Privacy computing system, method, device, equipment and medium

Abstract

The invention discloses a private computing system, method, device and equipment and a medium, which are used for flexibly and safely authenticating private computing equipment. In the application, a first private computing device sends an approval request of a target resource level to a second private computing device, wherein the approval request carries a first authorization token generated after information verification of each resource level before the target resource level is passed; if the second privacy computing device passes the verification of the first authorization token, generating a second authorization token corresponding to the target resource level, and sending the second authorization token to the first privacy computing device; in the embodiment of the invention, the first private computing device sends the task execution request carrying the second authorization token to the second private computing device, and the second private computing device authenticates the first private computing device based on the second authorization token, so that the private computing devices can be authenticated flexibly and safely.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a privacy computing system, method, apparatus, device and medium. Background Art

[0002] Privacy computing (Privacy compute or Privacy computing) refers to a collection of technologies that implement data analysis and computing while protecting the data itself from external leakage, so as to achieve the goal of "available but invisible" data, and realize the transformation and release of data value while fully protecting data and privacy security.

[0003] With the increasing awareness of data protection in the industry and the tightening of privacy regulatory policies, privacy computing has attracted widespread attention in the industry due to its "available, invisible" characteristics. Many technology vendors have launched their own privacy computing products with industry characteristics. While the numerous privacy computing products have enriched the market choices, they have also brought new challenges. For example, the privacy computing products launched by different technology vendors are usually designed and implemented based on different system platforms. When the privacy computing products of different system platforms are stored in different privacy computing devices, the privacy computing products of different system platforms are usually unable to complete information interaction, turning the "data island" into a "computing island."

[0004] Therefore, the interoperability between privacy algorithm products stored in different privacy computing devices has become an absolute pain point in the industry. Among them, how to authenticate different privacy computing devices to ensure the security of privacy algorithm products in different privacy computing devices when they are interconnected is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a privacy computing system, method, apparatus, device and medium for flexibly and securely authenticating privacy computing devices.

[0006] In a first aspect, the present application provides a privacy computing system, the system comprising:

[0007] A first privacy computing device is configured to send an approval request for a target resource level of any service to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the service level that are located before the target resource level;

[0008] The second privacy computing device is used to receive the approval request, and if the first authorization token is verified, generate a second authorization token corresponding to the target resource level of the business, and send the second authorization token to the first privacy computing device;

[0009] The first privacy computing device is further configured to receive and save the second authorization token, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request;

[0010] The second privacy computing device is used to receive the task execution request, and if the first privacy computing device is authenticated based on the second authorization token, execute the corresponding privacy computing task.

[0011] In a possible implementation manner, the second privacy computing device is specifically used to:

[0012] If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

[0013] In a possible implementation manner, the failure condition includes at least one of the following:

[0014] The first authorization token exceeds the valid usage period;

[0015] The number of times the first authorization token is used reaches a set number threshold;

[0016] Receiving an authorization cancellation instruction for the upper resource level of the service;

[0017] An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

[0018] In a possible implementation manner, the second privacy computing device is specifically used to:

[0019] For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

[0020] In a possible implementation, if the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the second privacy computing device is specifically used to:

[0021] When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies the preset expiration condition; or,

[0022] Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or

[0023] When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

[0024] In a possible implementation manner, the second privacy computing device is specifically used to:

[0025] Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

[0026] In a possible implementation manner, the second privacy computing device is specifically used to:

[0027] Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device;

[0028] Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold;

[0029] If so, determining that the approval request is valid;

[0030] If not, it is determined that the approval request is invalid.

[0031] In a second aspect, the present application provides a privacy-preserving computing method, which is applied to a second privacy-preserving computing device, and includes:

[0032] Receiving an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level;

[0033] If the first authorization token is verified, a second authorization token corresponding to the target resource level of the business is generated, and the second authorization token is sent to the first privacy computing device;

[0034] Receive a task execution request sent by a first privacy computing device, wherein the task execution request carries the second authorization token;

[0035] If the first privacy computing device is authenticated based on the second authorization token, the corresponding privacy computing task is executed.

[0036] In a possible implementation manner, the verifying the first authorization token successfully includes:

[0037] If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

[0038] In a possible implementation manner, the failure condition includes at least one of the following:

[0039] The first authorization token exceeds the valid usage period;

[0040] The number of times the first authorization token is used reaches a set number threshold;

[0041] Receiving an authorization cancellation instruction for the upper resource level of the service;

[0042] An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

[0043] In a possible implementation manner, receiving an authorization cancellation instruction for any resource level includes:

[0044] For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

[0045] In a possible implementation, if the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the determining whether the first authorization token satisfies a preset expiration condition includes:

[0046] When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies the preset expiration condition; or,

[0047] Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or

[0048] When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

[0049] In a possible implementation, after receiving the approval request for the target resource level of any business sent by the first privacy computing device and before generating the second authorization token corresponding to the target resource level of the business, the method further includes:

[0050] Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

[0051] In a possible implementation manner, verifying whether the approval request is valid includes:

[0052] Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device;

[0053] Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold;

[0054] If so, determining that the approval request is valid;

[0055] If not, it is determined that the approval request is invalid.

[0056] In a third aspect, the present application provides a privacy-preserving computing method, which is applied to a first privacy-preserving computing device, and includes:

[0057] Sending an approval request for a target resource level of any business to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level;

[0058] Receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

[0059] In a fourth aspect, the present application provides a privacy-preserving computing apparatus, which is applied to a second privacy-preserving computing device, and includes:

[0060] An approval module is configured to receive an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level;

[0061] An authorization module, configured to generate a second authorization token corresponding to a target resource level of the service if the first authorization token is verified, and send the second authorization token to the first privacy computing device;

[0062] An execution module, configured to receive a task execution request sent by a first privacy computing device, wherein the task execution request carries the second authorization token;

[0063] An authentication module is used to execute a corresponding privacy computing task if the first privacy computing device is authenticated based on the second authorization token.

[0064] In a possible implementation manner, the authorization module is specifically used to:

[0065] If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

[0066] In a possible implementation manner, the failure condition includes at least one of the following:

[0067] The first authorization token exceeds the valid usage period;

[0068] The number of times the first authorization token is used reaches a set number threshold;

[0069] Receiving an authorization cancellation instruction for the upper resource level of the service;

[0070] An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

[0071] In a possible implementation, if the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the authorization module is specifically used to:

[0072] When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies the preset expiration condition; or,

[0073] Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or

[0074] When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

[0075] In a possible implementation manner, the authorization module is specifically used to:

[0076] For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

[0077] In a possible implementation manner, the authorization module is further used to:

[0078] Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

[0079] In a possible implementation manner, the authorization module is specifically used to:

[0080] Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device;

[0081] Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold;

[0082] If so, determining that the approval request is valid;

[0083] If not, it is determined that the approval request is invalid.

[0084] In a fifth aspect, the present application provides a privacy-preserving computing apparatus, which is applied to a first privacy-preserving computing device, and includes:

[0085] A first sending module is used to send an approval request for a target resource level of any service to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying the information of each resource level of the service level before the target resource level;

[0086] The second sending module is used to receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

[0087] In the sixth aspect, the present application provides an electronic device comprising a processor and a memory, wherein the memory stores a program code, and when the program code is executed by the processor, the processor executes the steps of the privacy computing method described in any one of the second aspect, or executes the steps of the privacy computing method described in the third aspect.

