Privacy intersection result verification method and device

Abstract

The invention provides a privacy intersection result verification method and device, and the method comprises the steps that a first mechanism receives a privacy intersection request after an (i-1)-th offline moment, and the privacy intersection request comprises a to-be-queried object; the first mechanism encrypts the to-be-queried object into a first privacy identifier, sends the first privacy identifier to the second mechanism, and obtains a first privacy intersection result fed back by the second mechanism; the first mechanism writes the first privacy intersection result and the to-be-queried object into a query pipeline record; the first mechanism obtains a to-be-verified record in the ith interval period from the query flow record at the ith offline moment; the first mechanism obtains each second privacy identifier of the second mechanism; each second privacy identifier is obtained after the second mechanism encrypts a full-amount object stored in the second mechanism; and the first mechanism verifies each privacy intersection result in the ith interval period fed back by the second mechanism according to the to-be-verified record and each second privacy identifier. According to the scheme, the privacy intersection result can be effectively verified.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for verifying a privacy intersection result. Background Art

[0002] Private Set Intersection (PSI) is an important means to protect the privacy of participants in the data exchange process, which allows participants to jointly calculate the intersection of data without disclosing their own data. This technology has a wide range of applications in many fields, including but not limited to financial services, healthcare, social networks, market research, etc.

[0003] The core advantage of private intersection is to protect data privacy. Participants cannot obtain each other's original data information. This process makes verifying the results of private intersection a complex and difficult problem. Traditional data verification methods usually require direct access to plaintext data, which is obviously no longer applicable in this scenario. Summary of the invention

[0004] The present application provides a method and device for verifying a privacy intersection result, which can effectively verify the privacy intersection result.

[0005] In a first aspect, an embodiment of the present application provides a method for verifying a privacy intersection result, which can be executed by a device for verifying a privacy intersection result, and the device for verifying a privacy intersection result can be a terminal device or a module for a terminal device, or a server or a module for a server. The present application does not limit the execution subject of the method. The method comprises: a first institution receives a privacy intersection request after an i-1th offline time, wherein the privacy intersection request includes an object to be queried; wherein i is a positive integer; the first institution encrypts the object to be queried into a first privacy identifier and sends the first privacy intersection result to a second institution, and obtains a first privacy intersection result fed back by the second institution; the first privacy intersection result is used to indicate whether the object to be queried exists in the second institution; the first institution writes the first privacy intersection result and the object to be queried into a query flow record; the first institution obtains a record to be verified within an i-th interval period from the query flow record at an i-th offline time; the i-th interval period is a period corresponding to the i-1th offline time to the i-th offline time; the first institution obtains each second privacy identifier of the second institution; the each second privacy identifier is obtained after the second institution encrypts all objects stored in itself respectively; the first institution verifies each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the each second privacy identifier.

[0006] The above scheme first obtains the real-time privacy intersection result of the first institution in the i-th interval period, and then compares the real-time privacy intersection result of the i-th interval period with the second privacy identifiers of the second institution, so as to accurately and effectively verify the privacy intersection results in the i-th interval period fed back by the second institution.

[0007] In a possible implementation method, the query flow record also includes the processing time corresponding to the privacy intersection request; the first agency verifies the privacy intersection results within the i-th interval period fed back by the second agency according to the record to be verified and the second privacy identifiers, including: determining the second privacy intersection result of the record to be verified and the second privacy identifiers of the second agency; if the first privacy intersection result in any record in the record to be verified matches the second privacy intersection result, then determining that the first privacy intersection result fed back by the second agency has been verified; if the first privacy intersection result in any record in the record to be verified does not match the second privacy intersection result, then further verifying the unmatched first privacy intersection result through the object change record recorded by the second agency and the processing time in the unmatched record; the object change record records the change time and change status of any object.

[0008] In the above scheme, since the i-th interval period has a certain time length, it is possible that the data of each object of the second organization changes during this time period, resulting in errors in verifying the first privacy intersection result. Therefore, when it is determined that the first privacy intersection result does not match the second privacy intersection result, the object change record recorded by the second organization and the processing time in the mismatched record can be used to accurately and effectively further verify the mismatched first privacy intersection result.

[0009] In a possible implementation method, according to the privacy intersection result, each record in the record to be verified is divided into a first set to be verified and a second set to be verified; each record in the first set to be verified indicates that the corresponding object to be queried does not exist in the second institution; each record in the second set to be verified indicates that the corresponding object to be queried exists in the second institution; determining the second privacy intersection result of the record to be verified and each second privacy identifier of the second institution, including: determining a third privacy intersection result of the first set to be verified and each second privacy identifier of the second institution; determining a fourth privacy intersection result of the second set to be verified and each second privacy identifier of the second institution; judging whether the first privacy intersection result in any record matches the second privacy intersection result in the following manner, including: if the third privacy intersection result set is empty, determining that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise, they do not match; if the first privacy intersection result in any record in the record to be verified is in the fourth privacy intersection result, determining that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise, they do not match.

