the first party and the second party is (λ+512)n, and the communication round is 1, where the size of the third sub-ciphertext is 512n bits, and the size of the fourth sub-ciphertext is λbit; in S512, the WAN communication volume between the first party and the second party is λn, and the communication round is 1; in S517, the WAN communication volume between the first party and the second party is 512n bits, and the communication round is 1.

[0215] Therefore, the total LAN communication volume between the first party and the third party is (logI|+64m)N+(λ+64m)N, and the total communication round is 2; the total WAN communication volume between the first party and the second party is (2λ+1024)n, and the total communication round is 3. It can be seen that the total WAN communication volume between the first party and the second party is independent of m and N.

[0216] The specific implementation of the above S501 to S522 has been described in detail in the data processing method for secure computing applied to the first party according to the embodiment of the present disclosure, and will not be repeated here.

[0217] In addition, in the present disclosure, the second party and the third party communicate only once when synchronizing the target key, and do not communicate at other times. Moreover, the third party only participates in the operation when encrypting the private data of the first party, and does not participate in the operation at other stages.

[0218] In addition, in order to improve the processing efficiency of the target data processing task, the above S101, S301-S302, S401-S402 and S501-S505 can all be performed offline.

[0219] Figure 7The present invention is a block diagram of a data processing device for secure computing applied to a first party according to an exemplary embodiment. The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and the first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and the second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, and h≥1. Figure 7 As shown, a data processing device 600 for secure computing applied to a first party includes: a first sending module 601, used to send the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses a target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and send the first ciphertext to the first party, wherein the target features include at least some of the h-dimensional features; a generating module 602, used to generate, in response to receiving the first ciphertext and the second ciphertext sent by the second party, a ciphertext of the intersection of the first identification set and the second identification set, a first ciphertext, and a second ciphertext. The invention relates to a ciphertext of a feature and a ciphertext of a target label, wherein the second ciphertext is obtained by the second party performing homomorphic encryption on the second identification set and the label corresponding to the second identification set using the target key, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; a first sharding module 603 is used to perform a feature sharding operation with the second party according to the ciphertext of the first feature to obtain a first shard of the first feature, and to perform a label sharding operation with the second party according to the ciphertext of the target label to obtain a second shard of the target label; a first execution module 604 is used to execute a target data processing task based on the first shard and the second shard.

[0220] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0221] Optionally, the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identifier, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the feature ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0222] Optionally, the first sharding module 603 includes: an acquisition submodule, used to obtain the first random number in the ciphertext of the first feature, and send the first random number to the second party, so that the second party uses the target key to symmetrically encrypt the first random number to obtain the third shard of the first feature; a first determination submodule, used to determine the feature ciphertext of the first feature as the first shard.

[0223] Optionally, the label is a binary label; the first sharding module 603 includes: a first generating submodule, used to generate a second random number, and use the second random number to mask the ciphertext of the target label to obtain masked data, wherein the second random number is 0 or 1; a sending submodule, used to send the masked data to the second party, so that the second party uses the target key to homomorphically decrypt the masked data, and generate a fourth shard of the target label according to the homomorphic decryption result; a second determining submodule, used to use the second random number as the second shard.

[0224] Optionally, the second ciphertext includes a third sub-ciphertext and a fourth sub-ciphertext of the label corresponding to each second identifier, wherein the third sub-ciphertext is obtained by the second party performing pseudo-random encryption on the second identifier set using the target key, and the fourth sub-ciphertext is obtained by the second party performing elliptic curve encryption on the label and target point corresponding to the second identifier using the target key, and the target point is any point on a preset elliptic curve.

[0225] Optionally, the generation module 602 includes: a calculation submodule, used to calculate the intersection of the first sub-ciphertext and the third sub-ciphertext, and obtain the ciphertext of the intersection of the first identification set and the second identification set; a third determination submodule, used to determine the ciphertext corresponding to the ciphertext of the intersection from all the second sub-ciphertexts, and obtain the ciphertext of the first feature, and determine the ciphertext corresponding to the ciphertext of the intersection from all the fourth sub-ciphertexts, and obtain the ciphertext of the target label.