[0088] In the seventh aspect, the present application provides a computer-readable storage medium comprising a program code. When the storage medium is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the privacy computing method described in any one of the second aspect, or to execute the steps of the privacy computing method described in the third aspect.

[0089] In the eighth aspect, the present application provides a computer program product, which includes: a computer program code, which, when executed on a computer, enables the computer to execute the steps of the privacy computing method described in any one of the second aspect, or to execute the steps of the privacy computing method described in the third aspect.

[0090] In an embodiment of the present application, the first privacy computing device can send an approval request for a target resource level of any business to the second privacy computing device. The approval request can carry a first authorization token generated by the second privacy computing device after verifying the information of each resource level before the target resource level; after receiving the approval request, the second privacy computing device can verify the first authorization token. If the verification passes, it can generate a second authorization token corresponding to the target resource level and send the second authorization token to the first privacy computing device; when the first privacy computing device sends a task execution request to the second privacy computing device, it can carry the second authorization token in the task execution request. The second privacy computing device can authenticate the first privacy computing device based on the second authorization token. If the authentication passes, it can execute the corresponding privacy computing task. Based on this, it is possible to flexibly and securely authenticate the privacy computing device and ensure the security of the privacy algorithm products in different privacy computing devices when they are interconnected. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] In order to more clearly illustrate the implementation methods in the embodiments of the present application or the related technologies, the following is a brief introduction to the drawings required for use in the embodiments or the related technology descriptions. Obviously, the drawings described below are some embodiments of the present application, and a person skilled in the art can also obtain other drawings based on these drawings.

[0092] Figure 1 A schematic diagram of a privacy computing system provided by some embodiments is shown;

[0093] Figure 2 A schematic diagram of a first privacy computing process provided by some embodiments is shown;

[0094] Figure 3 A schematic diagram of a second privacy computing process provided by some embodiments is shown;

[0095] Figure 4A A schematic diagram of an authorization token provided by some embodiments is shown;

[0096] Figure 4B A schematic diagram of storage information of an authorization token provided by some embodiments is shown;

[0097] Figure 5 A schematic diagram of a third privacy computing process provided by some embodiments is shown;

[0098] Figure 6 A fourth privacy computing process schematic diagram provided by some embodiments is shown;

[0099] Figure 7 A schematic diagram of a privacy computing device provided by some embodiments is shown;

[0100] Figure 8 A schematic diagram of another privacy computing device provided by some embodiments is shown;

[0101] Fig. 9 A schematic diagram of the structure of an electronic device provided by some embodiments is shown. DETAILED DESCRIPTION

[0102] In order to ensure the security of interconnection between privacy algorithm products in different privacy computing devices, the present application provides a privacy computing system, method, apparatus, device and medium.

[0103] In order to make the purpose and implementation method of the present application clearer, the exemplary implementation method of the present application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only part of the embodiments of the present application, rather than all the embodiments.

[0104] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0105] The terms "first", "second", "third", etc. in the specification and claims of this application and the above drawings are used to distinguish similar or similar objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances.

[0106] The terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0107] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0109] Embodiment 1:

[0110] Figure 1 A schematic diagram of a privacy-preserving computing system provided by some embodiments is shown, the system comprising: a first privacy-preserving computing device 11 and a second privacy-preserving computing device 12, wherein:

[0111] The first privacy computing device 11 is used to send an approval request for a target resource level of any service to the second privacy computing device 12, wherein the approval request carries a first authorization token received from the second privacy computing device 12, wherein the first authorization token is generated after verifying the information of each resource level of the service level before the target resource level;

[0112] The second privacy computing device 12 is used to receive the approval request, and if the first authorization token is verified, generate a second authorization token corresponding to the target resource level of the business, and send the second authorization token to the first privacy computing device 11;

[0113] The first privacy computing device 11 is further configured to receive and save the second authorization token, and when sending a task execution request to the second privacy computing device 12, carry the second authorization token in the task execution request;

[0114] The second privacy computing device 12 is used to receive the task execution request, and if the first privacy computing device 11 is authenticated based on the second authorization token, execute the corresponding privacy computing task.

[0115] In a possible implementation, the first privacy computing device 11 and the second privacy computing device 12 may be devices such as personal computers (PCs), mobile terminals, or servers, etc., which are not specifically limited in this application. The first privacy computing device 11 and the second privacy computing device 12 may be two different devices. The first privacy computing device 11 and the second privacy computing device 12 each store a sub-algorithm of any privacy algorithm. For the convenience of description, the sub-algorithm stored in the first privacy computing device 11 is referred to as the first sub-algorithm, and the sub-algorithm stored in the second privacy computing device 12 is referred to as the second sub-algorithm. In a possible implementation, the first sub-algorithm and the second sub-algorithm may be partial sub-algorithms contained in the same privacy computing product launched by the same technology manufacturer, or the first sub-algorithm and the second sub-algorithm may be different privacy computing products launched by different technology manufacturers based on different system platforms, etc., which can be flexibly set according to needs, which are not specifically limited in this application and will not be repeated here.

[0116] In a possible implementation, the number of the first privacy computing device 11 and the second privacy computing device 12 can be one or more. The present application does not specifically limit the number of the first privacy computing device 11 and the second privacy computing device 12, and can be flexibly set according to the needs. No matter whether the number of the first privacy computing device 11 or the second privacy computing device 12 is one or more, for each first privacy computing device 11, the authentication process between the first privacy computing device 11 and any second privacy computing device 12 can adopt the authentication process provided by the embodiment of the present application, which will not be repeated here. For the convenience of understanding, unless otherwise specified, the authentication process (privacy computing process) provided by the present application is explained below by taking the number of the first privacy computing device 11 and the second privacy computing device 12 as one for example.

[0117] In a possible implementation, the first privacy computing device 11 and the second privacy computing device 12 can both be used as a node. The first privacy computing device 11 and the second privacy computing device 12 can both include different types of resources such as nodes participating in a certain interconnected joint computing business, projects involved in the business in the node, data required when the node executes the privacy computing task of the corresponding project of the business, processes involved in executing the corresponding project of the business, and jobs included in the process. Among them, there can be one or more projects involved in a certain business in the node, one or more data can be used when the node executes the privacy computing task of a certain business corresponding project, the number of processes involved in the project can be one or more, and the number of jobs included in the process can also be one or more. This application does not make specific restrictions on this. These different types of resources can be divided into different resource levels. For example, refer to Table 1. Table 1 shows an example table of resource levels provided in some embodiments.

[0118] Table 1

[0119] Resource level Resource Type 1 node 2 Projects, data 3 process 4 Operation

[0120] As shown in Table 1, the first resource level can be nodes, the second resource level can be data and projects, the third resource level can be processes, and the fourth resource level can be jobs. The resource level can be flexibly set according to demand, and this application does not make specific restrictions on this. For ease of understanding, the privacy computing process provided by this application is explained below using the first resource level as nodes, the second resource level as data and projects, the third resource level as processes, and the fourth resource level as jobs as examples.

[0121] In a possible implementation, in order to facilitate authentication when different privacy computing devices are interconnected and jointly computed for a certain business, and to ensure the security of the privacy algorithm products in different privacy computing devices when they are interconnected and jointly computed, the approval and authorization process can be performed between different privacy computing devices before the interconnected and jointly computed. Specifically, when performing approval and authorization, in order to improve security, the corresponding approval and authorization process can be performed for each resource level.

