A method and device for realizing cross-domain data sharing based on multi-party computation

Abstract

The present application belongs to the technical field of data security, and specifically relates to a method and device for realizing cross-domain data sharing based on multi-party computation. The method comprises the following steps: constructing a global data directory for cross-domain data sharing, which comprises access control permissions and file metadata; a data acquisition party writes a multi-party computation program describing a data analysis process for the accessible entries in the data directory, sends the program to a data provider, and completes computation environment deployment; the data acquisition party initiates a cross-domain data sharing request to the data provider, and jointly runs a cross-domain data sharing process; the returned result of the data sharing request is stored in a result management area, and waits for access by the data acquisition party; the data acquisition party sends a result access request for the data in the result management area, acquires a result file storage path, and obtains the data sharing result. The present application supports users in different domains to realize cross-domain data sharing in different data sharing modes, and improves the efficiency and convenience of cross-domain data sharing.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and specifically relates to a method and device for realizing cross-domain data sharing based on multi-party computing. Background Art

[0002] Data has become a crucial factor in production, and data mining can yield a wealth of valuable information. Cross-domain data sharing enables multiple business departments holding different data to jointly mine valuable information from their data while complying with data security laws and regulations. This has broad applications in areas such as smart justice, smart healthcare, and financial risk management. Therefore, cross-domain data sharing is essential.

[0003] Most of the existing methods for achieving cross-domain data sharing are: targeting specific data sharing scenarios, making specific designs based on technologies such as multi-party computing to achieve cross-domain data sharing, which partially meets the current cross-domain data sharing needs.

[0004] However, the above method also has the following technical problems:

[0005] The aforementioned multi-party computation-based data sharing methods require specialized design tailored to different data sharing needs, consuming significant time and effort. Furthermore, these methods involve complex cryptography and machine learning knowledge and require numerous parameter settings. Currently, there is a lack of a unified cross-domain data sharing platform that isolates the complex underlying implementation from upper-layer applications through middleware encapsulation and simplifies the parameter setting process. Consequently, when applied to actual cross-domain data sharing, these methods suffer from poor usability and difficulty meeting diverse data sharing requirements. Summary of the Invention

[0006] The purpose of the present invention is to provide a method and device for realizing cross-domain data sharing based on multi-party computing, so as to solve the problem that cross-domain data sharing currently faces poor usability and difficulty in meeting various data sharing requirements.

[0007] The method for implementing cross-domain data sharing based on multi-party computing provided by the present invention involves the following three parties: a data exchange center, a data acquirer, and a data provider, and specifically includes the following steps:

[0008] (1) A data exchange center builds a unified data directory for data scattered across different domains, and can add or modify data entries in the data directory; it sets access control permissions and metadata for each data entry in the data directory; wherein the access control permissions for the data entry specify the data acquirers who can access the data entry, and the metadata for the data entry includes the name of the data, the date the data was created, the format of the data, the data sample, and the source of the data set;

[0009] (2) The data acquirer sends a data directory query request to the data exchange center, and for the data entries in the data directory with access rights, writes a multi-party computing program that describes the data analysis process, and sends it to the data provider to complete the computing environment deployment;

[0010] (3) After the computing environment is deployed, the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area; the data acquirer queries the data sharing results in the result management area and obtains the result file storage path.

[0011] Further:

[0012] In step (1), adding or modifying data entries to the data directory and setting access control permissions and metadata for the data entries specifically include the following steps: the data provider adds or updates local data for data sharing to a locally deployed file sharing area, and constructs a data directory entry containing the access control permissions and metadata for the file; the data provider sends the data directory entry containing the access control permissions and metadata for the file to the data exchange center responsible for generating the global data directory; after verifying the identity of the data provider, the data exchange center merges the data entry newly added by the data provider into the global data directory.

[0013] In step (2), the data acquirer sends a data directory query request to the data exchange center, and for data entries with access rights in the data directory, writes a multi-party computing program describing the data analysis process, and sends it to the data provider to complete the deployment of the computing environment; specifically, the following steps are included: the data acquirer sends a data directory query request containing its identity information to the data exchange center, and after the data exchange center authenticates its identity, it returns the data directory accessible to the data acquirer; for data entries with access rights in the returned data directory, the data acquirer detects whether the data provider holding the data entry has deployed the multi-party computing software environment, and if not, sends the multi-party computing software environment stored locally to the data provider for deployment; the data acquirer writes a multi-party computing program describing the corresponding data analysis process according to its data analysis needs, and sends the program to the data provider to complete the deployment of the computing environment.

