Node communication method and system without public network IP address

Abstract

The invention relates to a node communication method and system without a public network IP address, and the method comprises the steps: a second node receives active data packets sent by N first nodes according to a preset period through a heartbeat mechanism; if yes, establishing a long connection with the M first nodes and sending a corresponding homomorphic encryption scheme, a grade division rule and a Hash scheme to the M first nodes, encrypting local data by the M first nodes through the homomorphic encryption scheme to obtain M encrypted data, performing grade division on the local data through the grade division rule to obtain corresponding grades, hash calculation is carried out on the level through a Hash scheme, M first Hash values are obtained, nodes of the same level are obtained according to the M first Hash values, difference analysis is carried out according to encrypted data of the nodes of the same level, the second node is a node with a public network IP address, and the first node is a node without a public network IP address. Therefore, communication connection without public network IP address nodes is realized, and the security of data analysis is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a node communication method and system without a public network IP address. Background Art

[0002] In current node communications, only nodes that provide public IP addresses can establish connections, while nodes without public IP addresses cannot establish connections with other nodes to achieve data transmission. This affects the development of node communication, and when analyzing the data transmitted by the nodes, it is usually necessary to obtain the original data, which affects the security of the original data. Summary of the invention

[0003] The technical problem to be solved by the present invention is: the present invention provides a node communication method and system without a public IP address, which realizes the communication connection of nodes without a public IP address and improves the security of node data analysis.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0005] In a first aspect, the present invention provides a node communication method without a public IP address, comprising:

[0006] The second node determines whether it has received the activity data packets sent to the second node by the N first nodes respectively through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes respectively through the long connection. The second node is a node with a public IP address, and the first node is a node without a public IP address.

[0007] The M first nodes receive the homomorphic encryption scheme, the level division rule, and the hash scheme, encrypt the local data respectively by the homomorphic encryption scheme to obtain M encrypted data, divide the local data into levels by the level division rule to obtain corresponding levels, perform hash calculation on the levels by the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second node;

[0008] The second node receives M of the first hash values ​​and M of the encrypted data, and determines whether there is an identical first hash value among the M first hash values. If so, the first nodes with the identical first hash value are regarded as nodes of the same level, and a difference analysis is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain an analysis result.

[0009] The beneficial effects of the present invention are as follows: the first node, i.e., the node without a public IP address, sends an active data packet to the second node, i.e., the node with a public IP address, through a heartbeat mechanism according to a preset period, so as to establish a long connection between the first node and the second node, realize two-way communication, and solve the problem that the traditional node without a public IP address cannot establish a connection with other nodes to transmit data. Moreover, when performing difference analysis on the nodes, firstly, different-level nodes are screened out according to the first hash value, and then the difference analysis is performed according to the encrypted data of the different-level nodes. There is no need to perform difference analysis on all nodes, which reduces the amount of calculation and improves efficiency. Moreover, when performing difference analysis on the encrypted data of the different-level nodes, there is no need to decrypt the encrypted data, thereby ensuring the security of the original data.

[0010] Optionally, the M first nodes classify the local data according to the class classification rule respectively, and obtain corresponding classes including:

[0011] Obtaining field data corresponding to different fields in the local data, determining the level intervals to which the field data belongs according to the level division rule, taking the level interval as the first interval, respectively calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval;

[0012] A first level is obtained according to the first interval, and a second level is obtained according to the second interval.

[0013] According to the above description, when classifying local data, a multi-level system is adopted. The level intervals to which the field data corresponding to different fields in the local data belong are taken into consideration, and the relationship between the field data and the two adjacent level intervals of the level interval to which it belongs is also taken into consideration. The level classification is carried out in a multi-dimensional and fine-grained manner to improve the comprehensiveness and completeness of the level classification.