[0226] Optionally, the first sending module 601 is used to send the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and scramble the order of the first ciphertext to obtain a fifth ciphertext, and send the fifth ciphertext to the first party; the generation module 602 is used to generate a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label according to the fifth ciphertext and the second ciphertext in response to receiving the fifth ciphertext and the second ciphertext sent by the second party.

[0227] Optionally, the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, and scrambling the order of the homomorphic encryption results.

[0228] Optionally, the target data processing task is a structured query language query task or a machine learning model training task.

[0229] Figure 8 The block diagram of a data processing device for secure computing applied to a second party is shown according to an exemplary embodiment. The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and the first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and the second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, and h≥1. Figure 8As shown, a data processing device 700 for secure computing applied to a second party includes: a first encryption module 701, used to homomorphically encrypt the second identification set and the label corresponding to the second identification set using a target key to obtain a second ciphertext; a second sending module 702, used to send the second ciphertext to the first party, so that the second party generates a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label based on the first ciphertext and the second ciphertext, wherein the first ciphertext is obtained by the third party using the target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set, the target feature includes at least some dimensional features in the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; a second sharding module 703, used to perform a feature sharding operation with the first party to obtain a third shard of the first feature, and to perform a label sharding operation with the first party to obtain a fourth shard of the target label; a second execution module 704, used to execute a target data processing task based on the third shard and the fourth shard.

[0230] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0231] Optionally, the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identifier, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the feature ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0232] Optionally, the second sharding module 703 includes: a first encryption submodule, used to, in response to receiving the first random number sent by the first party, symmetrically encrypt the first random number using the target key to obtain a fourth ciphertext; and a negation submodule, used to negate the fourth ciphertext to obtain a third shard of the first feature.

[0233] Optionally, the first encryption module 701 includes: a second encryption submodule, used to use the target key to pseudo-randomly encrypt the second identification set to obtain a third sub-ciphertext; a third encryption submodule, used to perform elliptic curve encryption on the label and the target point corresponding to each of the second identifications using the target key to obtain a fourth sub-ciphertext of the label, wherein the target point is any point on a preset elliptic curve; wherein the second ciphertext includes the third sub-ciphertext and the fourth sub-ciphertext of the label corresponding to each of the second identifications.

[0234] Optionally, the label is a binary classification label; the second sharding module 703 includes: a decryption submodule, used to, in response to receiving the masked data sent by the first party, perform homomorphic decryption on the masked data using the target key, wherein the masked data is obtained by the first party using a second random number to mask the ciphertext of the target label, and the second random number is 0 or 1; a fourth determination submodule, used to determine 0 as the fourth shard if the homomorphic decryption result is the target point; and a fifth determination submodule, used to determine 1 as the fourth shard if the homomorphic decryption result is not the target point.

[0235] Optionally, the data processing device 700 for secure computing applied to the second party also includes: a first scrambling module, used to scramble the order of the second ciphertext to obtain a sixth ciphertext before the second sending module 702 sends the second ciphertext to the first party; and a determination module, used to determine the sixth ciphertext as the second ciphertext.

[0236] Optionally, the target data processing task is a structured query language query task or a machine learning model training task.