[0014] In step (2), the multi-party computation procedure specifically includes:

[0015] Secure multi-party computing is used to support data security analysis between multiple data providers and transmit the data analysis results to the data exchange center deployed at the data acquisition party while protecting the security of the original data;

[0016] The privacy set intersection is used to complete data collision based on data of multiple data providers, and the data collision result is returned to the data acquirer under the premise that the original data of the data provider does not leave the local;

[0017] The security model reasoning is used to make the data acquirer predict the input data by using the model owned by the data provider, and obtain a label.

[0018] In step (three), the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs a cross-domain data sharing process, and stores a data sharing result to a result management area; specifically comprising the following steps: the data acquirer sets the running parameters of the data sharing process, such as the bit number used to represent the data, the underlying multi-party computing protocol used, etc., and synchronizes them to the data provider; the data acquirer and the data provider run a multi-party computing program based on the deployed multi-party computing software environment, complete the data sharing process; after the data sharing process is completed, the data sharing result is restored to the data acquirer, and the data acquirer stores it to the result management area.

[0019] The application also provides a device for realizing cross-domain data sharing based on multi-party computing, specifically comprising:

[0020] A data directory construction module is used to construct a unified data directory for data dispersed in different domains, and set access control permissions and metadata of each data entry in the data directory, wherein the access control permissions of the data entry include data acquirers that can access the data entry, and the metadata of the data entry includes a name of the data, a creation date of the data, a format of the data, a data sample, and a data set source.

[0021] An identity authentication module is used to store and manage identity information, verify the identity of a request data provider and the access permission of the data acquirer to the data;

[0022] A multi-party computing module is used to parse a data sharing request and support multiple data sharing modes, and realize cross-domain data sharing, wherein the data sharing modes include secure multi-party computation, privacy set intersection, and security model reasoning.

[0023] A result management module is used to manage data in a result management area, and provide a series of operations such as uploading, downloading, and deleting.

[0024] The application also provides a non-transitory computer readable storage medium, which stores a computer program or at least one computer executable instruction, and the computer program or at least one computer executable instruction is loaded and executed by a processor to realize the method for acquiring a target feature label according to any one of the above.

[0025] The present invention also provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements any one of the above-mentioned methods for cross-domain data sharing when executing the computer program. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flowchart of the method for implementing cross-domain data sharing based on multi-party computing in the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described below by way of examples with reference to the accompanying drawings. It should be noted that the terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or device.

[0028] Example 1, a method for realizing cross-domain data sharing based on multi-party computing, see Figure 1 As shown. It includes the following steps:

[0029] S1. Build a unified data directory for data scattered in different domains, and set the access control permissions and metadata for each data entry in the data directory, that is, build a list A = {{F11, F12, ...}, {F21, F22, ...}, ..., {Fi1, ..., Fij, ...}, ..., {Fm1, ..., Fmj, ...}}, where Fij is the jth data entry provided by the i-th data provider, i ranges from 1 to m, and m is the number of data providers.

[0030] Data providers are users who provide data for access by data acquirers.

[0031] Data acquirers are users who need to obtain data stored in other domains.

[0032] Each data entry contains access control permission information and metadata information.

[0033] Furthermore, the access control permission information includes the data acquirers who can access the data entry, and the metadata information includes the name of the data, the date of creation of the data, the format of the data, the data sample, the source of the data set, and the like.

[0034] The data items of all data providers can be organized in the form of a file tree.

[0035] In step S1, the following sub-steps are specifically included:

[0036] S11, add / modify data entries in the data directory, and set the access control permissions and metadata of the data entries.

[0037] Step S11 includes the following sub-steps:

[0038] S111, the data provider i adds / updates the local data Fij for data sharing to the file sharing area deployed locally, and constructs a data directory entry containing the access control permissions and metadata of the file.

[0039] S112, the data provider i sends the data directory entry containing the access control permissions and metadata of the file to the data exchange center. The data exchange center is responsible for aggregating the data directory entries of the data providers and forming a complete global data directory.

