Method and device for realizing cross-domain data sharing based on multi-party computing

Abstract

The invention belongs to the technical field of data security, and particularly relates to a method and a device for realizing cross-domain data sharing based on multi-party computing. The method comprises the following steps: constructing a global data directory which is used for cross-domain data sharing and comprises access control authority and file metadata; the data acquisition party compiles a multi-party computing program for describing a data analysis process according to accessible entries in the data directory, and sends the multi-party computing program to the data provider to complete computing environment deployment; the data acquirer initiates a cross-domain data sharing request to the data provider to jointly run a cross-domain data sharing process; a return result of the data sharing request is stored in a result management area and waits for the access of a data acquisition party; and for the data in the result management area, the data acquisition party sends a result access request, acquires a result file storage path and acquires a data sharing result. According to the invention, users in different domains are supported to use different data sharing modes to realize cross-domain data sharing, and the efficiency and convenience of cross-domain data sharing are improved.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a method and device for realizing cross-domain data sharing based on multi-party computing. Background Art

[0002] Data has become an important production factor, and a large amount of valuable information can be obtained by mining data. Cross-domain data sharing enables multiple business departments holding different data to jointly mine valuable information from their data while meeting the requirements of data security laws and regulations. It has broad applications in the fields of smart justice, smart medical care, and financial risk control. Therefore, it is very necessary to realize cross-domain data sharing.

[0003] Most of the existing methods for achieving cross-domain data sharing are: targeting specific data sharing scenarios, making specific designs based on technologies such as multi-party computing to achieve cross-domain data sharing, which partially meets the current cross-domain data sharing needs.

[0004] However, the above method also has the following technical problems:

[0005] The above data sharing method based on multi-party computing requires specific design for different data sharing needs, which consumes a lot of time and manpower. At the same time, the above data sharing method involves complex cryptography and machine learning knowledge, and requires setting a large number of parameters. Currently, there is a lack of a unified cross-domain data sharing platform that separates the complex underlying implementation from the upper-level application through middleware encapsulation and simplifies the parameter setting process. Therefore, when the above method is applied to actual cross-domain data sharing, it will face the problem of poor usability and difficulty in meeting various data sharing needs. Summary of the invention

[0006] The purpose of the present invention is to provide a method and device for realizing cross-domain data sharing based on multi-party computing, so as to solve the problem that the current cross-domain data sharing is faced with poor usability and difficulty in meeting various data sharing requirements.

[0007] The method for realizing cross-domain data sharing based on multi-party computing provided by the present invention involves the following three parties: a data exchange center, a data acquisition party, and a data provider, and specifically includes the following steps:

[0008] (1) A data exchange center builds a unified data directory for data scattered in different domains, and can add or modify data entries in the data directory; set access control permissions and metadata for each data entry in the data directory; wherein the access control permissions of the data entry specify the data acquisition party that can access the data entry, and the metadata of the data entry includes the name of the data, the date of creation of the data, the format of the data, the data sample, and the source of the data set;

[0009] (2) The data acquirer sends a data directory query request to the data exchange center, writes a multi-party computing program describing the data analysis process for the data entries with access rights in the data directory, and sends it to the data provider to complete the computing environment deployment;

[0010] (3) After the computing environment is deployed, the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area; the data acquirer queries the data sharing results in the result management area and obtains the result file storage path.

[0011] Further:

[0012] In step (a), adding or modifying data entries to the data directory and setting access control permissions and metadata for the data entries specifically include the following steps: the data provider adds or updates local data for data sharing to a file sharing area deployed locally, and constructs a data directory entry containing the access control permissions and metadata for the file; the data provider sends the data directory entry containing the access control permissions and metadata for the file to a data exchange center responsible for generating a global data directory; after the data exchange center verifies the identity of the data provider, it merges the data entries newly added by the data provider into the global data directory.