[0237] Fig. 9 The block diagram of a data processing device for secure computing applied to a third party is shown according to an exemplary embodiment. The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and the first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and the second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, and h≥1. Fig. 9 As shown, a data processing device 800 for secure computing applied to a third party includes: a second encryption module 801, which is used to respond to receiving the first identification set and the target feature corresponding to the first identification set sent by the first party, and homomorphically encrypt the first identification set and the target feature corresponding to the first identification set using a target key to obtain a first ciphertext; wherein the target feature includes at least part of the h-dimensional features; a third sending module 802, which is used to send the first ciphertext to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target label based on the first ciphertext, wherein the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0238] In the above technical solution, first, assuming that the third party (TEE device) is honest to the first party, the first party sends the first identification set held by itself and at least part of the dimensional features (i.e., target features) corresponding to the first identification set to the third party in the same local area network; then, the third party uses the target key to homomorphically encrypt the plaintext data received from the first party to obtain the first ciphertext, and sends the first ciphertext to the first party; at the same time, the second party uses the target key to homomorphically encrypt the second identification set held by itself and the label corresponding to the second identification set to obtain the second ciphertext, and sends the second ciphertext to the first party; next, the first party According to the first ciphertext received from the third party and the second ciphertext received from the second party, the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the target feature (i.e., the first feature) corresponding to the intersection, and the ciphertext of the label (i.e., the target label) corresponding to the intersection are generated; then, according to the ciphertext of the first feature, the first party and the second party jointly perform a feature sharding operation to respectively obtain a shard of the first feature, and according to the ciphertext of the target label, the first party and the second party jointly perform a label sharding operation to respectively obtain a shard of the target label; finally, the first party and the second party respectively perform the target data processing task based on the shards they hold. In this way, the first party can, based on the assumption that the third party is honest to the first party, send the plaintext data it holds to the third party in the same local area network, so that the third party can encrypt the plaintext data held by the first party using the target key pre-agreed with the second party. In this way, it is possible to avoid encrypting the data held by the first party and sending it to the second party through the wide area network. In addition, when the first party and the second party perform feature fragmentation and label fragmentation based on the ciphertext of the first feature and the ciphertext of the target label, only the ciphertext of the feature corresponding to the intersection of the first identification set and the second identification set is involved, and all the ciphertexts held by the first party are not involved. The ciphertext of the data can avoid sending the ciphertext of all the data held by the first party to the second party. Since there is no need to send the ciphertext of all the data held by the first party to the second party, the communication volume between the first party and the second party (which belongs to the wide area network communication) can be reduced, so that the communication volume between the two parties during feature sharding and label sharding can be reduced, especially when the amount of data of the first party is much larger than that of the second party, the communication volume can be significantly reduced, thereby improving the processing efficiency of the target data processing task. Therefore, this solution can protect data security and reduce communication volume in scenarios such as model training and SQL query.

[0239] Optionally, the second encryption module 802 includes: a fourth encryption sub-module, used to use a target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext; a second generation sub-module, used to generate a first random number, and use the target key to symmetrically encrypt the first random number to obtain a third ciphertext; an addition sub-module, used to add the third ciphertext to the target feature corresponding to each of the first identifications to obtain a feature ciphertext of the target feature; wherein the first ciphertext includes the first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each of the first identifications, and the second sub-ciphertext includes the first random number and the feature ciphertext of the target feature corresponding to the first identification.

[0240] Optionally, the data processing device 800 for secure computing applied to a third party also includes: a second scrambling module, used to scramble the order of the first ciphertext to obtain a fifth ciphertext before the third sending module 802 sends the first ciphertext to the first party; the third sending module 802 is used to send the fifth ciphertext to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target label based on the fifth ciphertext.

[0241] The present disclosure also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the data processing method for secure computing applied to a first party, or the steps of the data processing method for secure computing applied to a second party, or the steps of the data processing method for secure computing applied to a third party, provided by the present disclosure.

[0242] The present disclosure also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned data processing method for secure computing applied to a first party, or the steps of the data processing method for secure computing applied to a second party, or the steps of the data processing method for secure computing applied to a third party.

[0243] Reference below Fig.10 , which shows a schematic diagram of the structure of an electronic device (e.g., a terminal device or a server) 900 suitable for implementing the embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0244] like Fig.10 As shown, the electronic device 900 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 into a random access memory (RAM) 903. In the RAM 903, various programs and data required for the operation of the electronic device 900 are also stored. The processing device 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0245] Typically, the following devices may be connected to the I / O interface 905: an input device 906 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 907 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 908 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 909. The communication device 909 may allow the electronic device 900 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 The electronic device 900 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0246] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 909, or installed from a storage device 908, or installed from a ROM 902. When the computer program is executed by the processing device 901, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0247] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0248] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0249] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0250] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: sends the first identification set and the target features corresponding to the first identification set to a third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sends the first ciphertext to the first party, wherein the participants in the secure computing include the first party, the second party and the third party, the first party holds the first identification set, the first identification in the first identification set corresponds to an h-dimensional feature, the second party holds the second identification set, the second identification in the second identification set corresponds to a label, the third party is a trusted execution environment device, the third party and the first party are located in the same local area network, h≥1, and the target features include up to of the h-dimensional features. A small number of partial-dimensional features; in response to receiving the first ciphertext and the second ciphertext sent by the second party, generate a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label according to the first ciphertext and the second ciphertext, wherein the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; according to the ciphertext of the first feature, perform a feature sharding operation with the second party to obtain a first shard of the first feature, and according to the ciphertext of the target label, perform a label sharding operation with the second party to obtain a second shard of the target label; based on the first shard and the second shard, perform a target data processing task.