[0010] The above scheme divides each record in the record to be verified into a first set to be verified and a second set to be verified, and can verify the privacy intersection results of the first set to be verified and the second set to be verified respectively according to the different situations of the first set to be verified and the second set to be verified, thereby accurately and effectively verifying each privacy intersection result within the i-th interval time period fed back by the second institution.

[0011] In a possible implementation method, if the unmatched record belongs to the first set to be verified, it is determined through the object change record recorded by the second organization that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in an invalid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to a valid change status in the second organization, then it is determined that the first privacy intersection result in the unmatched record matches the third privacy intersection result.

[0012] The above scheme can achieve accurate and effective verification of the unmatched first privacy intersection results.

[0013] In a possible implementation method, if the unmatched record belongs to the second set to be verified, it is determined through the object change record recorded by the second organization that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in a valid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to an invalid change status in the second organization, then it is determined that the first privacy intersection result in the unmatched record matches the fourth privacy intersection result.

[0014] The above scheme can achieve accurate and effective verification of the unmatched first privacy intersection results.

[0015] In a possible implementation method, the encryption algorithm is determined according to a privacy request protocol.

[0016] The above scheme uses the privacy intersection protocol to encrypt the objects to be queried and the records to be verified of the first institution, so that the second institution can perform privacy intersection operations based on the encrypted objects to be queried and the records to be verified without knowing the plaintext information of the objects to be queried and the records to be verified of the first institution, thereby ensuring the security of the data of the first institution; uses the privacy intersection protocol to encrypt the full objects stored by the second institution itself, so that the first institution can perform privacy intersection operations based on the encrypted full objects without knowing the plaintext information of the second institution, thereby ensuring the security of the data of the second institution.

[0017] In a second aspect, an embodiment of the present application provides a verification device for a privacy intersection result, comprising: a transceiver unit and a processing unit. The transceiver unit is used to receive a privacy intersection request after the i-1th offline time, wherein the privacy intersection request includes an object to be queried; wherein i is a positive integer; the object to be queried is encrypted into a first privacy identifier and then sent to a second institution, and a first privacy intersection result fed back by the second institution is obtained; the first privacy intersection result is used to indicate whether the object to be queried exists in the second institution; the processing unit is used to write the first privacy intersection result and the object to be queried into a query flow record; at the i-th offline time, the record to be verified within the i-th interval period is obtained from the query flow record; the i-th interval period is the period corresponding to the i-1th offline time period to the i-th offline time period; the transceiver unit is used to obtain each second privacy identifier of the second institution; the second privacy identifiers are obtained after the second institution encrypts the full amount of objects stored in itself; the processing unit is used to verify each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the second privacy identifiers.

[0018] In a possible implementation method, the query flow record also includes the processing time corresponding to the privacy intersection request; the processing unit is used to determine the second privacy intersection result of the record to be verified and the second privacy identifiers of the second agency; if the first privacy intersection result in any record in the records to be verified matches the second privacy intersection result, it is determined that the first privacy intersection result fed back by the second agency has been verified; if the first privacy intersection result in any record in the records to be verified does not match the second privacy intersection result, the unmatched first privacy intersection result is further verified through the object change record recorded by the second agency and the processing time in the unmatched record; the object change record records the change time and change status of any object.

[0019] In a possible implementation method, the processing unit is configured to divide each record in the to-be-verified record into a first to-be-verified set and a second to-be-verified set according to the privacy intersection result; each record in the first to-be-verified set indicates that the corresponding to-be-queried object does not exist in the second institution; each record in the second to-be-verified set indicates that the corresponding to-be-queried object exists in the second institution; determine a third privacy intersection result between the first to-be-verified set and each second privacy identifier of the second institution; determine a fourth privacy intersection result between the second to-be-verified set and each second privacy identifier of the second institution; if the third privacy intersection result set is empty, determine that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise, it does not match; if the first privacy intersection result in any record in the to-be-verified record is in the fourth privacy intersection result, determine that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise, it does not match.

[0020] In a possible implementation method, the processing unit is used to determine, if the unmatched record belongs to the first set to be verified, through the object change record recorded by the second organization, that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in an invalid state in the change status of the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to a valid state in the change status of the second organization, and then determine that the first privacy intersection result in the unmatched record matches the third privacy intersection result.

[0021] In a possible implementation method, the processing unit is used to determine, if the unmatched record belongs to the second set to be verified, through the object change record recorded by the second organization, that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in a valid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to an invalid change status in the second organization, and then determine that the first privacy intersection result in the unmatched record matches the fourth privacy intersection result.

[0022] In a possible implementation method, the encryption algorithm is determined according to a privacy request protocol.

[0023] In a third aspect, an embodiment of the present application further provides a computing device, including:

[0024] A memory for storing program instructions;

[0025] The processor is used to call the program instructions stored in the memory, and execute any method of implementing the above-mentioned first aspect according to the obtained program instructions.

[0026] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, any method of the above-mentioned first aspect is implemented.