[0040] S113, after the data exchange center verifies the identity of the data provider, the data provider adds the data entry to the global data directory A={{F11,F12,…},{F21,F22,…},……,{Fi1,…,Fij,…},……,{Fm1,…,Fmj,…}}.

[0041] S12, delete data entries from the data directory, and remove the access control permissions and metadata corresponding to the data entries from the data directory.

[0042] Step S12 specifically includes the following sub-steps:

[0043] S121, the data provider deletes the local data for data sharing from the file sharing area deployed locally.

[0044] S122, the data provider sends a data entry deletion request to the data exchange center.

[0045] S123, after the data exchange center verifies the identity of the data provider, the data exchange center deletes the data entry requested by the data provider from the global data directory.

[0046] S2, the data acquisition party r sends a data directory query request to the data exchange center to view the data entries {F1, F2, …, Fn} that it has access to. The data directory query request contains the ID of the root directory of the data directory and the identity information of the data acquisition party r, so that the data exchange center can verify the identity of the data acquisition party r. Subsequently, the data acquisition party writes a multi-party computing program describing the data analysis process according to its data analysis requirements, and sends it to the data provider to complete the computing environment deployment.

[0047] Step S2 specifically includes the following sub-steps:

[0048] S21, the data acquisition direction data exchange center sends a data directory query request containing its identity information, and the data exchange center returns the data directory accessible by the data acquisition party after authenticating its identity.

[0049] S22, for the data entries in the returned data directory with access rights, the data acquisition party detects whether the data provider holding the data entry has deployed a multi-party computing software environment, and if not, sends the multi-party computing software environment stored locally to the data provider for deployment. The multi-party computing software environment refers to a set of software environments that implement multi-party computing protocols and support multiple participants to collaboratively complete secure data analysis.

[0050] S23, the data acquisition party writes a multi-party computing program describing the corresponding data analysis process according to its data analysis requirements, and sends the program to the data provider to complete the computing environment deployment. Specifically, the multi-party computing program describes the process of calculating the output data based on the input data of multiple participants based on Boolean circuits or arithmetic circuits.

[0051] S3, after the completion of the computing environment deployment, the data acquisition party initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing result in the result management area. Specifically, the supported data sharing methods include secure multi-party computation, private set intersection, and secure model inference.

[0052] Step S3 specifically includes the following sub-steps:

[0053] S31, the data acquisition party sets the running parameters of the data sharing process, such as the number of bits used to represent the data, the underlying multi-party computing protocol used, etc., and synchronizes them to the data provider;

[0054] S32, the data acquisition party and the data provider run the multi-party computing program based on the deployed multi-party computing software environment to complete the data sharing process;

[0055] S33, after the completion of the data sharing process, the data sharing result is restored to the data acquisition party, and the data acquisition party stores it in the result management area.

[0056] S4, after the completion of the cross-domain data sharing request, the returned result Ri of the data sharing request is stored in the local result management area, waiting for the data acquisition party r to access. The result management area refers to a local area that temporarily stores the data sharing result, and provides interfaces for uploading, downloading, deleting, etc.

[0057] S5, the data acquisition party r sends a result access request, acquires a result file storage path, and obtains the data sharing result. The result access request contains a unique identifier of the data sharing result and identity information of the data acquisition party r, and the result file storage path refers to a file path in which the data acquisition party r locally stores the data sharing result.

[0058] By the above steps, a unified data directory is constructed for data dispersed in different domains, and access control permissions and metadata of each data entry in the data directory are set. According to the permission information in the data directory, accessible data entries and usable data sharing modes are selected, including multi-party computation, private set intersection, and secure model reasoning, and cross-domain data transmission is completed. Therefore, the method and device for cross-domain data sharing based on multi-party computation can enable the data acquisition party to safely acquire or analyze data held by the data providing party, obtain valuable information, and improve the efficiency and convenience of cross-domain data sharing.

[0059] Embodiment 2 is a device for realizing cross-domain data sharing based on multi-party computation, comprising a data directory construction module, an identity authentication module, a multi-party computation module, and a result management module.