[0251] Alternatively, the computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: uses the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext, the participants in the secure computing include a first party, a second party and a third party, the first party holds a first identification set, the first identification in the first identification set corresponds to an h-dimensional feature, the second party holds a second identification set, the second identification in the second identification set corresponds to a label, the third party is a trusted execution environment device, the third party and the first party are located in the same local area network, h≥1; sends the second ciphertext to the first party, so that the second party can obtain the second ciphertext based on the first ciphertext and the A second ciphertext is generated, and a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label are generated, wherein the first ciphertext is obtained by the third party using the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set, and the target features include at least some of the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; a feature sharding operation is performed with the first party to obtain a third shard of the first feature, and a label sharding operation is performed with the first party to obtain a fourth shard of the target label; based on the third shard and the fourth shard, a target data processing task is performed.

[0252] Alternatively, the computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to receiving a first identification set and a target feature corresponding to the first identification set sent by a first party, use a target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set to obtain a first ciphertext, the participants in the secure computing include a first party, a second party and a third party, the first party holds a first identification set, the first identification in the first identification set corresponds to an h-dimensional feature, the second party holds a second identification set, the second identification in the second identification set corresponds to a label, the third party is a trusted execution environment device, the third party and the first party are located in the same local area network, h≥1; wherein the target feature includes at least some of the dimensional features in the h-dimensional feature; the first ciphertext is sent to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target label based on the first ciphertext, wherein the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0253] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0254] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0255] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a module does not limit the module itself in some cases. For example, the first execution module may also be described as "a module for executing a target data processing task based on the first shard and the second shard".

[0256] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0257] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0258] According to one or more embodiments of the present disclosure, Example 1 provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party, and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, and the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, and the third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, h≥1, and the method is applied to the first party, comprising: sending the first identification set and the target feature corresponding to the first identification set to the third party, so that the third party uses a target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set to obtain a first ciphertext, and sending the first ciphertext to the first party, wherein the target feature includes the h-dimensional at least some of the dimensional features in the features; in response to receiving the first ciphertext and the second ciphertext sent by the second party, generating, according to the first ciphertext and the second ciphertext, a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature and a ciphertext of the target label, wherein the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; according to the ciphertext of the first feature, perform a feature sharding operation with the second party to obtain a first shard of the first feature, and according to the ciphertext of the target label, perform a label sharding operation with the second party to obtain a second shard of the target label; based on the first shard and the second shard, perform a target data processing task.

[0259] According to one or more embodiments of the present disclosure, Example 2 provides the method of Example 1, wherein the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each of the first identifiers, wherein the second sub-ciphertext includes a first random number and a characteristic ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the characteristic ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0260] According to one or more embodiments of the present disclosure, Example 3 provides the method of Example 2, which performs a feature sharding operation with the second party based on the ciphertext of the first feature to obtain a first shard of the first feature, including: obtaining the first random number in the ciphertext of the first feature, and sending the first random number to the second party, so that the second party uses the target key to symmetrically encrypt the first random number to obtain a third shard of the first feature; and determining the feature ciphertext of the first feature as the first shard.

[0261] According to one or more embodiments of the present disclosure, Example 4 provides the method of Example 1, wherein the label is a binary classification label; the label sharding operation is performed with the second party based on the ciphertext of the target label to obtain a second shard of the target label, including: generating a second random number, and using the second random number to mask the ciphertext of the target label to obtain masked data, wherein the second random number is 0 or 1; sending the masked data to the second party, so that the second party uses the target key to homomorphically decrypt the masked data, and generates a fourth shard of the target label based on the homomorphic decryption result; and using the second random number as the second shard.