[0014] Optionally, the M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and sending the M first hash values ​​and the M encrypted data to the second nodes includes:

[0015] The M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and simultaneously perform hash calculation on the local data through the hash scheme to obtain M second hash values;

[0016] Sending M first hash values, M second hash values, and M encrypted data to the second node;

[0017] The second node performs a difference analysis on the nodes of the same level according to the encrypted data of the nodes of the same level, and obtains the analysis results including:

[0018] Obtain the second hash value corresponding to the node of the same level, and determine whether the second hash value is the same. If the second hash value is the same, the node of the same level is the same data node; if the second hash value is different, the node of the same level is the different data node.

[0019] According to the above description, when performing difference analysis on nodes of the same level, the same data nodes and different data nodes can be directly judged by whether the second hash values ​​of the nodes of the same level are the same. There is no need to decrypt the original data, and the second hash value is used for judgment, thereby improving the security of the original data.

[0020] Optionally, the nodes at the same level are different data nodes including:

[0021] The encrypted data corresponding to the different data node is obtained, an encryption difference value of the encrypted data is calculated, and it is determined whether the encryption difference value is lower than a second threshold value. If so, the different data node is a similar node.

[0022] According to the above description, similar nodes are determined by calculating the encryption difference of encrypted data of different data nodes, without the need to decrypt the encrypted data of different data nodes, thereby improving the security of original data.

[0023] Optionally, the second node performs difference analysis on the node at the same level based on the encrypted data of the node at the same level in a trusted execution environment.

[0024] According to the above description, the second node performs difference analysis on nodes of the same level in a trusted execution environment to ensure the security of the difference analysis.

[0025] In a second aspect, the present invention provides a node communication system without a public IP address, comprising:

[0026] The second node is used to determine whether it has received the activity data packets sent to the second node by N first nodes respectively through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes respectively through the long connection, the second node is a node with a public IP address, and the first node is a node without a public IP address; and receives M first hash values ​​and M encrypted data, and determines whether there is an identical first hash value in the M first hash values. If so, the first node with the identical first hash value is regarded as a node of the same level, and the difference analysis of the nodes of the same level is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain the analysis result;

[0027] M first nodes are used to receive the homomorphic encryption scheme, the level division rule and the hash scheme, encrypt local data through the homomorphic encryption scheme to obtain M encrypted data, divide the local data into levels through the level division rule to obtain corresponding levels, perform hash calculations on the levels through the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second nodes.

[0028] The beneficial effects of the present invention are as follows: the first node, i.e., the node without a public IP address, sends an active data packet to the second node, i.e., the node with a public IP address, through a heartbeat mechanism according to a preset period, so as to establish a long connection between the first node and the second node, realize two-way communication, and solve the problem that the traditional node without a public IP address cannot establish a connection with other nodes to transmit data. Moreover, when performing difference analysis on the nodes, firstly, different-level nodes are screened out according to the first hash value, and then the difference analysis is performed according to the encrypted data of the different-level nodes. There is no need to perform difference analysis on all nodes, which reduces the amount of calculation and improves efficiency. Moreover, when performing difference analysis on the encrypted data of the different-level nodes, there is no need to decrypt the encrypted data, thereby ensuring the security of the original data.

[0029] Optionally, the M first nodes are specifically:

[0030] Obtaining field data corresponding to different fields in the local data, determining the level intervals to which the field data belongs according to the level division rule, taking the level interval as the first interval, respectively calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval;

[0031] A first level is obtained according to the first interval, and a second level is obtained according to the second interval.

[0032] According to the above description, when classifying local data, a multi-level system is adopted. The level intervals to which the field data corresponding to different fields in the local data belong are taken into consideration, and the relationship between the field data and the two adjacent level intervals of the level interval to which it belongs is also taken into consideration. The level classification is carried out in a multi-dimensional and fine-grained manner to improve the comprehensiveness and completeness of the level classification.

[0033] Optionally, the M first nodes are specifically:

[0034] The M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and simultaneously perform hash calculation on the local data through the hash scheme to obtain M second hash values;

[0035] Sending M first hash values, M second hash values, and M encrypted data to the second node;

[0036] The second node is specifically:

[0037] Obtain the second hash value corresponding to the node of the same level, and determine whether the second hash value is the same. If the second hash value is the same, the node of the same level is the same data node; if the second hash value is different, the node of the same level is the different data node.