[0060] (1) The data directory construction module is configured to construct a unified data directory for data dispersed in different domains, and set access control permissions and metadata of each data entry in the data directory, that is, to construct a list A = {{F11, F12, …}, {F21, F22, …}, …, {Fi1, …, Fij, …}, …, {Fm1, …, Fmj, …}}, where Fij is the jth data entry provided by the ith data providing party, i takes a value from 1 to m, and m is the number of data providing parties.

[0061] Specifically, the data providing party is a user who provides data for the data acquisition party.

[0062] Specifically, each data entry contains access control permission information and metadata information.

[0063] Further, the access control permission information includes data acquisition parties that can access the data entry and data sharing modes that can be used, and the metadata information includes the name of the data, the creation date of the data, the format of the data, the data sample, and the data set source.

[0064] Specifically, the data entries of each data providing party can be organized in the form of a file tree.

[0065] (2) The identity authentication module is configured to store and manage identity information, verify the identity of the requesting data providing party and the access permission of the data acquisition party to the data.

[0066] (3) the multi-party computing module is used for analyzing a data sharing request initiated by a data obtaining party and supporting cross-domain data sharing using multiple data sharing modes; wherein, the cross-domain data sharing request contains ID information of a data entry Fi, identity information of the data obtaining party r, a data sharing mode used for realizing cross-domain data sharing and corresponding operation parameters, and the data sharing mode includes secure multi-party computation, private set intersection, and secure model inference.

[0067] Specifically, the secure multi-party computation unit, the private set intersection unit, and the secure model inference unit are included.

[0068] The secure multi-party computation unit is used for supporting data security analysis among multiple data providing parties and transmitting data analysis results to a data exchange center deployed at the data obtaining party under the premise of protecting original data security.

[0069] The private set intersection unit is used for completing data collision function based on data of multiple data providing parties and returning data collision results to the data obtaining party under the premise of ensuring that original data of the data providing party does not leave the local.

[0070] The secure model inference unit is used for enabling the data obtaining party to use a model owned by the data providing party to predict input data and obtain a label under the premise of not leaking the input data of the data obtaining party.

[0071] (4) the result management module is used for managing data in a result management area and providing a series of operations such as uploading, downloading, and deleting a shared result. Wherein, a result access request contains a unique identifier of a data sharing result and identity information of the data obtaining party, and a result file storage path refers to a file path for storing the data sharing result locally by the data obtaining party.

[0072] The above modules construct a unified data directory for data distributed in different domains and set access control permissions and metadata of each data entry in the data directory, select accessible data entries and usable data sharing modes including secure multi-party computation, private set intersection, and secure model inference according to permission information in the data directory, and complete cross-domain data transmission. Therefore, the method and device for cross-domain data sharing based on multi-party computation can enable the data obtaining party to safely obtain or analyze data held by the data providing party and obtain valuable information, which is beneficial to improving efficiency and convenience of cross-domain data sharing.

[0073] The embodiment of the present application also provides a non-transitory computer readable storage medium which can be arranged in an electronic device to save a computer program or at least one computer executable instruction related to a method in the method embodiment, the computer program or the at least one computer executable instruction is loaded and executed by the processor to realize the method provided by the above-mentioned embodiment.

[0074] The embodiment of the present application further provides an electronic device, comprising a processor, a memory and a computer program stored in the memory and executable on the processor, and the processor implements the method provided by the above-mentioned embodiment when executing the computer program.

[0075] The embodiment of the present application further provides a computer program product comprising program code for causing an electronic device to perform the steps of the method according to the various exemplary embodiments of the present application described in the specification when the program product is run on the electronic device.

[0076] The method for cross-domain data sharing provided by the embodiment can construct a unified data directory for data dispersed in different domains, set access control permissions and metadata of each data entry in the data directory, select accessible data entries and usable data sharing modes according to the permission information in the data directory, including secure multi-party computing, private set intersection, secure model reasoning, and complete cross-domain data transmission. The method can enable data acquisition parties to safely acquire or analyze data held by data providers, obtain valuable information, and improve the efficiency and convenience of cross-domain data sharing.