[0013] In step (ii), the data acquirer sends a data directory query request to the data exchange center, and for data entries in the data directory with access rights, writes a multi-party computing program describing the data analysis process, and sends it to the data provider to complete the deployment of the computing environment; specifically, the following steps are included: the data acquirer sends a data directory query request containing its identity information to the data exchange center, and after the data exchange center authenticates its identity, it returns the data directory accessible to the data acquirer; for data entries in the returned data directory with access rights, the data acquirer detects whether the data provider holding the data entry has deployed a multi-party computing software environment, and if not, sends the multi-party computing software environment stored locally to the data provider for deployment; the data acquirer writes a multi-party computing program describing the corresponding data analysis process according to its data analysis needs, and sends the program to the data provider to complete the deployment of the computing environment.

[0014] In step (ii), the multi-party computing procedure specifically includes:

[0015] Secure multi-party computing is used to support data security analysis between multiple data providers and transmit the data analysis results to the data exchange center deployed at the data acquisition party under the premise of protecting the security of the original data;

[0016] Privacy set intersection, which completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer under the premise of ensuring that the original data of the data provider does not leave the local area;

[0017] Secure model reasoning enables the data acquirer to use the model owned by the data provider to predict its input data and obtain labels.

[0018] In step (iii), the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area; specifically includes the following steps: the data acquirer sets the operating parameters of the data sharing process, such as the number of bits used to represent the data, the underlying multi-party computing protocol used, etc., and synchronizes them to the data provider; the data acquirer and the data provider run the multi-party computing program based on the deployed multi-party computing software environment to complete the data sharing process; after the data sharing process is completed, the data sharing results are restored to the data acquirer, and the data acquirer stores it in the result management area.

[0019] The present invention also provides a device for realizing cross-domain data sharing based on multi-party computing, which specifically includes:

[0020] A data directory construction module is used to build a unified data directory for data scattered in different domains, and set the access control rights and metadata of each data entry in the data directory, wherein the access control rights of the data entry include the data acquirer who can access the data entry, and the metadata of the data entry includes the name of the data, the creation date of the data, the format of the data, the data sample, and the source of the data set;

[0021] Identity authentication module, used to store and manage identity information, verify the identity of the data provider and the data acquirer's access rights to the data;

[0022] A multi-party computing module is used to parse data sharing requests and support multiple data sharing methods to achieve cross-domain data sharing, where the data sharing methods include secure multi-party computing, privacy set intersection, and secure model reasoning;

[0023] The result management module is used to manage the data in the result management area and provide a series of operations such as upload, download, and delete.

[0024] The present invention also provides a non-transitory computer-readable storage medium, which stores a computer program or at least one computer-executable instruction. The computer program or at least one computer-executable instruction can be loaded and executed by a processor to implement any of the above-mentioned methods for obtaining target feature labels.

[0025] The present invention also provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that the method of cross-domain data sharing of any one of the above items is implemented when the processor executes the computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The figure is a flowchart of the method for realizing cross-domain data sharing based on multi-party computing of the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described below by way of examples in conjunction with the accompanying drawings. It should be noted that the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Example 1, a method for realizing cross-domain data sharing based on multi-party computing, see Figure 1 As shown. The following steps are included:

[0029] S1. Build a unified data directory for data scattered in different domains, and set the access control permissions and metadata for each data entry in the data directory, that is, build a list A = {{F11, F12, ...}, {F21, F22, ...}, ..., {Fi1, ..., Fij, ...}, ..., {Fm1, ..., Fmj, ...}}, where Fij is the jth data entry provided by the i-th data provider, i ranges from 1 to m, and m is the number of data providers.

[0030] Data providers are users who provide data for access by data acquirers.

[0031] Data acquirers are users who need to acquire data stored in other domains.

[0032] Each data entry contains access control permission information and metadata information.

[0033] Furthermore, the access control permission information includes the data acquirers who can access the data entry, and the metadata information includes the name of the data, the date the data was created, the format of the data, the data sample, the source of the data set, etc.

[0034] The data items of all data providers can be organized in the form of a file tree.

[0035] In step S1, the following sub-steps are specifically included:

[0036] S11. Add / modify data entries to the data directory and set access control permissions and metadata for the data entries.

[0037] Step S11 includes the following sub-steps:

[0038] S111. Data provider i adds / updates local data Fij for data sharing to the file sharing area deployed locally, and constructs a data directory entry containing the access control permissions and metadata of the file.

[0039] S112, data provider i sends the data directory entry containing the access control authority and metadata of the file to the data exchange center, wherein the data exchange center is responsible for aggregating the data directory entries of the data providers and forming a complete global data directory.