[0038] According to the above description, when performing difference analysis on nodes of the same level, the same data nodes and different data nodes can be directly judged by whether the second hash values ​​of the nodes of the same level are the same. There is no need to decrypt the original data, and the second hash value is used for judgment, thereby improving the security of the original data.

[0039] Optionally, the second node is specifically:

[0040] The encrypted data corresponding to the different data node is obtained, an encryption difference value of the encrypted data is calculated, and it is determined whether the encryption difference value is lower than a second threshold value. If so, the different data node is a similar node.

[0041] According to the above description, similar nodes are determined by calculating the encryption difference of encrypted data of different data nodes, without the need to decrypt the encrypted data of different data nodes, thereby improving the security of original data.

[0042] Optionally, the second node performs difference analysis on the node at the same level based on the encrypted data of the node at the same level in a trusted execution environment.

[0043] According to the above description, the second node performs difference analysis on nodes of the same level in a trusted execution environment to ensure the security of the difference analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 A flowchart of a node communication method without a public IP address provided in this embodiment;

[0045] Figure 2 A schematic diagram of the overall process of a node communication method without a public IP address provided in this embodiment;

[0046] Figure 3 A schematic diagram of the structure of a node communication system without a public IP address provided in this embodiment;

[0047] Figure 4 A flowchart of a hash scheme and hash value transmission between a first node and a second node involved in this embodiment;

[0048] Figure 5 This is a flow chart of data transmission between a first node and a second node involved in this embodiment.

[0049] [Description of Reference Numerals]

[0050] 1. A node communication system without a public IP address;

[0051] 2. Second node;

[0052] 3. The first node. DETAILED DESCRIPTION

[0053] In order to better understand the above technical solution, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer and more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0054] Embodiment 1

[0055] In this embodiment, in the privacy computing platform, only the Internet center and the public network zone center provide access IP addresses, while other nodes participating in privacy computing do not have public IP addresses. In this way, two-way communication is realized to meet network requests in the privacy computing process. Among them, the Internet center needs to provide public IP addresses to enterprise nodes and provide access addresses to the public network zone center. The public network zone center only needs to provide access addresses to municipal and county bureau nodes and Internet center nodes under the public network, and there is no need to expose the access addresses to enterprise nodes.

[0056] In the scenario of data development and utilization for enterprises, and when enterprises use government data for privacy computing, small and micro enterprises may not have public IP addresses. Enterprise nodes can access the Internet center without exposing public addresses, and join the privacy computing basic platform for privacy computing, which can lower the entry threshold of the platform and facilitate promotion.

[0057] Please refer to Figure 1 to Figure 2 The present invention provides a node communication method without a public IP address, comprising the steps of:

[0058] S1. The second node determines whether it has received the activity data packets sent to the second node by N first nodes respectively through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes respectively through the long connection. The second node is a node with a public IP address, and the first node is a node without a public IP address.

[0059] In this embodiment, the first node is a node without a public IP address, and the second node is a node with a public IP address. At the same time, the second node can be a node with a trusted execution environment, or a node that executes an algorithm for multi-party secure computing or performs homomorphic encryption computing. Network data transmission will only be performed during the execution of algorithm tasks. When there are no algorithm tasks, the network remains silent, but both parties are still required to remain connected. Since NAT and firewalls track the connection status, when one party is behind NAT or a firewall, it cannot be passively connected and can only actively connect to the communication party with a public IP. Therefore, if a party behind NAT or a firewall wants to receive incoming data packets, it must keep the connection session valid by regularly sending active data packets. The second node can connect to multiple first nodes and receive data from multiple first nodes. After that, the data of different first nodes can be securely calculated, such as performing privacy intersection or difference analysis on the data of multiple first nodes to determine whether they meet the requirements.