[0122] In one possible implementation, for each resource level, the first privacy computing device 11 may send an approval request for the resource level of a certain business to the second privacy computing device 12. Exemplarily, for the first resource level (node ​​resource level), the first privacy computing device 11 may send an approval request for the node resource level of a certain business to the second privacy computing device 12 (the approval request for the node resource level may also be referred to as a contract signing request), and the approval request may carry the node identifier (node_id) of the first privacy computing device 11 and the business identifier. After receiving the contract signing request, the second privacy computing device 12 may review the information of the contract signing request. If the review is passed, an authorization token (token1) corresponding to the node resource level may be generated. The process of reviewing the information of the contract signing request may adopt existing technologies, which will not be described in detail here.

[0123] For any resource level other than the first resource level, when performing corresponding approval and authorization for the resource level, the first privacy computing device 11 may send an approval request for the resource level of a certain business to the second privacy computing device 12. The approval request may carry an authorization token received from the second privacy computing device 12. The authorization token may be an authorization token generated by the second privacy computing device 12 after verifying the information of the resource levels of the business level before the resource level.

[0124] Exemplarily, for the project resource level in the second resource level, the first privacy computing device 11 may send an approval request for the project resource level of a certain business to the second privacy computing device 12 (the approval request for the project resource level may also be referred to as a project cooperation request), and the approval request may carry the authorization token (token1) of the first resource level (i.e., the node resource level) for the corresponding business received from the second privacy computing device 12. After receiving the approval request, the second privacy computing device 12 may review (verify) the authorization token (token1) carried in the approval request. If the verification passes, an authorization token (token2) corresponding to the project resource level may be generated. If the verification fails, the process of generating the authorization token corresponding to the project resource level may not be performed. Among them, the verification process of the authorization token is introduced in subsequent embodiments, which will not be repeated here.

[0125] For the data resource level in the second resource level, the first privacy computing device 11 can send an approval request for the data resource level of a certain business to the second privacy computing device 12 (the approval request for the data resource level can also be called a data approval request). The approval request can carry the authorization token (token1) of the first resource level (i.e., the node resource level) for the corresponding business received from the second privacy computing device 12. After receiving the approval request, the second privacy computing device 12 can review (verify) the authorization token (token1) carried in the approval request. If the verification passes, the authorization token (token3) corresponding to the data resource level can be generated. If the verification fails, the process of generating the authorization token corresponding to the data resource level can be omitted. Among them, the verification process of the authorization token is introduced in the subsequent embodiments, which will not be repeated here.

[0126] In one possible implementation, in order to improve the verification efficiency of the authorization token, the second privacy computing device 12 can maintain and update in real time whether the authorization token is a valid token. When verifying the authorization token, if the authorization token is identified as a valid token, the authorization token can be verified to pass; otherwise, if the authorization token is identified as an expired token, the authorization token can be verified to fail, thereby achieving quick verification.

[0127] Specifically, when maintaining and updating whether the authorization token is a valid token, the second privacy computing device 12 can determine whether the authorization token is a valid token or an invalid token based on whether the authorization token is an authorization token generated by itself for a certain resource level of a certain business, and whether the authorization token meets the preset expiration condition. Exemplarily, the second privacy computing device 12 can save the authorization token to the valid token set in the database each time it generates an authorization token. Afterwards, for each authorization token, it can be determined in real time whether the authorization token meets the preset expiration condition. If the preset expiration condition is met, the authorization token can be removed from the valid token set, for example, it can be marked as an invalid token or deleted.

[0128] Among them, for each authorization token, when the second privacy computing device 12 determines whether the authorization token meets the preset expiration condition, it can be that when it is identified that the usage period of the authorization token exceeds the preset effective usage period, it is considered that the authorization token meets the preset expiration condition and the authorization token can be removed from the valid token set.

[0129] In addition, for each authorization token, when determining whether the authorization token satisfies the preset expiration condition, the second privacy computing device 12 may also consider that the authorization token satisfies the preset expiration condition when recognizing that the number of times the authorization token has been used exceeds the preset number threshold, and may remove the authorization token from the valid token set. In a possible implementation, when an interoperable privacy computing task is performed between the first privacy computing device 11 and the second privacy computing device 12 based on the data of a certain business, it is considered that the authorization token of a certain business is used once, and the number of times the corresponding authorization token is used can be determined by counting the number of times the first privacy computing device 11 and the second privacy computing device 12 perform an interoperable privacy computing task based on the data of a certain business.

[0130] In addition, for each authorization token, when the second privacy computing device 12 determines whether the authorization token meets the preset expiration condition, it may also be possible to remove the authorization token from the valid token set when it receives an authorization cancellation instruction for the resource level corresponding to the authorization token for the corresponding business input by the operator and considers that the authorization token meets the expiration condition.

[0131] In addition, for each authorization token, when the second privacy computing device 12 determines whether the authorization token meets the preset expiration condition, it may also be possible to remove the authorization token from the valid token set if it receives an authorization cancellation instruction input by the operator for any resource level before the resource level corresponding to the authorization token for the corresponding business.

[0132] In one possible implementation, taking into account that multiple sub-data in the data resource layer may be used simultaneously when performing interoperable privacy computing tasks, for example, sub-data 1 corresponding to authorization sub-token token3-1 and sub-data 2 corresponding to authorization sub-token token3-2 are used simultaneously. For the data resource layer, when receiving an authorization cancellation instruction for all data (such as sub-data 1 and sub-data 2) involved in executing the privacy computing task of the corresponding business in the data resource layer, it can be considered that an authorization cancellation instruction for the data resource layer is received, and the authorization token token3 corresponding to the data resource layer is removed from the valid token set; otherwise, if only an authorization cancellation instruction for part of the sub-data is received, and the authorization cancellation instruction is not triggered for some sub-data, it can be considered that only the sub-authorization token of the part of the sub-data that has received the authorization cancellation instruction is invalid, and for the data resource layer, the authorization token of the data resource layer is still valid. For example, assuming that only the authorization cancellation instruction for sub-data 1 corresponding to authorization sub-token token3-1 is received, but the authorization cancellation instruction for sub-data 2 corresponding to authorization sub-token token3-2 is not received, then only the authorization sub-token token3-1 can be considered invalid, and the authorization token token3 at the data resource level is still valid.

[0133] As another example, take the authorization token corresponding to the first resource level (node ​​resource level) as token1, the authorization token corresponding to the project resource level in the second resource level as token2, and the authorization token corresponding to the data resource level in the second resource level as token3 as an example. Assuming that when an authorization cancellation instruction for the node resource level is received, token1 can be removed from the valid token set. At the same time, the authorization token corresponding to the project resource level as token2 and the authorization token corresponding to the data resource level as token3 can also be removed from the valid token set. It can be seen that if the authorization token of the second resource level is a valid token, the authorization token of the first resource level before the second resource level can be considered to be valid as well.