[0027] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program executable by a computer device, wherein when the program is run on the computer device, the computer device executes any method for implementing the above-mentioned first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of a method for verifying a privacy intersection result provided in an embodiment of the present application;

[0029] Figure 2 A system architecture diagram of a privacy intersection result verification method provided in an embodiment of the present application;

[0030] Figure 3 A flowchart of a real-time privacy intersection method provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of a real-time privacy intersection method provided in an embodiment of the present application;

[0032] Figure 5 A flowchart of a real-time privacy intersection method provided in an embodiment of the present application;

[0033] Figure 6 A flowchart of a method for verifying a privacy intersection result provided in an embodiment of the present application;

[0034] Figure 7 A flowchart of a method for verifying a privacy intersection result provided in an embodiment of the present application;

[0035] Figure 8 A flowchart of a method for verifying a privacy intersection result provided in an embodiment of the present application;

[0036] Fig. 9 A schematic diagram of the structure of a privacy intersection result verification device provided in an embodiment of the present application;

[0037] Fig.10 A schematic diagram of the structure of a privacy intersection result verification device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The current solutions for verifying the correctness of private intersection results are:

[0039] (1) More functional tests and a more complete test set.

[0040] Through in-depth testing, potential problems in the system can be discovered and resolved, improving the reliability and stability of the software and ensuring normal functionality.

[0041] However, relying solely on testing cannot solve all problems in the program. Privacy protection belongs to a relatively new technical field with relatively high complexity, and it is difficult to cover all situations.

[0042] (2) Explicit random inspection.

[0043] By using direct plaintext comparison, you can quickly confirm whether the privacy intersection result meets the expected result.

[0044] There are the following problems with plain text sampling:

[0045] First, random inspection is a kind of sampling behavior, which cannot cover all data surfaces. From the perspective of integrity, the normal results of random inspection cannot prove that the results of the entire data set are normal and meet expectations. In addition, plaintext random inspection will expose the original data information, which may cause privacy leakage problems and is not applicable to some sensitive scenarios.

[0046] (3) Trusted third-party audit

[0047] Another solution is to have a trusted third party review the results of the privacy request, but there is still the problem of exposing the original information and causing privacy leakage. For some institutions, third-party audits also have compliance issues.

[0048] Figure 1 A flowchart of a privacy intersection result verification method provided in an embodiment of the present application, the method can be executed by a privacy intersection result verification device, the privacy intersection result verification device can be a terminal device or a module for a terminal device, or a server or a module for a server. The present application does not limit the execution subject of the method.

[0049] The method comprises the following steps:

[0050] Step 101: The first institution receives a privacy exchange request after the (i-1)th offline time.

[0051] Wherein, the privacy intersection request includes the object to be queried; i is a positive integer.

[0052] In a possible implementation method, the first mechanism receives the privacy intersection request in real time during the period corresponding to the i-1th offline time to the i-th offline time, and writes the privacy intersection result into the query flow record.

[0053] Step 102: the first institution encrypts the object to be queried into a first privacy identifier and sends it to the second institution, and obtains a first privacy intersection result fed back by the second institution.

[0054] The first privacy intersection result is used to indicate whether the second institution has the object to be queried.

[0055] In one possible implementation method, the algorithm for encrypting the object to be queried is determined based on a privacy intersection protocol, wherein the privacy intersection protocol includes one or more of the following: an oblivious pseudo-random function OPRF protocol, a Yao confusion circuit, a privacy set intersection of fully homomorphic encryption (FHE), or a privacy set intersection based on public key encryption.

[0056] The first institution encrypts the object to be queried into a first privacy identifier and sends it to the second institution, and the second institution cannot obtain the object to be queried based on the first privacy identifier. That is, the second institution cannot obtain the plaintext information of the first institution by decrypting the corresponding privacy identifier.

[0057] Step 103: The first institution writes the first privacy intersection result and the object to be queried into a query flow record.

[0058] In a possible implementation method, the query flow record is stored in the first institution.

[0059] In a possible implementation method, the first mechanism writes the first privacy intersection result and the object to be queried into a query flow record; when the privacy intersection result needs to be verified later, the object to be queried is encrypted.

[0060] Step 104: the first institution obtains the records to be verified within the i-th interval period from the query flow record at the i-th offline time.

[0061] The i-th interval period is a period corresponding to the i-1th offline time to the i-th offline time.

[0062] In a possible implementation method, the record to be verified is a privacy intersection result within a period corresponding to the (i-1)th offline time to the (i)th offline time.

[0063] Step 105: The first institution obtains each second privacy identifier of the second institution.

[0064] The second privacy identifiers are obtained by encrypting the full amount of objects stored by the second organization.

[0065] In one possible implementation method, the algorithm used by the second institution to encrypt all objects stored in itself is determined according to the privacy intersection protocol, that is, the first institution cannot obtain the plaintext information of the second institution by decrypting each second privacy identifier.

[0066] Step 106: The first institution verifies each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the second privacy identifiers.

[0067] In a possible implementation method, if the privacy intersection results within the i-th interval are abnormal, the first mechanism performs abnormal processing according to the abnormality.

[0068] The above scheme first obtains the real-time privacy intersection result of the first institution in the i-th interval period, and then compares the real-time privacy intersection result of the i-th interval period with the second privacy identifiers of the second institution, so as to accurately and effectively verify the privacy intersection results in the i-th interval period fed back by the second institution.