[0060] like Figure 2 As shown, the second node, that is, the node with a public IP address, determines whether it has received the activity data packets sent by N first nodes to the second node through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet, where M≤N, that is, the node without a public IP address sends an activity data packet to the node with a public IP address through the heartbeat mechanism according to the preset period to establish and maintain the connection between the two. The preset period is 25s, which can be adjusted according to actual conditions. The second node sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes through the established long connection, wherein the homomorphic encryption scheme includes a homomorphic encryption public key and an encrypted field corresponding to the homomorphic encryption public key, and the hash scheme includes a hash algorithm used when hashing the level, a hash algorithm used when hashing the local data, and a corresponding hash field, wherein the hash field includes but is not limited to: name, age, ID number, address, income, etc. The encryption field and the hash field can be the same or different, which can be adjusted according to actual conditions.

[0061] S2, M of the first nodes receive the homomorphic encryption scheme, the level division rule and the hash scheme, encrypt the local data by the homomorphic encryption scheme respectively to obtain M encrypted data, divide the local data into levels by the level division rule to obtain corresponding levels, perform hash calculation on the levels by the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second node;

[0062] In this embodiment, if Figure 2 As shown, the M first nodes correspond to the homomorphic encryption scheme, level division rule and hash scheme sent by the second node in the receiving step S1, encrypt the local data according to the homomorphic encryption public key in the homomorphic encryption scheme and the encryption field corresponding to the homomorphic encryption public key to obtain M encrypted data, divide the local data into levels according to the level division rule to obtain corresponding levels, hash the obtained levels according to the hash algorithm used in the hash scheme to hash the levels to obtain M first hash values, merge the M first hash values ​​and the M encrypted data and send them back to the second node.

[0063] At this time, the M first nodes in step S2 classify the local data according to the class classification rule, and the corresponding classes include:

[0064] S21, obtaining field data corresponding to different fields in the local data, determining the level interval to which the field data belongs according to the level division rule, taking the level interval as the first interval, calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval;

[0065] S22. Obtain a first level according to the first interval, and obtain a second level according to the second interval.

[0066] In this embodiment, if Figure 2As shown, the first node obtains the field data corresponding to different fields in the local data, and determines the level interval to which the field data belongs according to the level division rule. Before this, different levels and the level intervals corresponding to different levels are preset, such as: level a, corresponding level interval: (0,2]; level b, corresponding level interval: [2,4]; level c, corresponding level interval: [4,6), level d, corresponding level interval: [6,8), the specific data of field a is: 4.02, and the level interval to which it belongs is: [4,6), that is, the first interval is [4,6), according to the first interval The first level is obtained: c. The two adjacent level intervals of the first interval are: [2,4) and [6,8). The level difference between the field data: 4.02 and [2,4) is calculated: 4.02-4=0.02. The level difference between the field data: 4.02 and [6,8) is calculated: 6-4.02=1.98. It is judged whether the level difference is lower than the first threshold value, where the first threshold value is 0.05. If 0.02 is lower than 0.05, the second interval is obtained: [2,4). Therefore, the second level b is obtained according to the second interval. The first threshold value can be adjusted according to the actual situation.

[0067] At this time, the M first nodes in step S2 perform hash calculation on the levels through the hash scheme to obtain M first hash values, and sending the M first hash values ​​and the M encrypted data to the second nodes includes:

[0068] S23, the M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and at the same time perform hash calculation on the local data through the hash scheme to obtain M second hash values;

[0069] S24. Send the M first hash values, the M second hash values, and the M encrypted data to the second node.

[0070] In this embodiment, if Figure 2 As shown, the hash scheme includes a hash algorithm used when performing hash calculations on the levels and a hash algorithm used when performing hash calculations on local data and corresponding hash fields. The two algorithms may be consistent or inconsistent. The M first nodes perform hash calculations on the levels obtained in step S22 using the hash algorithm used when performing hash calculations on the levels to obtain M first hash values. At the same time, they perform hash calculations on the corresponding hash fields in the local data using the hash algorithm used when performing hash calculations on the local data to obtain M second hash values. The M first hash values, M second hash values ​​and M encrypted data are sent to the second node.

