Data use security control system based on privacy computing technology

Abstract

The embodiment of the invention discloses a data use security control system based on a privacy computing technology, which belongs to the technical field of power grid data security, and comprises a resource management module for carrying out data preprocessing, data processing and feature processing on accessed original data, and an engine management module for providing a federated learning engine and a multi-party security computing engine, the service management module provides visual and interactive service capability for various application scenes according to privacy computing capability based on a multi-party security computing engine, and the platform management module controls and manages nodes, users, permissions, billing, audit reports and operation monitoring of the system. The protocol management module enables the system block chain with the privacy computing technology capability to be in butt joint with other block chain architectures, and according to the embodiment of the invention, detail data out-of-domain can be completely eradicated through fine-grained control of data, the data security control pressure is reduced, and data leakage or abuse beyond the expiration does not exist.

Description

Technical Field

[0001] The present application belongs to the field of power grid data security technology, and specifically, to a data usage security control system based on privacy computing technology. Background Art

[0002] With the digital transformation of energy and power, and the rapid development of power data services, the original static inherent application mode of data has been broken. It has become a consensus that multi-scenario and multi-subject data can collaboratively enhance the value of data applications. Data flows more frequently across systems, boundaries, and organizations. The security leakage risks and legal compliance risks faced by data have also increased significantly. How to use data safely and how to promote the safe collaborative business of power grid data and multi-party data have always been a difficult problem for power grid companies.

[0003] Currently, privacy computing technology is unable to meet the data modeling needs of power systems, is unable to improve the security of federated learning through multi-party secure computing technology, and cannot provide effective protection for data and model parameters during model training. Summary of the invention

[0004] In order to solve the above problems and technical defects, the embodiment of the present application adopts the following technical solution, a data usage security control system based on privacy computing technology, including:

[0005] Resource management module, used to perform data preprocessing, data processing and feature processing on the raw data, so that the data can support the input of multiple heterogeneous databases, data files and standard interfaces, and provide a data routing mechanism with multiple scheduling strategies and configuration combinations;

[0006] The engine management module is used to provide a federated learning engine and a multi-party secure computing engine to implement basic operations, set operations, polynomial operations, and complex operations, and automatically adapt the optimal protocol solution according to the business application scenario and the positioning of the participants;

[0007] The service management module is used to provide visualized and interactive service capabilities for business application scenarios based on the privacy computing capabilities of the multi-party secure computing engine, and to achieve data privacy protection and secure application of external data in multi-party data fusion application scenarios;

[0008] The platform management module is used to control and manage the system's nodes, users, permissions, billing, audit reports, and operation monitoring, and to achieve overall management and monitoring of the multi-party joint operation of privacy computing tasks;

[0009] The protocol management module is used to connect the system blockchain with privacy computing technology capabilities with other blockchain architectures, and complete computing evidence, process proof, value calculation and resource rights confirmation based on smart contracts.

[0010] Preferably, the establishment process of the federated learning engine is as follows:

[0011] Step 1: Obtain sample data, perform exploratory analysis on the sample data, and obtain the basic distribution of the sample data;

[0012] Step 2: Preprocess the sample data. Preprocessing is to align and uniformly convert the acquired sample data into model development data;

[0013] Step 3: feature screening of the model development data;

[0014] Step 4: Model the screened model development data based on the logistic regression model to build a preliminary model;

[0015] Step 5: Evaluate the preliminary model. Based on the evaluation results, expand the sample data obtained in step 1. Repeat steps 1, 2, 3, 4, and 5 based on the expanded data. Repeat multiple times until the evaluation results meet the requirements and the optimal model is obtained.

[0016] Step 6: deploy the optimal model as a federated learning engine, monitor the deployed federated learning engine, generate a monitoring report, and regularly expand the sample data obtained in step 1 according to the detection report.

[0017] Furthermore, the exploratory analysis includes: variable type identification, variable missing rate analysis, basic statistical distribution analysis of continuous variables and category distribution analysis of categorical variables.