[0040] S113. After verifying the identity of the data provider, the data exchange center merges the data entries newly added by the data provider into the global data directory A = {{F11, F12, ...}, {F21, F22, ...}, ..., {Fi1, ..., Fij, ...}, ..., {Fm1, ..., Fmj, ...}}.

[0041] S12. Delete the data entry from the data directory, and remove the access control permission and metadata corresponding to the data entry from the data directory.

[0042] Step S12 specifically includes the following sub-steps:

[0043] S121. The data provider deletes the local data used for data sharing from the file sharing area deployed locally.

[0044] S122. The data provider sends a data entry deletion request to the data exchange center.

[0045] S123. After verifying the identity of the data provider, the data exchange center deletes the data entry requested to be deleted by the data provider from the global data directory.

[0046] S2. Data acquirer r sends a data directory query request to the data exchange center to check the data entries {F1, F2, …, Fn} to which it has access rights. The data directory query request contains the ID of the root directory of the data directory and the identity information of data acquirer r, so that the data exchange center can verify the identity of data acquirer r. Subsequently, the data acquirer writes a multi-party computing program that describes the data analysis process for the data entry Fi in the data directory with access rights according to its data analysis requirements, and sends it to the data provider to complete the computing environment deployment.

[0047] Step S2 specifically includes the following sub-steps:

[0048] S21. The data acquirer sends a data directory query request containing its identity information to the data exchange center. After the data exchange center authenticates its identity, it returns the data directory that the data acquirer can access.

[0049] S22. For the data entry with access rights in the returned data directory, the data acquirer detects whether the data provider holding the data entry has deployed the multi-party computing software environment. If not, the multi-party computing software environment stored locally is sent to the data provider for deployment. The multi-party computing software environment refers to a software environment that implements the multi-party computing protocol and supports multiple participants to collaborate in completing security data analysis.

[0050] S23. The data acquirer writes a multi-party computing program that describes the corresponding data analysis process according to its data analysis needs, and sends the program to the data provider to complete the deployment of the computing environment. Specifically, the multi-party computing program describes the process of calculating the output data based on the input data of multiple participants based on Boolean circuits or arithmetic circuits.

[0051] S3. After the computing environment is deployed, the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area. Specifically, the supported data sharing methods include secure multi-party computing, privacy set intersection, and secure model reasoning.

[0052] Step S3 specifically includes the following sub-steps:

[0053] S31. The data acquirer sets the operating parameters of the data sharing process, such as the number of bits used to represent the data, the underlying multi-party computing protocol used, etc., and synchronizes them to the data provider;

[0054] S32. The data acquirer and the data provider run a multi-party computing program based on the deployed multi-party computing software environment to complete the data sharing process;

[0055] S33. After the data sharing process is completed, the data sharing results are restored to the data acquirer, and the data acquirer stores them in the result management area.

[0056] S4. After the cross-domain data sharing request is completed, the return result Ri of the data sharing request is stored in the local result management area, waiting for the data acquisition party r to access. Among them, the result management area refers to the local area that temporarily stores the data sharing results, and provides a series of operation interfaces such as upload, download, and delete.

[0057] S5. Data acquirer r sends a result access request to obtain the result file storage path and obtain the data sharing result. The result access request includes the unique identifier of the data sharing result and the identity information of data acquirer r. The result file storage path refers to the file path where data acquirer r stores the data sharing result locally.

[0058] Through the above steps, a unified data directory is constructed for data scattered in different domains, and the access control permissions and metadata of each data entry in the data directory are set. According to the permission information in the data directory, the accessible data entries and the available data sharing methods are selected, including multi-party computing, privacy set intersection, and security model reasoning, to complete cross-domain data transmission. Therefore, the method and device for cross-domain data sharing based on multi-party computing of the present invention can enable the data acquirer to securely acquire or analyze the data held by the data provider to obtain valuable information, which is conducive to improving the efficiency and convenience of cross-domain data sharing.