[0069] Optionally, the first institution and the second institution are two independent institutions, and the real-time privacy intersection result of the first institution can be verified, and the real-time privacy intersection result of the second institution can also be verified; this application does not limit this. Verifying the real-time privacy intersection result of the second institution is similar to verifying the real-time privacy intersection result of the first institution, and will not be repeated here. The subsequent embodiments are all explained by taking the verification of the real-time privacy intersection result of the first institution as an example.

[0070] In a possible implementation method, the privacy intersection result in the query flow record can be verified repeatedly. This application is not limited to verifying the privacy intersection result in the query flow record of the i-th interval period, and the privacy intersection result at any time in the query flow record can be verified multiple times according to actual needs.

[0071] In one embodiment, the query flow record also includes the processing time corresponding to the privacy intersection request;

[0072] The first institution verifies each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the second privacy identifiers, including:

[0073] Determine the second privacy intersection result of the record to be verified and each second privacy identifier of the second institution; if the first privacy intersection result in any record of the record to be verified matches the second privacy intersection result, then determine that the first privacy intersection result fed back by the second institution has been verified; if the first privacy intersection result in any record of the record to be verified does not match the second privacy intersection result, then further verify the unmatched first privacy intersection result through the object change record recorded by the second institution and the processing time in the unmatched record; the object change record records the change time and change status of any object. In this scheme, since the i-th interval period has a certain time length, it is possible that the data of each object of the second institution changes within this time period, resulting in errors in the verification of the first privacy intersection result. Therefore, when it is determined that the first privacy intersection result does not match the second privacy intersection result, the object change record recorded by the second institution and the processing time in the unmatched record can be used to accurately and effectively further verify the unmatched first privacy intersection result.

[0074] In a possible implementation method, according to the privacy intersection result, each record in the records to be verified is divided into a first set to be verified and a second set to be verified; each record in the first set to be verified represents that the corresponding object to be queried does not exist in the second institution; each record in the second set to be verified represents that the corresponding object to be queried exists in the second institution.

[0075] In one possible implementation method, if there is an unmatched record, the first institution encrypts the unmatched record and sends it to the second institution, which performs further verification; or, after the second institution receives the encrypted unmatched record sent by the first institution, it sends the change flow of the second privacy identifier corresponding to the encrypted unmatched record to the first institution, which performs further verification.

[0076] In a possible implementation method, a third privacy intersection result of the first set to be verified and each second privacy identifier of the second institution is determined; if the third privacy intersection result set is empty, it is determined that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise it is determined that they do not match.

[0077] In a possible implementation method, if the unmatched record belongs to the first set to be verified, it is determined through the object change record recorded by the second organization that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in an invalid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to a valid change status in the second organization, then it is determined that the first privacy intersection result in the unmatched record matches the third privacy intersection result.

[0078] For example, the first set to be verified is (1, 2, 3), and the second privacy identification set obtained after the second institution encrypts all objects stored in itself is (1, 4, 5). Logically, each record in the first set to be verified indicates that the second institution does not have a corresponding object to be queried. Therefore, the first set to be verified should not have an intersection with the second privacy identification set. However, at this time, it is found that the first set to be verified and the second privacy identification set have an intersection (1), so the intersection (1) is an unmatched record, recorded as the first unmatched record.

[0079] At this time, query the processing time of the second privacy identifier corresponding to the first unmatched record in the second institution in the object change record recorded by the second institution; if before the processing time, the change status of the second privacy identifier corresponding to the first unmatched record in the second institution is invalid, and after the processing time, the change status of the second privacy identifier corresponding to the first unmatched record in the second institution is valid, it means that the second privacy identifier corresponding to the first unmatched record in the second institution is added to the second institution after the processing time, and at this time, it is considered that the first privacy intersection result of the first unmatched record matches the second privacy identifiers.

[0080] In a possible implementation method, the invalid state means that the object to be queried does not exist in the second institution. The valid state means that the object to be queried exists in the second institution.

[0081] In a possible implementation method, the processing time refers to the time when the second institution receives the privacy exchange request, or the time when the second institution sends the privacy exchange request result to the first institution.

[0082] In a possible implementation method, the fourth privacy intersection result of the second set to be verified and each second privacy identifier of the second institution is determined; if the first privacy intersection result in any record of the records to be verified is in the fourth privacy intersection result, then the first privacy intersection result corresponding to the first privacy identifier in any record is determined to match the second privacy intersection result, otherwise it is not matched. Specifically, if the non-intersection of the first privacy intersection result and the fourth privacy intersection result in any record of the records to be verified is empty, then the first privacy intersection result corresponding to the first privacy identifier in any record is determined to match the second privacy intersection result; if the non-intersection of the first privacy intersection result and the fourth privacy intersection result in any record of the records to be verified is not empty, then the first privacy intersection result corresponding to the first privacy identifier in any record is determined to not match the second privacy intersection result.

[0083] In a possible implementation method, if the unmatched record belongs to the second set to be verified, it is determined through the object change record recorded by the second organization that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in a valid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to an invalid change status in the second organization, then it is determined that the first privacy intersection result in the unmatched record matches the fourth privacy intersection result.