[0077] Those skilled in the art should understand that the present application is not limited to the above-mentioned embodiments. Various changes and improvements can be made to the present application without departing from the spirit and scope of the present application, and these changes and improvements all fall within the scope of the present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for cross-domain data sharing based on multi-party computing, involving the following three parties: a data exchange center, a data acquirer, and a data provider, characterized in that: The specific steps are: (1) The data exchange center builds a unified data directory for data dispersed across different domains, and adds or modifies data entries in the data directory; it sets access control permissions and metadata for each data entry in the data directory; wherein the access control permissions for the data entry specify the data acquirers who can access the data entry, and the metadata for the data entry includes the name of the data, the date the data was created, the format of the data, the data sample, and the source of the data set; (2) The data acquirer sends a data catalog query request to the data exchange center, writes a multi-party computing program describing the data analysis process for the data entries with access rights in the data catalog, and sends it to the data provider to complete the deployment of the computing environment; (3) After the computing environment is deployed, the data acquirer initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area; the data acquirer queries the data sharing results in the result management area and obtains the result file storage path.

2. The method for realizing cross-domain data sharing based on multi-party computing according to claim 1, characterized in that: The steps of adding or modifying data entries to the data directory and setting access control permissions and metadata for the data entries as described in step (1) specifically include the following steps: the data provider adds or updates local data for data sharing to a locally deployed file sharing area, and constructs a data directory entry containing the access control permissions and metadata for the local data; the data provider sends the data directory entry containing the access control permissions and metadata for the local data to a data exchange center responsible for generating a global data directory; the data exchange center merges the data entry newly added by the data provider into the global data directory after verifying the identity of the data provider.

3. The method for realizing cross-domain data sharing based on multi-party computing according to claim 2 is characterized in that: Step (2) specifically includes the following steps: the data acquirer sends a data directory query request containing its identity information to the data exchange center; the data exchange center authenticates its identity and returns a data directory accessible to the data acquirer; for data entries in the returned data directory with access rights, the data acquirer checks whether the data provider holding the data entry has deployed a multi-party computing software environment; if not, the data acquirer sends the multi-party computing software environment stored locally to the data provider for deployment; The data acquirer writes a multi-party computing program that describes the corresponding data analysis process based on data analysis requirements, and sends the program to the data provider to complete the computing environment deployment.

4. The method for realizing cross-domain data sharing based on multi-party computing according to claim 3 is characterized in that: The multi-party computation procedure described in step (2) specifically includes: Secure multi-party computing is used to support data security analysis between multiple data providers and transmit the data analysis results to the data exchange center deployed at the data acquisition party while protecting the security of the original data; Privacy set intersection, which completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer while ensuring that the original data of the data provider does not leave the local area; Secure model inference enables data acquirers to use the model owned by the data provider to predict their input data and obtain labels.

5. The method for realizing cross-domain data sharing based on multi-party computing according to claim 4 is characterized in that: The data acquirer in step (3) initiates a cross-domain data sharing request to the data provider, jointly runs the cross-domain data sharing process, and stores the data sharing results in the result management area. Specifically, the data acquirer sets the operating parameters of the data sharing process, including the number of bits used to represent the data and the underlying multi-party computing protocol used, and synchronizes them to the data provider; The data acquirer and data provider run the multi-party computing program based on the deployed multi-party computing software environment to complete the data sharing process; After the data sharing process is completed, the data sharing results will be restored to the data acquirer, and the data acquirer will store them in the result management area.

6. A device for implementing cross-domain data sharing based on multi-party computing to implement the method of claim 5, characterized in that: Specifically include: A data directory construction module is used to build a unified data directory for data scattered across different domains and set access control permissions and metadata for each data entry in the data directory. The access control permissions for a data entry include the data acquirers who can access the data entry, and the metadata for a data entry includes the data name, data creation date, data format, data sample, and data set source. The identity authentication module is used to store and manage identity information, verify the identity of the data provider and the data access rights of the data acquirer; The multi-party computing module is used to resolve data sharing requests and support multiple data sharing methods to achieve cross-domain data sharing; specifically, it includes: Secure multi-party computing unit, used to support data security analysis between multiple data providers and transmit the data analysis results to the data exchange center deployed at the data acquisition party under the premise of protecting the security of the original data; The privacy set intersection unit completes the data collision function based on the data of multiple data providers, and returns the data collision result to the data acquirer while ensuring that the original data of the data provider does not leave the local area; The secure model inference unit is used to enable the data acquirer to use the model owned by the data provider to predict its input data and obtain a label; The result management module is used to manage the data in the result management area and provide upload, download, and delete operations.

Images