[0134] That is to say, for a certain resource level, if the authorization token of the resource level is valid, the authorization token of the resource level before the resource level is also valid. Conversely, if the authorization token of the resource level is invalid, the authorization token of the resource level after the resource level is also invalid. Based on this, in order to improve efficiency, taking the third resource level (process resource level) as an example, when performing the approval authorization process of the third resource level, the first privacy computing device 11 can send an approval request for the process resource level of a certain business to the second privacy computing device 12 (the approval request of the process resource level can also be called a process approval request). The approval request can carry the authorization token (token2 and token3) of the second resource level (project resource level and data resource level) for the corresponding business received from the second privacy computing device 12. After receiving the approval request, the second privacy computing device 12 can review (verify) the authorization tokens (token2 and token3) carried in the approval request. If token2 passes the verification and token3 passes the verification, the authorization token (token4) corresponding to the process resource level can be generated. Otherwise, if token2 fails to be verified or token3 fails to be verified, the step of generating the authorization token (token4) corresponding to the process resource level may not be performed. The verification process of the authorization token is the same as the verification process described above, and will not be repeated here.

[0135] When performing the approval and authorization process of the fourth resource level (job resource level), the first privacy computing device 11 may send an approval request for the job resource level of a certain business to the second privacy computing device 12 (the approval request for the job resource level may also be referred to as a job approval request). The approval request may carry the authorization token (token4) of the third resource level (process resource level) for the corresponding business received from the second privacy computing device 12. After receiving the approval request, the second privacy computing device 12 may review (verify) the authorization token (token4) carried in the approval request. If the verification passes, an authorization token (token5) corresponding to the job resource level may be generated. Otherwise, if the verification fails, the step of generating an authorization token (token5) corresponding to the job resource level may not be performed. Among them, the verification process of the authorization token is the same as the verification process described above, and will not be repeated here.

[0136] In a possible implementation, when verifying the authorization token (token4) of the third resource level (process resource level) and determining whether the authorization token (token4) of the third resource level (process resource level) is invalid (whether the preset invalidation condition is met), it can be determined at least in the following ways:

[0137] Method 1: When receiving the authorization cancellation instruction for the process resource level, the authorization token (token4) corresponding to the process resource level is considered invalid (satisfying the preset invalidation condition).

[0138] In addition, when the authorization token at the process resource level exceeds the effective period of use or the number of times it is used reaches a set threshold, the authorization token (token4) corresponding to the process resource level may be considered invalid, which will not be described in detail here. For ease of understanding, in this embodiment, only whether an authorization cancellation instruction is received is used to determine whether the authorization token is invalid.

[0139] Method 2: Determine whether the authorization token of the resource level (project resource level, data resource level, node resource level) before the process resource level is invalid.

[0140] Among them: (1) When receiving the authorization cancellation instruction for the project resource level, it is considered that the authorization token corresponding to the project resource level meets the preset expiration condition. At this time, regardless of whether the authorization token at the data resource level is valid, the authorization token (token4) corresponding to the process resource level can be considered invalid (meeting the preset expiration condition).

[0141] (2) When receiving the authorization cancellation instruction for all data involved in executing the privacy computing task of the corresponding business in the data resource level, it is considered that the authorization token corresponding to the data resource level meets the preset expiration condition. At this time, regardless of whether the authorization token at the project resource level is valid, the authorization token (token4) corresponding to the process resource level can be considered invalid (meeting the preset expiration condition).

[0142] (3) When the authorization token corresponding to the project resource level does not meet the preset expiration conditions, and only receives the authorization cancellation instruction for part of the data involved in the privacy computing task of executing the corresponding business in the data resource level, at this time, it can be considered that the authorization token (token3) of the data resource level is still valid. The process resource level is the next resource level of the data resource level, and the authorization token (token4) corresponding to the process resource level is also valid (does not meet the preset expiration conditions).

[0143] Exemplarily, suppose that a certain interconnected privacy computing task uses multiple sub-data in the data resource layer at the same time, for example, sub-data 1 from bank A corresponding to authorization sub-token token3-1 and sub-data 2 from bank B corresponding to authorization sub-token token3-2 are used at the same time. When receiving the authorization cancellation instruction for all data (such as sub-data 1 and sub-data 2) involved in executing the privacy computing task of the corresponding business in the data resource layer, it is considered that the authorization cancellation instruction for the data resource layer is received, and the authorization token token3 corresponding to the data resource layer can be considered invalid. If only the authorization cancellation instruction for sub-data 1 of bank A is received, and the authorization cancellation instruction for sub-data 2 of bank B is not received, it can be considered that for the data resource layer, the authorization token token3 of the data resource layer is still valid. At this time, if the authorization token corresponding to the project resource layer is valid (the preset expiration condition is not met), the authorization token (token4) corresponding to the process resource layer can be considered to be valid.

[0144] (4) When the authorization token corresponding to the project resource level does not meet the preset expiration conditions, and all data involved in the privacy computing tasks of the corresponding business in the data resource level have not received the corresponding authorization cancellation instructions, at this time, it can be considered that the authorization token (token3) of the data resource level and the authorization token (token2) corresponding to the project resource level are both valid, and the authorization token (token4) corresponding to the process resource level is also valid.

[0145] (5) When an authorization cancellation instruction is received for the first resource level (node ​​resource level), the authorization token of the node resource level can be considered invalid. In addition, the authorization tokens of all resource levels after the node resource level: project resource level, data resource level, and process resource level are all invalid.

[0146] In a possible implementation, after the authorization tokens corresponding to each resource level are generated, when the first privacy computing device 11 and the second privacy computing device 12 are ready to perform a privacy computing task, the authentication process of the privacy computing device can be performed based on the authorization token corresponding to any resource level. For example, when the authorization token corresponding to the corresponding resource level provided by the first privacy computing device 11 is valid (located in the valid token set), the first privacy computing device 11 is considered to be a safe device, and the second privacy computing device 12 can authenticate the first privacy computing device 11 and perform the corresponding privacy computing task. When the authorization token corresponding to the corresponding resource level provided by the first privacy computing device 11 is not in the valid token set, the second privacy computing device 12 can fail to authenticate the first privacy computing device 11 and not perform the corresponding privacy computing task, thereby ensuring to the greatest extent that only authenticated privacy computing devices can perform interconnected privacy computing and ensure the security of the privacy computing process.

[0147] Specifically, when performing the corresponding authentication process, the first privacy computing device 11 and the second privacy computing device 12 can pre-agree on the fields of the resource level for authentication and approval. The fields of the resource level for authentication and approval can be full-link approval and authentication, or they can be the identifier of a certain resource level. This application does not make specific limitations on this. Exemplarily, when the fields of the resource level for authentication and approval are full-link approval and authentication, it can be considered that the authentication process of the privacy computing device needs to be based on the authorization token of the last resource level (such as the fourth resource level). Since the authorization token of the last resource level is valid, the authorization tokens of the resource levels before the resource level are also valid. Therefore, by verifying the authorization token of the last resource level, fast verification and fast authentication can be achieved.

[0148] In addition, in order to improve the flexibility of authentication, the field of the resource level for authentication and approval can also be the identifier of one of the resource levels other than the last resource level. That is to say, in addition to being able to authenticate the privacy computing device based on the authorization token of the last resource level, the authentication process of the privacy computing device can also be based on the authorization token of one of the resource levels other than the last resource level (such as the second resource level, the third resource level, etc.). For ease of understanding, the embodiment of the present application refers to the resource level used for authentication and approval as the target resource level. The target resource level can be any resource level, and the generation process of the authorization token of the target resource level can be:

[0149] The first privacy computing device 11 sends an approval request for the target resource level of the corresponding business to the second privacy computing device 12, and the approval request carries the first authorization token previously received from the second privacy computing device 12, and the first authorization token is generated by the second privacy computing device 12 after verifying the information of each resource level before the target resource level of the business. Among them, taking the target resource level as the fourth resource level (job resource level) as an example, the first authorization token can be the authorization token corresponding to the third resource level generated by the second privacy computing device 12.