[0018] Furthermore, the data preprocessing includes: missing value processing, outlier processing, feature encoding, and feature scaling;

[0019] Missing value processing is to use XGBoost algorithm to fill in missing values;

[0020] Outlier processing is to identify and fill out outliers in sample data using the upper and lower quartile difference method;

[0021] Feature coding is to convert the non-numeric variable feature coding in the sample data into numeric type using one-ho coding method;

[0022] Feature scaling is to first standardize the target variable in the sample data so that the target variable obeys the standard normal distribution, and then perform normalization to scale the value range of the target variable to between 0 and 1.

[0023] Furthermore, the feature screening is to use a machine learning model to score the preprocessed model development data, treating variables with scores lower than a preset value as ineffective variables, and variables with scores greater than or equal to a preset value as important variables to be retained, eliminating ineffective variables and retaining important variables.

[0024] Furthermore, the construction of the preliminary model is to first bin the screened features, then perform evidence weight transformation according to categories to obtain discrete variables, then encode the discrete variables to obtain continuous variables, perform variable selection on the continuous variables, then screen the selection according to the coefficient signs of each variable, assign each screened variable to a corresponding variable bin, and construct a preliminary model based on the variables in each variable bin.

[0025] Further, the model evaluation includes horizontal federation evaluation and vertical federation evaluation;

[0026] The horizontal federation evaluation is to evaluate the training of the preliminary model by horizontally combining multiple different scenario training models to obtain multiple sample expansion evaluation results, and expand the data obtained in step 1 according to the sample expansion evaluation results;

[0027] Vertical federated evaluation is to vertically combine multiple different data features to build a model to train and evaluate the preliminary model, obtain multiple evaluation feature dimensions, and expand the data obtained in step 1 according to the evaluation feature dimensions.

[0028] Preferably, the multi-party secure computing engine includes:

[0029] The privacy communication module is used to support query task creation, support associated data asset configuration, support internal and external query logs, and implement hidden set intersection when internal assets and external data assets are associated;

[0030] Multi-party secure computing module, which is used to support basic operations, logical operations, polynomial operations and set operations based on the underlying secret sharing homomorphic encryption, oblivious transmission and obfuscated circuit protocols, and can flexibly call encapsulated operators to implement custom operations;

[0031] The joint computing module is used to configure joint statistical tasks in a visual way and complete multi-party joint statistical computing functions, generate visualization task execution reports, support the operations of intersection, difference, union and complement of privacy sets, configure the screening conditions for intersection of privacy sets in a visual way, and perform multi-party privacy protection set operations;

[0032] The privacy anonymity module is used to provide a variety of standard anonymous private query implementation methods to implement standard anonymous private queries, and can also perform multi-party anonymous private queries with computing conditions.

[0033] Furthermore, the privacy communication module builds a data interaction encrypted communication channel through RSA asymmetric encryption during data query interaction, and performs data obfuscation, data encryption, data transmission, data decryption and matching during the data query interaction process, so that the service party cannot know other information of the query party except the query information, and the query party cannot know other information of the service party except the query information provided.

[0034] Furthermore, the privacy anonymization module performs obfuscation, encryption, interaction, decryption and matching during the query process, so that the service provider cannot obtain the privacy information of the query party in the query conditions, and the query party cannot obtain the remaining information of the service provider except the matching content.

[0035] Compared with the prior art, the beneficial effects of the embodiments of the present application are:

[0036] This application can protect the data privacy and security of all parties through the privacy computing platform, avoid the reduction of data product value or loss of data assets due to the leakage of original data or illegal caching and resale of data, as well as security risks such as leakage of core data. It will have management functions such as data management and model management. The original data and data models are authorized by project to ensure data and model specificity, eliminating data abuse at the source. At the same time, based on the privacy computing platform, it provides a way to make the original data invisible but the data available and convertible. After the data partner strictly defines the corresponding algorithms and data sources, the data calling process is completely transparent to the data partner. The fine-grained control of the data prevents detailed data from leaving the domain, reduces the pressure of data security management, and there is no data leakage or abuse beyond the expiration date, allowing data partners to cooperate with peace of mind. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In the attached picture:

[0038] Figure 1 Schematic diagram of the system structure of an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Generally, the components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0040] Example

[0041] like Figure 1 As shown, the data usage security control system based on privacy computing technology includes:

[0042] Resource management module, used to perform data preprocessing, data processing and feature processing on the raw data, so that the data can support the input of multiple heterogeneous databases, data files and standard interfaces, and provide a data routing mechanism with multiple scheduling strategies and configuration combinations;

[0043] The engine management module is used to provide a federated learning engine and a multi-party secure computing engine to implement basic operations, set operations, polynomial operations, and complex operations, and automatically adapt the optimal protocol solution according to the business application scenario and the positioning of the participants;

[0044] The service management module is used to provide visualized and interactive service capabilities for business application scenarios based on the privacy computing capabilities of the multi-party secure computing engine, and to achieve data privacy protection and secure application of external data in multi-party data fusion application scenarios;

[0045] The platform management module is used to control and manage the system's nodes, users, permissions, billing, audit reports, and operation monitoring, and to achieve overall management and monitoring of the multi-party joint operation of privacy computing tasks;

[0046] The protocol management module is used to connect the system blockchain with privacy computing technology capabilities with other blockchain architectures, and complete computing evidence, process proof, value calculation and resource rights confirmation based on smart contracts.

[0047] The model training process usually includes seven steps: data alignment, sending the initial model, local self-training, encrypted result upload, fusion calculation, model update, and new model sending.

[0048] In addition to data alignment, other steps are iterated in a loop to form the final model. The system will realize the ability to visualize modeling of the entire process including data configuration, sample alignment, feature engineering, model training, and model evaluation, and the training process can be completed without writing code. It provides a friendly operation interface, interactive exploration analysis, and efficient operator performance, which not only lowers the threshold for data analysts and business personnel to use, allowing them to quickly get started, but also improves the modeling efficiency of senior experts and shortens the cycle of model tuning.

[0049] The process of establishing a federated learning engine is as follows:

[0050] Step 1: Obtain sample data, perform exploratory analysis on the sample data, and obtain the basic distribution of the sample data;

[0051] Exploratory analysis includes: variable type identification, variable missing rate analysis, basic statistical distribution analysis of continuous variables, and category distribution analysis of categorical variables.

[0052] Step 2: Preprocess the sample data. Preprocessing is to align and uniformly convert the acquired sample data into model development data;

[0053] Data preprocessing includes: missing value processing, outlier processing, feature encoding, and feature scaling;

[0054] Missing value processing is to use XGBoost algorithm to fill in missing values;

[0055] Outlier processing is to identify and fill out outliers in sample data using the upper and lower quartile difference method;

[0056] Feature coding is to convert the non-numeric variable feature coding in the sample data into numeric type using one-ho coding method;

[0057] Feature scaling is to first standardize the target variable in the sample data so that the target variable obeys the standard normal distribution, and then perform normalization to scale the value range of the target variable to between 0 and 1.

[0058] Step 3: feature screening of the model development data;

[0059] Feature screening is the process of using a machine learning model to score the preprocessed model development data, treating variables with scores below the preset values ​​as ineffective variables, and variables with scores greater than or equal to the preset values ​​as important variables to be retained. Ineffective variables are eliminated, and important variables are retained.

[0060] Step 4: Model the screened model development data based on the logistic regression model to build a preliminary model;

[0061] To construct a preliminary model, we first bin the selected features, then perform evidence weight transformation according to categories to obtain discrete variables, then encode the discrete variables to obtain continuous variables, perform variable selection on the continuous variables, and then screen the selection according to the coefficient signs of each variable, assign each screened variable to the corresponding variable bin, and construct a preliminary model based on the variables in each variable bin.

[0062] Step 5: Evaluate the preliminary model. Based on the evaluation results, expand the sample data obtained in step 1. Repeat steps 1, 2, 3, 4, and 5 based on the expanded data. Repeat multiple times until the evaluation results meet the requirements and the optimal model is obtained.