[0084] Exemplarily, the second set to be verified is (1,2,3,4), and the second privacy identifier set obtained after the second institution encrypts all objects stored in itself is (1,2,3,5,6,7); in theory, each record in the first set to be verified represents that the second institution has a corresponding object to be queried; so the intersection of the first set to be verified and the second privacy identifier set should be the same as the second set to be verified. However, at this time, it is found that the intersection of the first set to be verified and the second privacy identifier set is (1,2,3), then the intersection (1,2,3) does not exist in the set (4) in the second set to be verified (1,2,3,4), then the combination (4) is an unmatched record, recorded as the second unmatched record.

[0085] At this time, the processing time of the second privacy identifier corresponding to the second unmatched record in the second institution is queried in the object change record recorded by the second institution; if before the processing time, the second privacy identifier corresponding to the second unmatched record in the second institution is in a valid state in the change status of the second institution; after the processing time, the second privacy identifier corresponding to the second unmatched record in the second institution is in an invalid state in the change status of the second institution, it means that the second privacy identifier corresponding to the second unmatched record in the second institution is deleted or unavailable after the processing time, and at this time, it is considered that the first privacy intersection result of the second unmatched record matches the second privacy identifiers.

[0086] Based on the same technical concept, Figure 2 A system for obtaining a privacy result provided by an embodiment of the present application is exemplarily shown, wherein the system includes a first mechanism and a second mechanism, wherein the first mechanism corresponds to Figure 2 Institution A, the second institution corresponds to Figure 2 Institution B. Each institution includes a business system, a real-time privacy intersection system, and an offline verification system. The business system is used to store the plaintext data of the corresponding institution and send privacy intersection requests to the real-time privacy intersection system; the real-time privacy intersection system is used to provide real-time privacy intersection functions to meet the real-time, availability, and security requirements of the system; the offline verification system is used to verify the historical privacy intersection results to enhance the reliability and accuracy of the system.

[0087] The real-time privacy intersection system and offline verification system are introduced below.

[0088] In one possible implementation method, a real-time privacy exchange system is deployed in each institution, and data synchronization interfaces such as adding, updating, and deleting are provided for the real-time privacy exchange system, which is called by the corresponding business system of each institution to keep the data of the two consistent.

[0089] In a possible implementation method, the business system stores a business data table, which records the plain text business data of each organization.

[0090] In a possible implementation method, the real-time privacy exchange system stores a data identification table, which corresponds to the business data table of the business system, except that the data identification table records the identification information corresponding to each piece of data in the business data table. For example, the ID card of each user in the business data table is used as the first identification, and the first identification is calculated by a hash algorithm and stored in the data identification table as the second identification.

[0091] In a possible implementation method, the data identification table includes data identification, data status and update time; wherein the data identification can be the hash value of the identification information corresponding to each data in the business data table; the data status includes valid status and invalid status; newly added and updated data is valid status, and deleted data is invalid status. The business system calls the interface provided by the privacy exchange service, and in order to ensure the privacy of business data, the business system hashes the data and synchronizes it to the privacy exchange system.

[0092] In a possible implementation method, the real-time privacy-enhancing system stores a change flow table, which is used to record the change of each object.

[0093] In a possible implementation method, the change flow table includes a data identifier, a change time, and a change type; wherein the change type includes one or more of the following: addition, update, and deletion.

[0094] For example, the business system calls the privacy intersection service at time “20230901181523” to insert a record with a hash value of 0x9812…, and the generated transaction record is: New, 20230901181523, 0x9812…; the business system calls the privacy intersection service at time “20230902210543” to delete the record with a hash value of 0x9812…, and the generated transaction record is: Delete, 20230902210543, 0x9812…

[0095] In one embodiment, the specific process of the first institution's real-time privacy request is as follows: Figure 3 and Figure 4 As shown, the process includes the following steps, wherein: Figure 3 The hash data table in is the above-mentioned data identification table, organization A is the first organization, and organization B is the second organization.

[0096] If the first institution needs to confirm whether the user "Xiao Wang" is the intersection data of the two institutions, the first institution is the active query party and the second institution is the passive query party. The process is as follows.

[0097] Step 401: The business system of the first institution sends a privacy request to the real-time privacy request system of the first institution.

[0098] The privacy intersection request includes the object to be queried.

[0099] Exemplarily, the business system of the first institution sends the hash value of the user "Xiao Wang" to the real-time privacy exchange service of the first institution to initiate a privacy exchange request.

[0100] Step 402: The real-time privacy intersection service of the first institution receives a privacy intersection request, generates a first privacy identifier for the object to be queried according to a privacy intersection protocol, and sends the first privacy identifier to the real-time privacy intersection service of the second institution.

[0101] Step 403: The real-time privacy exchange service of the second institution receives the first privacy identifier sent by the first institution.

[0102] Step 404: The real-time privacy exchange service of the second institution determines whether the second institution has the object to be queried according to the data identification table stored in the second institution, and generates a response result according to the privacy exchange protocol.

[0103] Step 405: The real-time privacy exchange service of the second institution sends a response result to the real-time privacy exchange service of the first institution.

[0104] Step 406: The real-time privacy exchange service of the first institution parses the response result and sends the parsed response result to the business system of the first institution.