[0150] When the second privacy computing device 12 receives the approval request, it can verify the first authorization token to determine whether the first authorization token is an authorization token in the current valid token set. If the first authorization token is an authorization token in the current valid token set, the first authorization token can be verified, and then a second authorization token corresponding to the target resource level of the business can be generated, and the second authorization token can be sent to the first privacy computing device 11. Conversely, if the first authorization token is not an authorization token in the current valid token set, the first authorization token can be verified and failed, and the process of generating the second authorization token corresponding to the target resource level of the business can be omitted. Among them, the process of verifying the first authorization token is the same as the process of verifying the authorization token described in the above embodiment, and will not be repeated here.

[0151] When the first privacy computing device 11 receives the second authorization token, it can save the second authorization token. Afterwards, when preparing to interconnect with the second privacy computing device 12 to perform a privacy computing task, it can send a task execution request to the second privacy computing device 12, and the task execution request can carry the second authorization token. When the second privacy computing device 12 receives the task execution request sent by the first privacy computing device 11, it can identify the second authorization token carried in the task execution request, and determine whether the second authorization token is an authorization token in the current valid token set. If the second authorization token is an authorization token in the current valid token set, the first privacy computing device 11 can be authenticated and the corresponding privacy computing task can be executed. On the contrary, if the second authorization token is not an authorization token in the current valid token set, the first privacy computing device 11 can be authenticated and the corresponding privacy computing task can not be executed, so that the privacy computing device can be authenticated flexibly and securely, ensuring the security of the privacy algorithm products in different privacy computing devices when interconnected.

[0152] For ease of understanding, the privacy computing process provided by this application is explained below through a specific embodiment. Figure 2 , Figure 2 A schematic diagram of a first privacy computing process provided by some embodiments is shown, and the process includes the following steps:

[0153] S201: The operator may input the service identifier and the node identifier of the second privacy computing device into the first privacy computing device to trigger the approval instruction at the node resource level. After receiving the approval instruction, the first privacy computing device may send a node resource level approval request (signing request) for the service of the service identifier to the second privacy computing device, and the approval request may carry the node identifier (node_id) and service identifier of the first privacy computing device.

[0154] S202: After receiving the signing request, the second privacy computing device can review the information of the signing request. If the review passes, an authorization token (token1) corresponding to the node resource level can be generated.

[0155] S203: The second privacy computing device saves the authorization token (token1) corresponding to the node resource level into the valid token set, and sends the authorization token to the first privacy computing device.

[0156] Optionally, in order to improve the speed of subsequent resource-level approval authorization, the second privacy computing device can save the identification (contract_id) of the approval workflow for reviewing (approving) the contract request, and can send the identification (contract_id) of the approval workflow to the first privacy computing device.

[0157] S204: After the node resource level approval authorization is passed, the operator can input the business identifier, project identifier (project_id), the node resource level approval workload identifier (contract_id), and the node resource level authorization token (token1) for the corresponding business received from the second privacy computing device in the first privacy computing device to trigger the project resource level approval instruction. After receiving the approval instruction, the first privacy computing device can send a project resource level approval request (project cooperation request) for the above business to the second privacy computing device, and the approval request carries the authorization token (token1) for the first resource level (i.e., node resource level) for the corresponding business received from the second privacy computing device.

[0158] S205: After receiving the approval request, the second privacy computing device can verify the authorization token (token1) of the node resource level carried in the approval request. If the verification passes, it can generate an authorization token (token2) corresponding to the project resource level of the business and the first privacy computing device.

[0159] S206: The second privacy computing device saves the authorization token (token2) corresponding to the project resource level into the valid token set, and sends the authorization token to the first privacy computing device.

[0160] Similarly, in order to improve the speed of subsequent resource-level approval authorization, the second privacy computing device can save the identification of the approval workflow (audit_id2) for reviewing (approving) the project cooperation request, and can send the identification of the approval workflow (audit_id2) and the authorization token (token2) corresponding to the project resource level to the first privacy computing device.

[0161] In a possible implementation, in order to facilitate subsequent authentication and approval authorization operations based on the authorization token, the authorization token generated by the second privacy computing device may carry a business identifier (x-trace-id) for full-link tracing, a requester (first privacy computing device) node identifier (x-source-node-id), a destination (second privacy computing device) node identifier (x-target-node-id), a random string for anti-replay (x-nonce), the resource level corresponding to the authorization token, the valid use period, the number of uses threshold, and other information. Among them, the generation process of the anti-replay random string in the authorization token can be generated using existing technology, and the valid use period and the number of uses threshold can be the valid use period and the number of uses threshold input by the operator received by the second privacy computing when generating the authorization token. The valid use period and the number of uses threshold can be flexibly set according to demand. For example, the valid use period can be 1 year, 6 months, etc., and the number of uses threshold can be 5 times, 10 times, etc. This application does not make specific restrictions on this.

[0162] When the second privacy computing device verifies the authorization token token1 at the node resource level, it can identify the business identifier, requester node identifier (x-source-node-id), destination node identifier (x-target-node-id), random string for anti-replay (x-nonce), resource level and other information carried in the authorization token, and compare the authorization token with the authorization token in the currently saved valid token set to determine whether the authorization token is an authorization token in the valid token set. If so, the authorization token can be verified to pass; otherwise, the authorization token can be verified to fail.

[0163] In one possible implementation, when one of the first privacy computing device and the second privacy computing device needs to send an authorization token to the other party, they can first use a preset symmetric key to encrypt the authorization token and send the encrypted authorization token to the other party to ensure the security of the authorization token, which will not be repeated here.

[0164] S207: After the node resource level approval authorization is passed, the operator can enter the business identifier, data set identifier (dataset_id), node resource level approval workload identifier (contract_id), and the node resource level authorization token (token1) for the corresponding business received from the second privacy computing device in the first privacy computing device to trigger the data resource level approval instruction. After receiving the approval instruction, the first privacy computing device can send an approval request (data approval request) for the data resource level of the above business to the second privacy computing device, and the approval request carries the authorization token (token1) for the first resource level (i.e., node resource level) of the corresponding business received from the second privacy computing device.

[0165] S208: After receiving the approval request, the second privacy computing device can verify the authorization token (token1) of the node resource level carried in the approval request. If the verification passes, it can generate an authorization token (token3) corresponding to the data resource level of the business and the first privacy computing device.

[0166] S209: The second privacy computing device saves the authorization token (token3) corresponding to the data resource level into the valid token set, and sends the authorization token to the first privacy computing device.

[0167] Optionally, the second privacy computing device can save the identification of the approval workflow (audit_id3) for reviewing (approving) the data approval request, and can send the identification of the approval workflow (audit_id3) and the authorization token (token3) corresponding to the data resource level to the first privacy computing device.

[0168] S210: After the approval authorization of the project resource level and the data resource level is passed, the operator can input the business identifier, the process identifier (flow_id), the approval workload identifier (audit_id2) of the project resource level, the authorization token (token2) of the project resource level for the corresponding business received from the second privacy computing device, the approval workload identifier (audit_id3) of the data resource level, and the authorization token (token3) of the data resource level for the corresponding business received from the second privacy computing device in the first privacy computing device to trigger the approval instruction of the process resource level. After receiving the approval instruction, the first privacy computing device can send an approval request (process approval request) for the process resource level of the above-mentioned business to the second privacy computing device, and the approval request carries the authorization token (token2) of the project resource level and the authorization token (token3) of the data resource level in the second resource level for the corresponding business received from the second privacy computing device.