[0059] Embodiment 2, a device for realizing cross-domain data sharing based on multi-party computing, comprising a data directory construction module, an identity authentication module, a multi-party computing module, and a result management module; wherein:

[0060] (1) The data directory construction module is used to construct a unified data directory for data scattered in different domains, and set the access control permissions and metadata of each data entry in the data directory, that is, to construct a list A = {{F11, F12, ...}, {F21, F22, ...}, ..., {Fi1, ..., Fij, ...}, ..., {Fm1, ..., Fmj, ...}}, where Fij is the jth data entry provided by the i-th data provider, i ranges from 1 to m, and m is the number of data providers.

[0061] Specifically, a data provider is a user who provides data for access by a data acquirer.

[0062] Specifically, each data entry includes access control permission information and metadata information.

[0063] Furthermore, the access control permission information includes the data acquirers who can access the data entry and the data sharing methods that can be used, and the metadata information includes the name of the data, the date the data was created, the format of the data, the data sample, and the source of the data set.

[0064] Specifically, the data entries of each data provider may be organized in the form of a file tree.

[0065] (2) The identity authentication module is used to store and manage identity information, verify the identity of the data provider and the data acquirer's access rights to the data.

[0066] (3) The multi-party computing module is used to parse the data sharing request initiated by the data acquirer and support the use of multiple data sharing methods to achieve cross-domain data sharing; wherein the cross-domain data sharing request includes the ID information of the data entry Fi, the identity information of the data acquirer r, the data sharing method used to achieve cross-domain data sharing and the corresponding operating parameters, and the data sharing method includes secure multi-party computing, privacy set intersection, and security model reasoning.

[0067] Specifically, it includes a secure multi-party computing unit, a privacy set intersection unit, and a security model reasoning unit, among which:

[0068] Secure multi-party computing unit, used to support data security analysis between multiple data providers, and transmit the data analysis results to the data exchange center deployed at the data acquisition party under the premise of protecting the security of the original data;

[0069] The privacy set intersection unit completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer under the premise of ensuring that the original data of the data provider does not leave the local area;

[0070] The secure model inference unit is used to enable the data acquirer to use the model owned by the data provider to predict its input data and obtain the label without leaking the input data of the data acquirer.

[0071] (4) The result management module is used to manage the data in the result management area and provide a series of operations such as uploading, downloading, and deleting shared results. The result access request contains the unique identifier of the data sharing result and the identity information of the data acquirer, and the result file storage path refers to the file path where the data acquirer stores the data sharing result locally.

[0072] The above module builds a unified data directory for data scattered in different domains, and sets the access control permissions and metadata of each data entry in the data directory. According to the permission information in the data directory, the accessible data entries and available data sharing methods are selected, including secure multi-party computing, privacy set intersection, and security model reasoning, to complete cross-domain data transmission. Therefore, the method and device for cross-domain data sharing based on multi-party computing of the present invention can enable the data acquirer to securely acquire or analyze the data held by the data provider to obtain valuable information, which is conducive to improving the efficiency and convenience of cross-domain data sharing.

[0073] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store a computer program or at least one computer executable instruction related to implementing a method in a method embodiment. The computer program or at least one computer executable instruction is loaded and executed by the processor to implement the method provided in the above embodiment.

[0074] An embodiment of the present invention further provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the method provided in the above embodiment is implemented when the processor executes the computer program.

[0075] An embodiment of the present invention further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present invention described above in this specification.

[0076] The cross-domain data sharing method provided in this embodiment can build a unified data directory for data scattered in different domains, and set the access control authority and metadata of each data entry in the data directory. According to the authority information in the data directory, the accessible data entries and the available data sharing methods are selected, including secure multi-party computing, privacy set intersection, and security model reasoning, to complete cross-domain data transmission. This method enables the data acquirer to securely acquire or analyze the data held by the data provider to obtain valuable information, which is conducive to improving the efficiency and convenience of cross-domain data sharing.