[0071] S3. The second node receives M first hash values ​​and M encrypted data, and determines whether there is an identical first hash value among the M first hash values. If so, the first nodes with the identical first hash value are regarded as nodes of the same level, and a difference analysis is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain an analysis result.

[0072] In this embodiment, if Figure 2 As shown, the second node receives the M first hash values ​​and M encrypted data sent in step S24, and first determines whether there is the same first hash value in the M first hash values. If so, it means that the first nodes with the same first hash values ​​are nodes of the same level, otherwise, the first nodes with different first hash values ​​are nodes of different levels, and the corresponding first nodes will be marked according to the obtained results: nodes of the same level and nodes of different levels, so as to facilitate subsequent data improvement and processing according to the marks. The nodes of the same level are differentially analyzed according to the encrypted data of the nodes of the same level to obtain the analysis results, wherein the second node performs differential analysis on the nodes of the same level according to the encrypted data of the nodes of the same level in a trusted execution environment.

[0073] At this time, in step S3, the second node performs a difference analysis on the nodes at the same level according to the encrypted data of the nodes at the same level, and the analysis results obtained include:

[0074] S31. Obtain the second hash values ​​corresponding to the nodes of the same level, and determine whether the second hash values ​​are the same. If they are the same, the nodes of the same level are nodes with the same data; if they are different, the nodes of the same level are nodes with different data.

[0075] At this time, the same-level nodes described in step S31 are different data nodes including:

[0076] S311. Obtain the encrypted data corresponding to the different data node, calculate the encryption difference of the encrypted data, and determine whether the encryption difference is lower than a second threshold. If so, the different data node is a similar node.

[0077] In this embodiment, if Figure 2As shown, when the second node performs difference analysis on the nodes of the same level according to the encrypted data of the nodes of the same level, it obtains the second hash value corresponding to the nodes of the same level and determines whether the second hash values ​​are the same. If they are the same, it means that they are nodes with the same data. Otherwise, if they are different, it means that they are nodes with different data. Similarity analysis will be performed on nodes with different data. By calculating the encrypted difference of the encrypted data corresponding to the nodes with different data, it is determined whether the encrypted difference is less than the second threshold. If so, the nodes with different data are similar nodes, and the corresponding first nodes will be marked according to the obtained results: nodes with the same data, nodes with different data, and similar nodes, so as to facilitate subsequent data improvement and processing according to the marks. For example, if the field data contained in two different first nodes are complementary, the field data of the first node can be identified according to the mark to form new and more complete data. The second threshold is 0.5, which can be adjusted according to actual conditions.

[0078] Embodiment 2

[0079] Please refer to Figure 3 The present invention provides a node communication system 1 without a public IP address, comprising: a second node 2 and a first node 3.

[0080] Among them, the second node 2 is used to determine whether the activity data packets sent to the second node by N first nodes respectively through the heartbeat mechanism according to the preset period are received. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes through the long connection, the second node is a node with a public IP address, and the first node is a node without a public IP address; and receives M first hash values ​​and M encrypted data, and determines whether there is an identical first hash value in the M first hash values. If so, the first node with the same first hash value is regarded as a node of the same level, and the difference analysis of the nodes of the same level is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain the analysis result;

[0081] M first nodes 3 are used to receive the homomorphic encryption scheme, the level division rule and the hash scheme, encrypt local data by the homomorphic encryption scheme to obtain M encrypted data, divide local data into levels by the level division rule to obtain corresponding levels, perform hash calculation on the levels by the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second node.

[0082] Specifically, the M first nodes 3 are:

[0083] Obtaining field data corresponding to different fields in the local data, determining the level intervals to which the field data belongs according to the level division rule, taking the level interval as the first interval, respectively calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval;

[0084] A first level is obtained according to the first interval, and a second level is obtained according to the second interval.