[0105] In a possible implementation method, the real-time privacy request service of the first institution writes the parsed response result into the query flow record, such as Figure 5 The query flow record is used for the real-time privacy intersection service to record the flow of the return result of the real-time privacy intersection service query of the second institution. Among them, the intersection query flow table is the query flow record.

[0106] In a possible implementation method, the query flow record includes the first privacy intersection result, the first privacy identifier, and the processing time corresponding to the privacy intersection request.

[0107] For example, the first institution queries the second institution for data with a hash value of 0x54d5… at the time “20210730102231”, and the returned result is the intersection data. Then the newly added query flow is: 0x54d5…, 20210730102231, yes;

[0108] The first institution queries the second institution for data with a hash value of 0x6ada… at time “20220628111724”, and the returned result is non-intersection data. The newly added query flow is: 0x6ada…, 20220628111724, no.

[0109] Step 407: The business system of the first organization determines whether the object to be queried exists in the second organization based on the parsed response result.

[0110] In one possible implementation method, the offline verification system is designed to perform periodic multiple checks on the results of the real-time privacy intersection system, and can use a more secure privacy intersection algorithm or mix and use multiple privacy intersection algorithm results for cross-checking to enhance the reliability of the system and the correctness of the results.

[0111] Exemplarily, by reconciling the incremental data in the query flow records of the first institution in the first cycle with the full data in the data identification table of the second institution, it can be checked whether the real-time intersection query return of the intersection query flow records of the first institution meets expectations. Similarly, by reconciling the incremental data in the query flow records of the second institution in the first cycle with the full data in the data identification table of the first institution, it can be checked whether the real-time intersection query return of the intersection query flow records of the second institution meets expectations.

[0112] In one possible implementation method, the reconciliation time and frequency are set, for example, when the real-time privacy exchange system is relatively idle, offline verification is performed; or a fixed frequency is set, and all real-time privacy exchange results in the current hour are offline verified once every hour. This application does not limit the reconciliation time and frequency.

[0113] In one embodiment, the specific process of offline verification by the first institution is as follows: Figure 6 As shown, Figure 6 The data hash table in is the above-mentioned data identification table, and the hash change flow table is the above-mentioned query flow record; institution A is the first institution, and institution B is the second institution.

[0114] In a possible implementation method, according to the privacy intersection result, each record in the records to be verified is divided into a first set to be verified and a second set to be verified; each record in the first set to be verified represents that the corresponding object to be queried does not exist in the second institution; each record in the second set to be verified represents that the corresponding object to be queried exists in the second institution.

[0115] In a possible implementation method, the process of performing offline verification on the first set to be verified is as follows: Figure 7 As shown, the following steps are included:

[0116] Step 701: The offline verification system of the first institution obtains records to be verified within a first period from a first set to be verified.

[0117] Step 702: The offline verification system of the second organization obtains all objects stored in itself from the data identification table.

[0118] Step 703: The first institution and the second institution start a batch privacy intersection task according to the privacy intersection protocol.

[0119] Step 704: After the first institution obtains the third privacy intersection result, if the third privacy intersection result is empty, it verifies that the real-time privacy intersection result is correct.

[0120] In one possible implementation method, after the first institution obtains the third privacy intersection result, the offline verification system's intersection result is empty, indicating that the query flow of the first institution's real-time privacy intersection service record is in line with expectations, and the data of the non-intersection set is also non-intersection data in the batch intersection result, and this round of reconciliation is completed.

[0121] In one possible implementation method, the third privacy intersection result is not empty. Assuming that one of the query records is identified as h and the processing time is t, there are two possible results that meet expectations:

[0122] It is possible that after processing time t, the data state corresponding to the data identification table h of the second institution has changed:

[0123] Case 1: Before processing time t, data h does not exist in the second institution, and after time t, data h is added;

[0124] Case 2: Before processing time t, the data of the second institution h is in a deleted state. After time t, the state of t is changed to a valid state.

[0125] For this scenario, the second organization performs verification and queries its own change flow table to check whether there is a flow in the interval of processing time > t that changes the status of h data to a valid state.

[0126] In a possible implementation method, the process of performing offline verification on the second set to be verified is as follows: Figure 8 As shown, the following steps are included:

[0127] Step 801: The offline verification system of the first institution obtains records to be verified within a first period from a second set to be verified.

[0128] Step 802: The offline verification system of the second organization obtains all objects stored in itself from the data identification table.

[0129] Step 803: The first institution and the second institution start a batch privacy intersection task according to the privacy intersection protocol.

[0130] Step 804: After the first institution obtains the fourth privacy intersection result, if the fourth privacy intersection result is the same as the second set to be verified, the real-time privacy intersection result is verified to be correct.

[0131] In one possible implementation method, the fourth privacy intersection result is calculated with the second set to be verified. If the non-intersection part of the fourth privacy intersection result and the second set to be verified is empty, it means that the real-time privacy intersection service of the first institution in the first cycle meets expectations, and the data of the intersection set of the real-time privacy intersection is also intersection data in the batch intersection result, and this round of reconciliation is completed.