[0063] Model evaluation includes horizontal federation evaluation and vertical federation evaluation;

[0064] The horizontal federation evaluation is to evaluate the training of the preliminary model by horizontally combining multiple different scenario training models to obtain multiple sample expansion evaluation results, and expand the data obtained in step 1 according to the sample expansion evaluation results;

[0065] Vertical federated evaluation is to vertically combine multiple different data features to build a model to train and evaluate the preliminary model, obtain multiple evaluation feature dimensions, and expand the data obtained in step 1 according to the evaluation feature dimensions.

[0066] Step 6: deploy the optimal model as a federated learning engine, monitor the deployed federated learning engine, generate a monitoring report, and regularly expand the sample data obtained in step 1 according to the detection report.

[0067] The multi-party secure computing engine includes:

[0068] The privacy communication module is used to support query task creation, support associated data asset configuration, support internal and external query logs, and implement hidden set intersection when internal assets and external data assets are associated;

[0069] The privacy communication module builds a data interaction encrypted communication channel through RSA asymmetric encryption during data query interaction, and performs data obfuscation, data encryption, data transmission, data decryption and matching during the data query interaction process, so that the service party cannot know other information of the query party except the query information, and the query party cannot know other information of the service party except the query information provided.

[0070] Multi-party secure computing module, which is used to support basic operations, logical operations, polynomial operations and set operations based on the underlying secret sharing homomorphic encryption, oblivious transmission and obfuscated circuit protocols, and can flexibly call encapsulated operators to implement custom operations;

[0071] The joint computing module is used to configure joint statistical tasks in a visual way and complete multi-party joint statistical computing functions, generate visualization task execution reports, support the operations of intersection, difference, union and complement of privacy sets, configure the screening conditions for intersection of privacy sets in a visual way, and perform multi-party privacy protection set operations;

[0072] The privacy anonymity module is used to provide a variety of standard anonymous private query implementation methods to implement standard anonymous private queries, and can also perform multi-party anonymous private queries with computing conditions.

[0073] The privacy anonymization module performs obfuscation, encryption, interaction, decryption and matching during the query process, so that the service provider cannot obtain the privacy information of the query party in the query conditions, and the query party cannot obtain other information of the service party except the matching content.

[0074] The above-mentioned embodiments only express the preferred implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for ordinary technicians in this field, several modifications, improvements and substitutions can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A data usage security control system based on privacy computing technology, characterized in that: include: Resource management module, used to perform data preprocessing, data processing and feature processing on the raw data, so that the data can support the input of multiple heterogeneous databases, data files and standard interfaces, and provide a data routing mechanism with multiple scheduling strategies and configuration combinations; The engine management module is used to provide a federated learning engine and a multi-party secure computing engine to implement basic operations, set operations, polynomial operations, and complex operations, and automatically adapt the optimal protocol solution according to the business application scenario and the positioning of the participants; The service management module is used to provide visualized and interactive service capabilities for business application scenarios based on the privacy computing capabilities of the multi-party secure computing engine, and to achieve data privacy protection and secure application of external data in multi-party data fusion application scenarios; The platform management module is used to control and manage the system's nodes, users, permissions, billing, audit reports, and operation monitoring, and to achieve overall management and monitoring of the multi-party joint operation of privacy computing tasks; The protocol management module is used to connect the system blockchain with privacy computing technology capabilities with other blockchain architectures, and complete computing evidence, process proof, value calculation and resource rights confirmation based on smart contracts.

2. The data usage security control system based on privacy computing technology according to claim 1 is characterized in that: The establishment process of the federated learning engine is as follows: Step 1: Obtain sample data, perform exploratory analysis on the sample data, and obtain the basic distribution of the sample data; Step 2: Preprocess the sample data. Preprocessing is to align and uniformly convert the acquired sample data into model development data; Step 3: feature screening of the model development data; Step 4: Model the screened model development data based on the logistic regression model to build a preliminary model; Step 5: Evaluate the preliminary model. Based on the evaluation results, expand the sample data obtained in step 1. Repeat steps 1, 2, 3, 4, and 5 based on the expanded data. Repeat multiple times until the evaluation results meet the requirements and the optimal model is obtained. Step 6: deploy the optimal model as a federated learning engine, monitor the deployed federated learning engine, generate a monitoring report, and regularly expand the sample data obtained in step 1 according to the detection report.