[0262] According to one or more embodiments of the present disclosure, Example 5 provides the method of Example 2, wherein the second ciphertext includes a third sub-ciphertext and a fourth sub-ciphertext of the label corresponding to each second identifier, wherein the third sub-ciphertext is obtained by the second party performing pseudo-random encryption on the second identifier set using the target key, and the fourth sub-ciphertext is obtained by the second party performing elliptic curve encryption on the label and target point corresponding to the second identifier using the target key, and the target point is any point on a preset elliptic curve.

[0263] According to one or more embodiments of the present disclosure, Example 6 provides the method of Example 5, which generates the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature, and the ciphertext of the target label based on the first ciphertext and the second ciphertext, including: calculating the intersection of the first sub-ciphertext and the third sub-ciphertext to obtain the ciphertext of the intersection of the first identification set and the second identification set; determining the ciphertext corresponding to the ciphertext of the intersection from all the second sub-ciphertexts to obtain the ciphertext of the first feature, and determining the ciphertext corresponding to the ciphertext of the intersection from all the fourth sub-ciphertexts to obtain the ciphertext of the target label.

[0264] According to one or more embodiments of the present disclosure, Example 7 provides the method of Example 1, wherein the first identification set and the target features corresponding to the first identification set are sent to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sends the first ciphertext to the first party, including: sending the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sending the first ciphertext to the first party. Obtain a first ciphertext, and scramble the order of the first ciphertext to obtain a fifth ciphertext, and send the fifth ciphertext to the first party; in response to receiving the first ciphertext and the second ciphertext sent by the second party, generate a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label according to the first ciphertext and the second ciphertext, including: in response to receiving the fifth ciphertext and the second ciphertext sent by the second party, generate a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label according to the fifth ciphertext and the second ciphertext.

[0265] According to one or more embodiments of the present disclosure, Example 8 provides the method of Example 1, wherein the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, and scramble the order of the homomorphic encryption results.

[0266] According to one or more embodiments of the present disclosure, Example 9 provides the method of any one of Examples 1-8, wherein the target data processing task is a structured query language query task or a machine learning model training task.

[0267] According to one or more embodiments of the present disclosure, Example 10 provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party, and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, and the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, and the third party is a trusted execution environment device, and the third party and the first party are located in the same local area network, h≥1, and the method is applied to the second party, comprising: using a target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext; sending the second ciphertext to the first party so that the second party can obtain the second ciphertext based on the first ciphertext; The ciphertext and the second ciphertext are used to generate the ciphertext of the intersection of the first identification set and the second identification set, the ciphertext of the first feature and the ciphertext of the target label, wherein the first ciphertext is obtained by the third party using the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set, the target features include at least some of the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; perform a feature sharding operation with the first party to obtain a third shard of the first feature, and perform a label sharding operation with the first party to obtain a fourth shard of the target label; based on the third shard and the fourth shard, perform a target data processing task.

[0268] According to one or more embodiments of the present disclosure, Example 11 provides the method of Example 10, wherein the first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each of the first identifiers, wherein the second sub-ciphertext includes a first random number and a characteristic ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the characteristic ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

[0269] According to one or more embodiments of the present disclosure, Example 12 provides the method of Example 11, wherein performing a feature sharding operation with the first party to obtain a third shard of the first feature includes: in response to receiving the first random number sent by the first party, symmetrically encrypting the first random number using the target key to obtain a fourth ciphertext; and performing a negation operation on the fourth ciphertext to obtain the third shard of the first feature.

[0270] According to one or more embodiments of the present disclosure, Example 13 provides the method of Example 10, which uses the target key to homomorphically encrypt the second identification set and the labels corresponding to the second identification set to obtain a second ciphertext, including: using the target key to pseudo-randomly encrypt the second identification set to obtain a third sub-ciphertext; for each label corresponding to the second identification, using the target key to perform elliptic curve encryption on the label and the target point to obtain a fourth sub-ciphertext of the label, wherein the target point is any point on a preset elliptic curve; wherein the second ciphertext includes the third sub-ciphertext and the fourth sub-ciphertext of the label corresponding to each second identification.