[0132] In one possible implementation method, if the fourth privacy intersection result and the non-intersection part of the second set to be verified are not empty, it is assumed that one of the records is identified as h, the processing time is t, and before the processing time t, the h data of the second institution is in a valid state, and after time t, the state of t is changed to an invalid state; for this scenario, the second institution performs verification and queries its own change flow table to see whether there is a flow in the interval of processing time > t that changes the state of h data to an invalid state.

[0133] In a possible implementation method, the result of the calculation of the real-time privacy intersection service of the first institution is abnormal, and an alarm is sent to the business system of the first institution, and the business system of the first institution investigates the abnormality.

[0134] Based on the same technical concept, Fig. 9 The following is an exemplary diagram of a privacy verification result verification device 900 provided in an embodiment of the present application. Fig. 9 As shown, it includes: a transceiver unit 901 and a processing unit 902. The transceiver unit 901 is used to receive a privacy intersection request after the i-1th offline time, and the privacy intersection request includes an object to be queried; wherein i is a positive integer; encrypt the object to be queried into a first privacy identifier and send it to the second institution, and obtain a first privacy intersection result fed back by the second institution; the first privacy intersection result is used to indicate whether the second institution has the object to be queried; the processing unit 902 is used to write the first privacy intersection result and the object to be queried into a query flow record; obtain the record to be verified within the i-th interval period from the query flow record at the i-th offline time; the i-th interval period is the period corresponding to the i-1th offline time to the i-th offline time; the transceiver unit 901 is used to obtain each second privacy identifier of the second institution; the each second privacy identifier is obtained after the second institution encrypts the full amount of objects stored in itself respectively; the processing unit 902 is used to verify each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the each second privacy identifier.

[0135] In a possible implementation method, the query flow record also includes the processing time corresponding to the privacy intersection request; the processing unit 902 is used to determine the second privacy intersection result of the record to be verified and each second privacy identifier of the second institution; if the first privacy intersection result in any record in the records to be verified matches the second privacy intersection result, it is determined that the first privacy intersection result fed back by the second institution has been verified; if the first privacy intersection result in any record in the records to be verified does not match the second privacy intersection result, the unmatched first privacy intersection result is further verified through the object change record recorded by the second institution and the processing time in the unmatched record; the object change record records the change time and change status of any object.

[0136] In a possible implementation method, the processing unit 902 is configured to divide each record in the to-be-verified record into a first to-be-verified set and a second to-be-verified set according to the privacy intersection result; each record in the first to-be-verified set indicates that the corresponding to-be-queried object does not exist in the second institution; each record in the second to-be-verified set indicates that the corresponding to-be-queried object exists in the second institution; determine a third privacy intersection result between the first to-be-verified set and each second privacy identifier of the second institution; determine a fourth privacy intersection result between the second to-be-verified set and each second privacy identifier of the second institution; if the third privacy intersection result set is empty, it is determined that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise it is not matched; if the first privacy intersection result in any record in the to-be-verified record is in the fourth privacy intersection result, it is determined that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise it is not matched.

[0137] In a possible implementation method, the processing unit 902 is used to determine, if the unmatched record belongs to the first set to be verified, through the object change record recorded by the second organization, that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in an invalid state in the change status of the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to a valid state in the change status of the second organization, and then determine that the first privacy intersection result in the unmatched record matches the third privacy intersection result.

[0138] In a possible implementation method, the processing unit 902 is used to determine, if the unmatched record belongs to the second set to be verified, through the object change record recorded by the second organization, that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in a valid change status in the second organization; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to an invalid change status in the second organization, and then determine that the first privacy intersection result in the unmatched record matches the fourth privacy intersection result.

[0139] In a possible implementation method, the encryption algorithm is determined according to a privacy request protocol.

[0140] Based on the same technical concept, the embodiment of the present application provides a privacy intersection result verification device 1000, which can be a computing device, for example. Fig.10 As shown, a privacy intersection result verification device 1000 includes at least one processor 1001 and a memory 1002 connected to the at least one processor. The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the present application. Fig.10 For example, the processor 1001 and the memory 1002 are connected via a bus. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0141] In an embodiment of the present application, the memory 1002 stores instructions that can be executed by at least one processor 1001. The at least one processor 1001 can execute the above-mentioned method for verifying the privacy intersection result by executing the instructions stored in the memory 1002.

[0142] Among them, the processor 1001 is a control center of the verification device 1000 for the result of privacy intersection, and can use various interfaces and lines to connect various parts of the computer device, and perform resource settings by running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002. Optionally, the processor 1001 may include one or more determination units, and the processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application program, etc., and the modem processor mainly processes wireless communication. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0143] Processor 1001 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware processor to be executed, or can be executed by a combination of hardware and software modules in the processor.

[0144] The memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 1002 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 1002 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0145] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer-executable program. The computer-executable program is used to enable a computer to execute a method for verifying a privacy intersection result listed in any of the above methods.

[0146] An embodiment of the present application provides a computer program product, including a computer program executable by a computer device. When the program is run on the computer device, the computer device executes a method for verifying a privacy intersection result listed in any of the above-mentioned methods.