3. The data usage security control system based on privacy computing technology according to claim 2 is characterized in that: The exploratory analysis includes: variable type identification, variable missing rate analysis, basic statistical distribution analysis of continuous variables and category distribution analysis of categorical variables.

4. The data usage security control system based on privacy computing technology according to claim 2 is characterized in that: The data preprocessing includes: missing value processing, outlier processing, feature encoding, and feature scaling; Missing value processing is to use XGBoost algorithm to fill in missing values; Outlier processing is to identify and fill out outliers in sample data using the upper and lower quartile difference method; Feature coding is to convert the non-numeric variable feature coding in the sample data into numeric type using one-ho coding method; Feature scaling is to first standardize the target variable in the sample data so that the target variable obeys the standard normal distribution, and then perform normalization to scale the value range of the target variable to between 0 and 1.

5. The data usage security control system based on privacy computing technology according to claim 2 is characterized in that: The feature screening is to use a machine learning model to score the preprocessed model development data, treat variables below a preset score as ineffective variables, and variables greater than or equal to a preset score as important variables to be retained, eliminate ineffective variables, and retain important variables.

6. The data usage security control system based on privacy computing technology according to claim 2 is characterized in that: The construction of the preliminary model is to first bin the screened features, then transform the evidence weights according to the categories to obtain discrete variables, then encode the discrete variables to obtain continuous variables, perform variable selection on the continuous variables, and then screen the selection according to the coefficient signs of each variable, assign each screened variable to a corresponding variable bin, and construct a preliminary model based on the variables in each variable bin.

7. The data usage security control system based on privacy computing technology according to claim 2 is characterized in that: The model evaluation includes horizontal federation evaluation and vertical federation evaluation; The horizontal federation evaluation is to evaluate the training of the preliminary model by horizontally combining multiple different scenario training models to obtain multiple sample expansion evaluation results, and expand the data obtained in step 1 according to the sample expansion evaluation results; Vertical federated evaluation is to vertically combine multiple different data features to build a model to train and evaluate the preliminary model, obtain multiple evaluation feature dimensions, and expand the data obtained in step 1 according to the evaluation feature dimensions.

8. The data usage security control system based on privacy computing technology according to claim 1, characterized in that: The multi-party secure computing engine includes: The privacy communication module is used to support query task creation, support associated data asset configuration, support internal and external query logs, and implement hidden set intersection when internal assets and external data assets are associated; Multi-party secure computing module, which is used to support basic operations, logical operations, polynomial operations and set operations based on the underlying secret sharing homomorphic encryption, oblivious transmission and obfuscated circuit protocols, and can flexibly call encapsulated operators to implement custom operations; The joint computing module is used to configure joint statistical tasks and complete multi-party joint statistical calculations in a visual way, generate a visual task execution report, support the operations of intersection, difference, union and complement of privacy sets, configure the screening conditions for intersection of privacy sets in a visual way, and perform multi-party privacy protection set operations; The privacy anonymity module is used to provide a variety of standard anonymous private query implementation methods to implement standard anonymous private queries, and can also perform multi-party anonymous private queries with computing conditions.

9. The data usage security control system based on privacy computing technology according to claim 7, characterized in that: The privacy communication module builds a data interaction encrypted communication channel through RSA asymmetric encryption during data query interaction, and performs data obfuscation, data encryption, data transmission, data decryption and matching during the data query interaction process, so that the service party cannot know other information of the query party except the query information, and the query party cannot know other information of the service party except the query information provided.

10. The data usage security control system based on privacy computing technology according to claim 7, characterized in that: The privacy anonymity module performs obfuscation, encryption, interaction, decryption and matching during the query process, so that the service provider cannot obtain the privacy information of the query party in the query conditions, and the query party cannot obtain the rest of the information of the service provider except the matching content.

Images