[0271] According to one or more embodiments of the present disclosure, Example 14 provides the method of Example 13, wherein the label is a binary classification label; the label sharding operation is performed with the first party to obtain a fourth shard of the target label, including: in response to receiving the masked data sent by the first party, using the target key to homomorphically decrypt the masked data, wherein the masked data is obtained by the first party using a second random number to mask the ciphertext of the target label, and the second random number is 0 or 1; if the homomorphic decryption result is the target point, 0 is determined as the fourth shard; if the homomorphic decryption result is not the target point, 1 is determined as the fourth shard.

[0272] According to one or more embodiments of the present disclosure, Example 15 provides the method of Example 10, and before the step of sending the second ciphertext to the first party, the method also includes: disrupting the order of the second ciphertext to obtain a sixth ciphertext; and determining the sixth ciphertext as the second ciphertext.

[0273] According to one or more embodiments of the present disclosure, Example 16 provides a data processing method for secure computing, wherein the participants in the secure computing include a first party, a second party, and a third party, wherein the first party holds a first identification set, wherein the first identification in the first identification set corresponds to an h-dimensional feature, wherein the second party holds a second identification set, wherein the second identification in the second identification set corresponds to a label, wherein the third party is a trusted execution environment device, wherein the third party and the first party are located in the same local area network, and h≥1, wherein the method is applied to the third party, and comprises: in response to receiving the first identification set and the target feature corresponding to the first identification set sent by the first party, homomorphically encrypting the first identification set and the target feature corresponding to the first identification set using a target key to obtain a first ciphertext; wherein the target feature includes at least some of the dimensional features in the h-dimensional feature; and sending the first ciphertext to the first party, so that the first party generates a first shard of the first feature and a second shard of the target label based on the first ciphertext, wherein the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

[0274] According to one or more embodiments of the present disclosure, Example 17 provides the method of Example 16, which uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, including: using the target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext; generating a first random number, and symmetrically encrypting the first random number using the target key to obtain a third ciphertext; for each target feature corresponding to the first identification, adding the third ciphertext to the target feature to obtain a feature ciphertext of the target feature; wherein the first ciphertext includes the first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identification, and the second sub-ciphertext includes the first random number and the feature ciphertext of the target feature corresponding to the first identification.

[0275] According to one or more embodiments of the present disclosure, Example 18 provides the method of Example 16, and before the step of sending the first ciphertext to the first party, the method also includes: scrambling the order of the first ciphertext to obtain a fifth ciphertext; sending the first ciphertext to the first party so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the first ciphertext, includes: sending the fifth ciphertext to the first party so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the fifth ciphertext.

[0276] According to one or more embodiments of the present disclosure, Example 19 provides a computer-readable medium having a computer program stored thereon, which implements the steps of any of the methods described in Examples 1-18 when executed by a processing device.

[0277] According to one or more embodiments of the present disclosure, Example 20 provides a computer program product, including a computer program, which implements the steps of any one of the methods of Examples 1-18 when executed by a processor.

[0278] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0279] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0280] Although the subject matter has been described in language specific to structural features and / or method logic actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims. Regarding the device in the above embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Claims

1. A data processing method for secure computing, characterized in that: The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and a first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and a second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device. The third party and the first party are located in the same local area network, and h≥1. The method is applied to the first party, and includes: Sending the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sending the first ciphertext to the first party, wherein the target features include at least some of the h-dimensional features; In response to receiving the first ciphertext and the second ciphertext sent by the second party, generating, according to the first ciphertext and the second ciphertext, a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label, wherein the second ciphertext is obtained by the second party using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; Performing a feature sharding operation with the second party according to the ciphertext of the first feature to obtain a first shard of the first feature, and performing a tag sharding operation with the second party according to the ciphertext of the target tag to obtain a second shard of the target tag; Based on the first shard and the second shard, a target data processing task is executed.