[0077] Those skilled in the art will appreciate that the present invention is not limited by the above-described embodiments. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and modifications, which fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for realizing cross-domain data sharing based on multi-party computing, which involves the following three parties: a data exchange center, a data acquirer, and a data provider, characterized in that: The specific steps are: (1) The data exchange center builds a unified data directory for data scattered in different domains, and can add or modify data entries in the data directory; set access control permissions and metadata for each data entry in the data directory; wherein the access control permissions of the data entry specify the data acquirers who can access the data entry, and the metadata of the data entry includes the name of the data, the date of creation of the data, the format of the data, the data sample, and the source of the data set; (2) The data acquirer sends a data directory query request to the data exchange center, writes a multi-party computing program describing the data analysis process for the data entries with access rights in the data directory, and sends it to the data provider to complete the computing environment deployment; (3) After the computing environment is deployed, the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area; the data acquirer queries the data sharing results in the result management area and obtains the result file storage path.

2. The method for realizing cross-domain data sharing based on multi-party computing according to claim 1 is characterized in that: Adding or modifying data entries to the data directory and setting access control permissions and metadata for the data entries as described in step (a) specifically include the following steps: the data provider adds or updates local data for data sharing to a locally deployed file sharing area, and constructs a data directory entry containing the access control permissions and metadata for the file; the data provider sends the data directory entry containing the access control permissions and metadata for the file to a data exchange center responsible for generating a global data directory; after verifying the identity of the data provider, the data exchange center merges the data entry newly added by the data provider into the global data directory.

3. The method for realizing cross-domain data sharing based on multi-party computing according to claim 2 is characterized in that: Step (ii) specifically includes the following steps: the data acquirer sends a data directory query request containing its identity information to the data exchange center, and after the data exchange center authenticates its identity, it returns the data directory accessible to the data acquirer; for the data entry with access rights in the returned data directory, the data acquirer detects whether the data provider holding the data entry has deployed the multi-party computing software environment, and if not, sends the multi-party computing software environment stored locally to the data provider for deployment; The data acquirer writes a multi-party computing program that describes the corresponding data analysis process based on its data analysis needs, and sends the program to the data provider to complete the computing environment deployment.

4. The method for realizing cross-domain data sharing based on multi-party computing according to claim 3 is characterized in that: The multi-party computing procedure in step (ii) specifically includes: Secure multi-party computing is used to support data security analysis between multiple data providers and transmit the data analysis results to the data exchange center deployed at the data acquisition party under the premise of protecting the security of the original data; Privacy set intersection, which completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer under the premise of ensuring that the original data of the data provider does not leave the local area; Secure model reasoning enables the data acquirer to use the model owned by the data provider to predict its input data and obtain labels.

5. The method for realizing cross-domain data sharing based on multi-party computing according to claim 4 is characterized in that: The data acquisition party in step (iii) initiates a cross-domain data sharing request to the data provider party, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area, which specifically includes the following steps: the data acquisition party sets the operating parameters of the data sharing process, including the number of bits used to represent the data, the underlying multi-party computing protocol used, and synchronizes them to the data provider party; The data acquirer and the data provider run the multi-party computing program based on the deployed multi-party computing software environment to complete the data sharing process; After the data sharing process is completed, the data sharing results will be restored to the data acquirer, and the data acquirer will store them in the result management area.

6. A cross-domain data sharing device based on the method of claim 5, characterized in that: Specifically include: A data directory construction module is used to build a unified data directory for data scattered in different domains, and set the access control rights and metadata of each data entry in the data directory, wherein the access control rights of the data entry include the data acquirer who can access the data entry, and the metadata of the data entry includes the name of the data, the creation date of the data, the format of the data, the data sample, and the source of the data set; Identity authentication module, used to store and manage identity information, verify the identity of the data provider and the data acquirer's access rights to the data; A multi-party computing module is used to parse data sharing requests and support multiple data sharing methods to achieve cross-domain data sharing, where the data sharing methods include secure multi-party computing, privacy set intersection, and secure model reasoning; The result management module is used to manage the data in the result management area and provide upload, download and delete operations.

7. The device for realizing cross-domain data sharing based on multi-party computing according to claim 6, characterized in that: The multi-party computing module includes: Secure multi-party computing unit, used to support data security analysis between multiple data providers, and transmit the data analysis results to the data exchange center deployed at the data acquisition party under the premise of protecting the security of the original data; The privacy set intersection unit completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer under the premise of ensuring that the original data of the data provider does not leave the local area; The security model inference unit is used to enable the data acquirer to use the model owned by the data provider to predict its input data and obtain a label.

Images