[0169] S211: After receiving the approval request, the second privacy computing device can verify the authorization token (token2) of the project resource level and the authorization token (token3) of the data resource level carried in the approval request. If both verifications pass, an authorization token (token4) corresponding to the process resource level of the business and the first privacy computing device can be generated.

[0170] S212: The second privacy computing device saves the authorization token (token4) corresponding to the process resource level into the valid token set, and sends the authorization token to the first privacy computing device.

[0171] Similarly, in order to improve the speed of subsequent resource-level approval authorization, the second privacy computing device can save the identification of the approval workflow (audit_id4) for reviewing (approving) the project cooperation request, and can send the identification of the approval workflow (audit_id4) and the authorization token (token4) corresponding to the process resource level to the first privacy computing device.

[0172] S213: After the approval authorization at the process resource level is passed, the operator can input the business identifier, job identifier (job_id), the approval workflow identifier (audit_id4) at the process resource level, and the authorization token (token4) at the process resource level for the corresponding business received from the second privacy computing device in the first privacy computing device to trigger the approval instruction at the job resource level. After receiving the approval instruction, the first privacy computing device can send an approval request (job approval request) at the job resource level for the above business to the second privacy computing device, and the approval request carries the authorization token (token4) at the process resource level for the corresponding business received from the second privacy computing device.

[0173] S214: After receiving the approval request, the second privacy computing device can verify the authorization token (token4) of the process resource level carried in the approval request. If all verifications pass, an authorization token (token5) corresponding to the business and the job resource level of the first privacy computing device can be generated.

[0174] S215: The second privacy computing device saves the authorization token (token5) corresponding to the job resource level into the valid token set, and sends the authorization token to the first privacy computing device.

[0175] In the process of executing the above steps, for each generated authorization token, the second privacy computing device can determine whether the authorization token meets the preset expiration condition. If so, the authorization token is removed from the valid token set.

[0176] S216: When the first privacy computing device sends a task execution request to the second privacy computing device, the task execution request carries the authorization token token5 (second authorization token) corresponding to the job resource level.

[0177] S217: The second privacy computing device receives the task execution request and determines whether the second authorization token token5 is an authorization token in the currently saved valid token set. If so, it can authenticate the first privacy computing device and interconnect with the first privacy computing device to perform the corresponding privacy computing task.

[0178] In one possible implementation, the authorization and authentication process in the above embodiment can be considered as a link performed in the management plane of the privacy computing device. When the authentication is completed and the privacy computing task is executed, the privacy computing device can send the second authorization token (such as token5) to the scheduling layer in the privacy computing device. When the scheduling layer executes the privacy computing task, one authorization token can correspond to one job (job_id), and one job can derive multiple tasks, such as task 1 (session_id1), task 2 (session_id2), task 3 (session_id3), etc. Each task can maintain a communication task that executes the interconnection privacy algorithm between the first privacy computing device and the second privacy computing device, so as to achieve a high-precision authorization control effect at the algorithm task level and ensure the security of interconnection privacy computing.

[0179] In a possible implementation, in the process of generating the second authorization token, in addition to verifying the first authorization token, the second privacy computing device can also verify whether the approval request is valid. If the first authorization token is verified and the approval request is also valid, the subsequent process of generating the second authorization token of the corresponding resource level can be performed. If the first authorization token fails to be verified or the approval request is invalid, the process of generating the authorization token of the corresponding resource level may not be performed.

[0180] Among them, when verifying whether the approval request is valid, considering that if the approval request is intercepted by a third-party malicious user, the third-party malicious user usually needs to perform corresponding decryption, tampering and other operations on the information in the approval request, and these operations usually take a certain amount of time. When verifying whether the approval request is valid, the time when the first privacy computing device carried by the first authorization token sends the approval request (for the convenience of description, referred to as the sending time) can be identified, and the time when the second privacy computing device receives the approval request (for the convenience of description, referred to as the receiving time) can be identified. After that, it can be determined whether the interval between the receiving time and the sending time is less than the preset time threshold. If the interval between the receiving time and the sending time is less than the preset time threshold, it can be considered that the approval request is highly likely not intercepted by a third-party malicious user, and the approval request can be considered valid. If the interval between the receiving time and the sending time is not less than (greater than or equal to) the preset time threshold, it can be considered that the approval request may be an approval request intercepted and tampered by a third-party malicious user. In order to ensure security, the approval request can be considered invalid.

[0181] For ease of understanding, the privacy computing process provided by this application is explained below through a specific embodiment. Figure 3 , Figure 3 A schematic diagram of a second privacy computing process provided by some embodiments is shown, and the process includes the following steps:

[0182] S301: The first privacy computing device sends an approval request for a target resource level of any business to the second privacy computing device. The approval request carries an authorization token generated by the second privacy computing device for the previous resource level of the target resource level.

[0183] S302: The second privacy computing device receives the approval request, verifies the first authorization token, and verifies whether the approval request is valid. If the first authorization token is verified and the approval request is valid, a second authorization token corresponding to the target resource level of the business is generated, and the second authorization token is sent to the first privacy computing device.

[0184] Among them, the process of verifying the first authorization token is the same as the above embodiment and will not be repeated here. When verifying the approval request, it is possible to identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and to identify the receiving time of the approval request received by the second privacy computing device; determine whether the interval between the receiving time and the sending time is less than a preset time threshold; if so, determine that the approval request is valid; if not, determine that the approval request is invalid.

[0185] S303: The first privacy-preserving computing device receives and saves the second authorization token, and when sending a task execution request to the second privacy-preserving computing device, carries the second authorization token in the task execution request.

[0186] S304: The second privacy computing device receives the task execution request and identifies the second authorization token carried in the task execution request. If the second authorization token is an authorization token in the currently saved valid token set, the first privacy computing device is authenticated and the corresponding privacy computing task is executed.

[0187] To facilitate understanding, the privacy computing process provided by this application is explained below through a specific embodiment.

[0188] See also Figure 4A , Figure 4AA schematic diagram of an authorization token provided by some embodiments is shown. It is assumed that based on the approval and authorization process of the above authorization token, the second privacy computing device generates authorization token token1 corresponding to the node resource level, authorization token token2 corresponding to the project resource level, authorization sub-tokens token3-1, token3-2, token3-3, and token3-4 corresponding to the data resource level, respectively. The process resource level of a certain business uses the sub-data corresponding to the authorization sub-tokens token3-1 and token3-2 of the data resource level. The authorization token of the process resource level of the business is token4-1, and the authorization token of the job resource level is token5-1. The process resource level of another business uses the sub-data corresponding to the authorization sub-tokens token3-1 and token3-2 of the data resource level. The authorization token of the process resource level of the business is token4-2, and the authorization token of the job resource level is token5-2. The process resource level of another business uses the sub-data corresponding to the authorization sub-tokens token3-1, token3-2, token3-3, and token3-4 at the data resource level. The authorization token at the process resource level of this business is token4-3. Assume that this business corresponds to two jobs, and the authorization tokens at the resource level of these two jobs are token5-3 and token5-4 respectively.