2. The method according to claim 1, characterized in that The first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each of the first identifiers, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the feature ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

3. The method according to claim 2, characterized in that The performing a feature sharding operation with the second party according to the ciphertext of the first feature to obtain a first shard of the first feature includes: Obtaining the first random number in the ciphertext of the first feature, and sending the first random number to the second party, so that the second party symmetrically encrypts the first random number using the target key to obtain a third fragment of the first feature; The characteristic ciphertext of the first characteristic is determined as the first fragment.

4. The method according to claim 1, characterized in that: The label is a binary classification label; The performing a label fragmentation operation with the second party according to the ciphertext of the target label to obtain a second fragment of the target label includes: Generate a second random number, and use the second random number to mask the ciphertext of the target tag to obtain masked data, wherein the second random number is 0 or 1; Sending the masked data to the second party, so that the second party uses the target key to homomorphically decrypt the masked data and generates a fourth fragment of the target tag according to the homomorphic decryption result; The second random number is used as the second shard.

5. The method according to claim 2, characterized in that: The second ciphertext includes a third sub-ciphertext and a fourth sub-ciphertext of the label corresponding to each second identifier, wherein the third sub-ciphertext is obtained by the second party using the target key to pseudo-randomly encrypt the second identifier set, and the fourth sub-ciphertext is obtained by the second party using the target key to perform elliptic curve encryption on the label and target point corresponding to the second identifier, and the target point is any point on a preset elliptic curve.

6. The method according to claim 5, characterized in that The step of generating, according to the first ciphertext and the second ciphertext, a ciphertext of the intersection of the first identifier set and the second identifier set, a ciphertext of the first feature, and a ciphertext of the target label includes: Calculate the intersection of the first sub-ciphertext and the third sub-ciphertext to obtain a ciphertext of the intersection of the first identifier set and the second identifier set; A ciphertext corresponding to the ciphertext of the intersection is determined from all the second sub-ciphertexts to obtain a ciphertext of the first feature, and a ciphertext corresponding to the ciphertext of the intersection is determined from all the fourth sub-ciphertexts to obtain a ciphertext of the target tag.

7. The method according to claim 1, characterized in that The sending the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and sending the first ciphertext to the first party includes: Sending the first identification set and the target features corresponding to the first identification set to the third party, so that the third party uses the target key to homomorphically encrypt the first identification set and the target features corresponding to the first identification set to obtain a first ciphertext, and disrupting the order of the first ciphertext to obtain a fifth ciphertext, and sending the fifth ciphertext to the first party; The step of generating, in response to receiving the first ciphertext and the second ciphertext sent by the second party, a ciphertext of the intersection of the first identifier set and the second identifier set, a ciphertext of the first feature, and a ciphertext of the target tag according to the first ciphertext and the second ciphertext, comprises: In response to receiving the fifth ciphertext and the second ciphertext sent by the second party, a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target tag are generated according to the fifth ciphertext and the second ciphertext.

8. The method according to claim 1, characterized in that The second ciphertext is obtained by the second party performing homomorphic encryption on the second identification set and the label corresponding to the second identification set using the target key, and disrupting the order of the homomorphic encryption results.

9. The method according to any one of claims 1 to 8, characterized in that The target data processing task is a structured query language query task or a machine learning model training task.

10. A data processing method for secure computing, characterized in that: The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and a first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and a second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device. The third party and the first party are located in the same local area network, and h≥1. The method is applied to the second party, and includes: Using the target key, homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext; The second ciphertext is sent to the first party, so that the second party generates, based on the first ciphertext and the second ciphertext, a ciphertext of the intersection of the first identification set and the second identification set, a ciphertext of the first feature, and a ciphertext of the target label, wherein the first ciphertext is obtained by the third party using the target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set, the target feature includes at least some of the dimensional features in the h-dimensional features, the first feature is the target feature corresponding to the intersection, and the target label is the label corresponding to the intersection; performing a feature slicing operation with the first party to obtain a third slicing of the first feature, and performing a tag slicing operation with the first party to obtain a fourth slicing of the target tag; Based on the third shard and the fourth shard, a target data processing task is executed.