[0147] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0148] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for verifying a privacy intersection result, characterized in that: include: The first institution receives a privacy intersection request after the i-1th offline time, wherein the privacy intersection request includes an object to be queried; wherein i is a positive integer; The first institution encrypts the object to be queried into a first privacy identifier and sends it to the second institution, and obtains a first privacy intersection result fed back by the second institution; the first privacy intersection result is used to indicate whether the object to be queried exists in the second institution; The first institution writes the first privacy intersection result and the object to be queried into a query flow record; The first mechanism obtains the record to be verified within the i-th interval period from the query flow record at the i-th offline time; the i-th interval period is the period corresponding to the i-1-th offline time to the i-th offline time; The first institution obtains each second privacy identifier of the second institution; each second privacy identifier is obtained after the second institution encrypts all objects stored in the second institution respectively; The first institution verifies each privacy intersection result within the i-th interval time period fed back by the second institution according to the record to be verified and the second privacy identifiers.

2. The method according to claim 1, characterized in that The query flow record also includes the processing time corresponding to the privacy intersection request; The first institution verifies each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the second privacy identifiers, including: Determine a second privacy intersection result between the record to be verified and each second privacy identifier of the second institution; If the first privacy intersection result in any record of the to-be-verified records matches the second privacy intersection result, it is determined that the first privacy intersection result fed back by the second institution has been verified; If the first privacy intersection result in any record in the records to be verified does not match the second privacy intersection result, the unmatched first privacy intersection result is further verified through the object change record recorded by the second organization and the processing time in the unmatched record; the object change record records the change time and change status of any object.

3. The method according to claim 2, characterized in that According to the privacy intersection result, each record in the to-be-verified record is divided into a first to-be-verified set and a second to-be-verified set; each record in the first to-be-verified set indicates that the corresponding to-be-queried object does not exist in the second institution; each record in the second to-be-verified set indicates that the corresponding to-be-queried object exists in the second institution; Determining the second privacy intersection result between the record to be verified and each second privacy identifier of the second institution includes: Determine a third privacy intersection result of the first to-be-verified set and each second privacy identifier of the second institution; Determine a fourth privacy intersection result of the second to-be-verified set and each second privacy identifier of the second institution; The method of determining whether the first privacy intersection result in any record matches the second privacy intersection result is as follows, including: If the third privacy intersection result set is empty, it is determined that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise it is determined that they do not match; If the first privacy intersection result in any record in the to-be-verified records is included in the fourth privacy intersection result, it is determined that the first privacy intersection result corresponding to the first privacy identifier in any record matches the second privacy intersection result, otherwise they do not match.

4. The method according to claim 3, characterized in that Further verifying the unmatched first privacy intersection result through the object change record recorded by the second institution and the processing time in the unmatched record includes: If the unmatched record belongs to the first set to be verified, it is determined through the object change record recorded by the second institution that before the processing time in the unmatched record, the change status of the second privacy identifier corresponding to the first privacy identifier in the unmatched record in the second institution is invalid; after the processing time in the unmatched record, the change status of the second privacy identifier corresponding to the first privacy identifier in the unmatched record in the second institution is updated to a valid state, then it is determined that the first privacy intersection result in the unmatched record matches the third privacy intersection result.

5. The method according to claim 3, characterized in that Further verifying the unmatched first privacy intersection result through the object change record recorded by the second institution and the processing time in the unmatched record includes: If the unmatched record belongs to the second set to be verified, it is determined through the object change record recorded by the second institution that before the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is in a valid change status in the second institution; after the processing time in the unmatched record, the second privacy identifier corresponding to the first privacy identifier in the unmatched record is updated to an invalid change status in the second institution, then it is determined that the first privacy intersection result in the unmatched record matches the fourth privacy intersection result.

6. The method according to any one of claims 1 to 5, characterized in that The encryption algorithm is determined according to the privacy request protocol.

7. A device for verifying a privacy intersection result, characterized in that: Including transceiver unit and processing unit: The transceiver unit is configured to receive a privacy intersection request after the i-1th offline time, wherein the privacy intersection request includes an object to be queried; wherein i is a positive integer; encrypt the object to be queried into a first privacy identifier and send it to the second institution, and obtain a first privacy intersection result fed back by the second institution; the first privacy intersection result is used to indicate whether the object to be queried exists in the second institution; The processing unit is configured to write the first privacy intersection result and the object to be queried into a query log record; obtain the record to be verified within the i-th interval period from the query log record at the i-th offline moment; the i-th interval period is the period corresponding to the i-1th offline moment to the i-th offline moment; The transceiver unit is further used to obtain each second privacy identifier of the second institution; each second privacy identifier is obtained after the second institution encrypts all objects stored in itself; The processing unit is further configured to verify each privacy intersection result within the i-th interval period fed back by the second institution according to the record to be verified and the second privacy identifiers.

8. A computing device, characterized in that include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 6 according to the obtained program instructions.

9. A computer-readable storage medium, characterized in that: The method comprises computer-readable instructions, and when a computer reads and executes the computer-readable instructions, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The invention comprises a computer program executable by a computer device, and when the program is run on the computer device, the computer device is caused to execute the steps of the method according to any one of claims 1 to 6.

Images