[0189] In a possible implementation, when storing authorization tokens of different resource levels, the privacy computing device may also store the hierarchical relationship (link relationship) between the resource levels of the authorization tokens. For example, taking the link relationship of the authorization token token5-1 as an example, see Figure 4B , Figure 4B A schematic diagram of an authorization token storage information provided by some embodiments is shown, and the second privacy computing device can record the identifier (node_id) of the first privacy computing device (node) corresponding to the authorization token and the business identifier (not shown). In addition, for each resource level, the authorization token (referred to as Token in the figure) corresponding to the identifier of the resource level (referred to as resource ID in the figure) can be recorded. For example, the authorization token corresponding to the identifier (node_id) of the node resource level is token1, the authorization token corresponding to the identifier (project_id) of the project resource level is token2, the authorization token corresponding to the identifier (dataset_id1) of sub-data 1 in the data resource level is token3-1, the authorization token corresponding to the identifier (dataset_id2) of sub-data 2 in the data resource level is token3-2, the authorization token corresponding to the identifier (flow_id) of the process resource level is token4-1, and the authorization token corresponding to the identifier (job_id) of the job resource level is token5-1.

[0190] In addition, for each authorization token, the authorization token of the previous resource level before the resource level corresponding to the authorization token can also be recorded (for ease of description, referred to as preceding Tokens in the figure). For example, for token2, the authorization token of the previous resource level before the resource level corresponding to token2 is token1. For token3-1, the authorization token of the previous resource level before the resource level corresponding to token3-1 is token1. For token3-2, the authorization token of the previous resource level before the resource level corresponding to token3-2 is token1. For token4-1, the authorization tokens of the previous resource level before the resource level corresponding to token4-1 are token2, token3-1, and token3-2, respectively. For token5-1, the authorization token of the previous resource level before the resource level corresponding to token5-1 is token4-1.

[0191] In addition, the status identifier of whether the authorization token is valid can also be recorded. For example, for each authorization token, when the status identifier of the authorization token is 1, the authorization token can be considered to be currently valid (located in the valid token set); when the status identifier of the authorization token is 0, the authorization token can be considered to be currently invalid (removed from the valid token set).

[0192] In addition, for each authorization token, the identifier of the approval workflow used by the second privacy computing device to generate the authorization token can also be recorded, which will not be repeated here.

[0193] In one possible implementation, when a cancellation instruction for authorization of the project resource level is received, token2 can be considered to meet the preset expiration condition, token2 can be removed from the valid token set, and its status flag can be modified to 0. In addition, since token2 is the predecessor token of token4-1, that is, the resource level of token2 is the previous resource level before the resource level of token4-1, when token2 is removed from the valid token set, token4-1 can also be removed from the valid token set, and the status flag of token4-1 can be modified to 0. Similarly, since token4-1 is the predecessor token of token5-1, that is, the resource level of token4-1 is the previous resource level before the resource level of token5-1, when token4-1 is removed from the valid token set, token5-1 can also be removed from the valid token set.

[0194] In a possible implementation, when only the authorization cancellation instruction for sub-data 2 is received but the authorization cancellation instruction for sub-data 1 is not received, token3-2 can be removed from the valid token set, while token4-1 and token5-1 are still valid.

[0195] When the authorization cancellation instruction for sub-data 2 and sub-data 1 is received, token3-2 and token3-1 may be removed from the valid token set, and token4-1 and token5-1 may also be removed from the valid token set.

[0196] Embodiment 2:

[0197] Based on the same technical concept, the present application provides a privacy computing method, which is applied to a second privacy computing device, see Figure 5 , Figure 5 A third privacy computing process schematic diagram provided by some embodiments is shown, and the method includes the following steps:

[0198] S501: Receive an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying the information of each resource level of the business level that is before the target resource level.

[0199] S502: If the first authorization token is verified, a second authorization token corresponding to the target resource level of the business is generated, and the second authorization token is sent to the first privacy computing device.

[0200] S503: Receive a task execution request sent by the first privacy computing device, where the task execution request carries the second authorization token.

[0201] S504: If the first privacy computing device is authenticated based on the second authorization token, the corresponding privacy computing task is executed.

[0202] In a possible implementation manner, the verifying the first authorization token successfully includes:

[0203] If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

[0204] In a possible implementation manner, the failure condition includes at least one of the following:

[0205] The first authorization token exceeds the valid usage period;

[0206] The number of times the first authorization token is used reaches a set number threshold;

[0207] Receiving an authorization cancellation instruction for the upper resource level of the service;

[0208] An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

[0209] In a possible implementation manner, receiving an authorization cancellation instruction for any resource level includes:

[0210] For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

[0211] In a possible implementation, if the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the determining whether the first authorization token satisfies a preset expiration condition includes:

[0212] When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies the preset expiration condition; or,

[0213] Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or

[0214] When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

[0215] In a possible implementation, after receiving the approval request for the target resource level of any business sent by the first privacy computing device and before generating the second authorization token corresponding to the target resource level of the business, the method further includes:

[0216] Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

[0217] In a possible implementation manner, verifying whether the approval request is valid includes:

[0218] Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device;

[0219] Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold;

[0220] If so, determining that the approval request is valid;

[0221] If not, it is determined that the approval request is invalid.

[0222] Embodiment 3:

[0223] Based on the same technical concept, the present application provides a privacy computing method, which is applied to a first privacy computing device, see Figure 6 , Figure 6 A fourth privacy computing process schematic diagram provided by some embodiments is shown, and the method includes the following steps:

[0224] S601: Send an approval request for a target resource level of any business to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying the information of each resource level of the business level that is located before the target resource level.

[0225] S602: Receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

[0226] Embodiment 4:

[0227] Based on the same technical concept, the present application provides a privacy computing device, which is applied to a second privacy computing device, see Figure 7 , Figure 7 A schematic diagram of a privacy computing device provided by some embodiments is shown, the device comprising:

[0228] An approval module 701 is used to receive an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying the information of each resource level of the business level before the target resource level;

[0229] The authorization module 702 is used to generate a second authorization token corresponding to the target resource level of the business if the first authorization token is verified, and send the second authorization token to the first privacy computing device;

[0230] An execution module 703 is used to receive a task execution request sent by the first privacy computing device, wherein the task execution request carries the second authorization token;

[0231] The authentication module 704 is used to execute the corresponding privacy computing task if the first privacy computing device is authenticated based on the second authorization token.

[0232] In a possible implementation, the authorization module 702 is specifically configured to:

[0233] If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

[0234] In a possible implementation manner, the failure condition includes at least one of the following:

[0235] The first authorization token exceeds the valid usage period;

[0236] The number of times the first authorization token is used reaches a set number threshold;

[0237] Receiving an authorization cancellation instruction for the upper resource level of the service;

[0238] An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

[0239] In a possible implementation, if the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the authorization module 702 is specifically used to:

[0240] When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies the preset expiration condition; or,

[0241] Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or

[0242] When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

[0243] In a possible implementation, the authorization module 702 is specifically configured to:

[0244] For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

[0245] In a possible implementation, the authorization module 702 is further configured to:

[0246] Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

[0247] In a possible implementation, the authorization module 702 is specifically configured to:

[0248] Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device;

[0249] Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold;

[0250] If so, determining that the approval request is valid;

[0251] If not, it is determined that the approval request is invalid.