11. The method according to claim 10, characterized in that The first ciphertext includes a first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each of the first identifiers, wherein the second sub-ciphertext includes a first random number and a feature ciphertext of the target feature corresponding to the first identifier, the first sub-ciphertext is obtained by the third party performing pseudo-random encryption on the first identifier set using the target key, the feature ciphertext is obtained by the third party performing symmetric encryption on the first random number using the target key to obtain a third ciphertext, and the third ciphertext is added to the target feature corresponding to the first identifier.

12. The method according to claim 11, characterized in that The performing a feature slicing operation with the first party to obtain a third slicing of the first feature includes: In response to receiving the first random number sent by the first party, symmetrically encrypting the first random number using the target key to obtain a fourth ciphertext; Perform a negation operation on the fourth ciphertext to obtain a third fragment of the first feature.

13. The method according to claim 10, characterized in that The step of using the target key to homomorphically encrypt the second identification set and the label corresponding to the second identification set to obtain a second ciphertext includes: Using the target key to pseudo-randomly encrypt the second identifier set to obtain a third sub-ciphertext; For each of the labels corresponding to the second identifiers, perform elliptic curve encryption on the label and the target point using the target key to obtain a fourth sub-ciphertext of the label, wherein the target point is any point on the preset elliptic curve; The second ciphertext includes the third sub-ciphertext and the fourth sub-ciphertext of the tag corresponding to each second identifier.

14. The method according to claim 13, characterized in that The label is a binary classification label; The performing a label fragmentation operation with the first party to obtain a fourth fragment of the target label includes: In response to receiving the masked data sent by the first party, using the target key to homomorphically decrypt the masked data, wherein the masked data is obtained by the first party masking the ciphertext of the target tag using a second random number, and the second random number is 0 or 1; If the homomorphic decryption result is the target point, 0 is determined as the fourth fragment; If the homomorphic decryption result is not the target point, 1 is determined as the fourth fragment.

15. The method according to claim 10, characterized in that Before the step of sending the second ciphertext to the first party, the method further includes: Disrupt the order of the second ciphertext to obtain a sixth ciphertext; The sixth ciphertext is determined as the second ciphertext.

16. A data processing method for secure computing, characterized in that: The participants of the secure computing include a first party, a second party and a third party. The first party holds a first identification set, and a first identification in the first identification set corresponds to an h-dimensional feature. The second party holds a second identification set, and a second identification in the second identification set corresponds to a label. The third party is a trusted execution environment device. The third party and the first party are located in the same local area network, and h≥1. The method is applied to the third party, and includes: In response to receiving the first identification set and the target features corresponding to the first identification set sent by the first party, homomorphically encrypt the first identification set and the target features corresponding to the first identification set using a target key to obtain a first ciphertext; wherein the target features include at least some of the dimensional features in the h-dimensional features; The first ciphertext is sent to the first party, so that the first party generates a first fragment of a first feature and a second fragment of a target label based on the first ciphertext, wherein the first feature is the target feature corresponding to the intersection of the first identification set and the second identification set, and the target label is the label corresponding to the intersection.

17. The method according to claim 16, characterized in that The step of using a target key to homomorphically encrypt the first identification set and the target feature corresponding to the first identification set to obtain a first ciphertext includes: Using the target key to pseudo-randomly encrypt the first identification set to obtain a first sub-ciphertext; Generate a first random number, and symmetrically encrypt the first random number using the target key to obtain a third ciphertext; For each target feature corresponding to the first identifier, add the third ciphertext to the target feature to obtain a feature ciphertext of the target feature; The first ciphertext includes the first sub-ciphertext and a second sub-ciphertext of the target feature corresponding to each first identifier, and the second sub-ciphertext includes the first random number and the feature ciphertext of the target feature corresponding to the first identifier.

18. The method according to claim 16, characterized in that Before the step of sending the first ciphertext to the first party, the method further includes: Disrupt the order of the first ciphertext to obtain a fifth ciphertext; The sending the first ciphertext to the first party so that the first party generates a first fragment of a first feature and a second fragment of a target tag based on the first ciphertext, includes: The fifth ciphertext is sent to the first party, so that the first party generates a first fragment of the first feature and a second fragment of the target tag based on the fifth ciphertext.

19. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processing device, the steps of the method according to any one of claims 1 to 18 are implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 18 are implemented.

Images