[0252] Embodiment 5:

[0253] Based on the same technical concept, the present application provides a privacy computing device, which is applied to a second privacy computing device, see Figure 8 , Figure 8 A schematic diagram of another privacy computing device provided by some embodiments is shown, the device comprising:

[0254] A first sending module 801 is configured to send an approval request for a target resource level of any service to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the service level before the target resource level;

[0255] The second sending module 802 is used to receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

[0256] Embodiment 6:

[0257] Based on the same technical concept, the present application provides an electronic device. Fig. 9 A schematic diagram of the structure of an electronic device provided by some embodiments is shown. Fig. 9 As shown, it includes: a processor 901, a communication interface 902, a memory 903 and a communication bus 904, wherein the processor 901, the communication interface 902, and the memory 903 communicate with each other through the communication bus 904;

[0258] The memory 903 stores a computer program. When the program is executed by the processor 901, the processor 901 performs the steps of any of the above methods. The repeated parts will not be repeated.

[0259] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0260] The communication interface 902 is used for communication between the electronic device and other devices.

[0261] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0262] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0263] Based on the above embodiments, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements the steps of any of the above methods when executed.

[0264] The above-mentioned computer-readable storage medium can be any available medium or data storage device that can be accessed by the processor in the electronic device, including but not limited to magnetic storage such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical storage such as CD, DVD, BD, HVD, etc., and semiconductor storage such as ROM, EPROM, EEPROM, non-volatile memory (NANDFLASH), solid-state drive (SSD), etc.

[0265] Based on the same technical concept, the present application also provides a computer program product, which includes a computer program / instruction, and when the computer program / instruction processor is executed, any of the above methods is implemented.

[0266] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0267] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0268] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0269] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0270] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0271] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A privacy computing system, characterized in that: The system comprises: A first privacy computing device is configured to send an approval request for a target resource level of any service to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the service level that are located before the target resource level; The second privacy computing device is used to receive the approval request, and if the first authorization token is verified, generate a second authorization token corresponding to the target resource level of the business, and send the second authorization token to the first privacy computing device; The first privacy computing device is further configured to receive and save the second authorization token, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request; The second privacy computing device is used to receive the task execution request, and if the first privacy computing device is authenticated based on the second authorization token, execute the corresponding privacy computing task.

2. The system according to claim 1, characterized in that The second privacy computing device is specifically used for: If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

3. The system according to claim 2, characterized in that The failure condition includes at least one of the following: The first authorization token exceeds the valid usage period; The number of times the first authorization token is used reaches a set number threshold; Receiving an authorization cancellation instruction for the upper resource level of the service; An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

4. The system according to claim 3, characterized in that The second privacy computing device is specifically used for: For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

5. The system according to claim 2, characterized in that If the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the second privacy computing device is specifically used to: When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies a preset expiration condition; or, Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or, When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

6. The system according to claim 1, characterized in that The second privacy computing device is specifically used for: Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

7. The system according to claim 6, characterized in that The second privacy computing device is specifically used for: Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device; Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold; If so, determining that the approval request is valid; If not, it is determined that the approval request is invalid.

8. A privacy computing method, characterized in that: The method is applied to a second privacy computing device, and the method includes: Receiving an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level; If the first authorization token is verified, a second authorization token corresponding to the target resource level of the business is generated, and the second authorization token is sent to the first privacy computing device; Receive a task execution request sent by a first privacy computing device, wherein the task execution request carries the second authorization token; If the first privacy computing device is authenticated based on the second authorization token, the corresponding privacy computing task is executed.

9. The method according to claim 8, characterized in that The verification of the first authorization token is passed, including: If the first authorization token is a token generated by itself for the upper resource level of the target resource level of the business, determine whether the first authorization token meets the preset expiration condition; if not, verify that the first authorization token passes.

10. The method according to claim 9, characterized in that The failure condition includes at least one of the following: The first authorization token exceeds the valid usage period; The number of times the first authorization token is used reaches a set number threshold; Receiving an authorization cancellation instruction for the upper resource level of the service; An authorization cancellation instruction for any resource level before the previous resource level of the service is received.

11. The method according to claim 10, characterized in that Receiving authorization revocation instructions for any resource level includes: For the data resource layer in the resource layer of the business, when receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource layer, it is determined that the authorization cancellation instruction for the data resource layer has been received.

12. The method according to claim 9, characterized in that If the resource level corresponding to the first authorization token is a process resource level, and the previous resource level of the process resource level is a project resource level and a data resource level, the determining whether the first authorization token satisfies a preset expiration condition includes: When the authorization token corresponding to the project resource level satisfies a preset expiration condition, determining that the first authorization token corresponding to the process resource level satisfies a preset expiration condition; or, Upon receiving an authorization cancellation instruction for all data involved in executing the privacy computing task of the business in the data resource level, determining that the first authorization token corresponding to the process resource level meets a preset expiration condition; or When the authorization token corresponding to the project resource level does not meet the preset expiration condition and receives an authorization cancellation instruction for some data involved in executing the privacy computing task of the business in the data resource level, it is determined that the first authorization token corresponding to the process resource level does not meet the preset expiration condition.

13. The method according to claim 8, characterized in that After receiving the approval request for the target resource level of any business sent by the first privacy computing device and before generating the second authorization token corresponding to the target resource level of the business, the method further includes: Verify whether the approval request is valid. If so, generate a second authorization token corresponding to the target resource level of the business.

14. The method according to claim 13, characterized in that The verifying whether the approval request is valid includes: Identify the sending time of the approval request sent by the first privacy computing device carried by the first authorization token, and identify the receiving time of the approval request received by the second privacy computing device; Determine whether the interval between the receiving time and the sending time is less than a preset interval threshold; If so, determining that the approval request is valid; If not, it is determined that the approval request is invalid.

15. A privacy computing method, characterized in that: The method is applied to a first privacy computing device, and the method includes: Sending an approval request for a target resource level of any business to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level; Receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

16. A privacy computing device, characterized in that: The apparatus is applied to a second privacy computing device, and the apparatus includes: An approval module is configured to receive an approval request for a target resource level of any business sent by a first privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying information of resource levels of the business level that are located before the target resource level; An authorization module, configured to generate a second authorization token corresponding to a target resource level of the service if the first authorization token is verified, and send the second authorization token to the first privacy computing device; An execution module, configured to receive a task execution request sent by a first privacy computing device, wherein the task execution request carries the second authorization token; An authentication module is used to execute a corresponding privacy computing task if the first privacy computing device is authenticated based on the second authorization token.

17. A privacy computing device, characterized in that: The apparatus is applied to a first privacy computing device, and the apparatus includes: A first sending module is used to send an approval request for a target resource level of any service to a second privacy computing device, wherein the approval request carries a first authorization token received from the second privacy computing device, wherein the first authorization token is generated after verifying the information of each resource level of the service level before the target resource level; The second sending module is used to receive and save the second authorization token received from the second privacy computing device, and when sending a task execution request to the second privacy computing device, carry the second authorization token in the task execution request, wherein the second authorization token is a second authorization token corresponding to the target resource level of the business generated by the second privacy computing device when the first authorization token is verified.

18. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the privacy computing method described in any one of claims 8 to 14, or executes the steps of the privacy computing method described in any one of claim 15.

19. A computer-readable storage medium, characterized in that: It includes program code. When the storage medium runs on an electronic device, the program code is used to enable the electronic device to execute the steps of the privacy computing method described in any one of claims 8 to 14, or to execute the steps of the privacy computing method described in any one of claim 15.

Images