[0085] Specifically, the M first nodes 3 are:

[0086] The M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and simultaneously perform hash calculation on the local data through the hash scheme to obtain M second hash values;

[0087] Sending M first hash values, M second hash values, and M encrypted data to the second node;

[0088] The second node 2 is specifically:

[0089] Obtain the second hash value corresponding to the node of the same level, and determine whether the second hash value is the same. If the second hash value is the same, the node of the same level is the same data node; if the second hash value is different, the node of the same level is the different data node.

[0090] Specifically, the second node 2 is:

[0091] The encrypted data corresponding to the different data node is obtained, an encryption difference value of the encrypted data is calculated, and it is determined whether the encryption difference value is lower than a second threshold value. If so, the different data node is a similar node.

[0092] Specifically, the second node 2 performs difference analysis on the nodes at the same level according to the encrypted data of the nodes at the same level in a trusted execution environment.

[0093] Embodiment 3

[0094] Please refer to Figures 4 to 5In this embodiment, the first node is a node without a public IP address, and the second node is a node with a public IP address. At the same time, the second node can be a node with a trusted execution environment, or a node that executes an algorithm for multi-party secure computing or performs homomorphic encryption computing. Network data transmission is only performed during the execution of algorithm tasks. When there are no algorithm tasks, the network remains silent, but both parties are still required to remain connected. Since NAT and firewalls track the connection status, when one party is behind NAT or a firewall, it cannot be passively connected and can only actively connect to the communication party with a public IP. Therefore, if a party behind NAT or a firewall wants to receive incoming data packets, it must keep the connection session valid by regularly sending keep-alive data packets. The second node can connect to multiple first nodes and receive data from multiple first nodes. After that, secure computing can be performed on the data of different first nodes, such as performing privacy intersection or difference analysis on the data of multiple first nodes to determine whether they meet the requirements.

[0095] Network data transmission is performed only during the execution of algorithm tasks. When there are no algorithm tasks, the network remains silent, but both parties are still required to maintain a connection. Since NAT and firewalls track the connection status, when one party is behind a NAT or firewall, it cannot passively connect and can only actively connect to the communication party with a public IP. Therefore, if the party behind a NAT or firewall wants to receive incoming data packets, it must keep the connection session valid by regularly sending keep-alive packets.

[0096] After the system is deployed, through the heartbeat mechanism, the first node sends a keep-alive data packet to the server endpoint every 25 seconds to maintain a long connection between the first node and the second node, thus solving the one-way communication problem and realizing data transmission.

[0097] Based on this scheme, the second node in the present application can be connected to multiple first nodes and receive data from multiple first nodes, and then secure calculations can be performed on the data of different first nodes, such as performing privacy intersection on the data of multiple first nodes or analyzing whether the differences meet the requirements.

[0098] Specifically, the process of privacy intersection of multiple data, such as Figure 4 As shown:

[0099] 1. The second node can send the hash scheme to different first nodes. After receiving the hash scheme, the first node performs hash processing on all its own data, that is, local data, including data with multiple fields, such as name, age, ID number, address, income and other fields.

[0100] 2. After the first node obtains the hash value of all the data, it can be transmitted to the second node.

[0101] 3. The second node determines the same data of each first node based on whether the hash values ​​uploaded by different first nodes are the same, and marks them. The data can be improved based on the mark later. If the field contents of two different first nodes are partially complementary, the mark can be used to identify the data of each first node and form new and more complete data for subsequent calculations.

[0102] The process of finding intersections on one part of the multi-party data and analyzing similarities on the other part: Figure 5 As shown, for example, the two first nodes each have five identical fields, such as fields 1, 2, 3, 4, and 5.

[0103] 1. The second node generates the hash scheme and the public and private keys of homomorphic encryption;

[0104] 2. The second node sends the hash scheme and the field corresponding to the hash scheme (such as 123); the homomorphically encrypted public key and the field corresponding to the public key (such as 45) to the first node;

[0105] 3. The first node hashes the corresponding field according to the hash scheme to obtain hash value 1, and encrypts the corresponding field according to the public key to obtain encrypted data 2 (the public key is used to encrypt field 4 and field 5 respectively, that is, encrypted data 2 includes two encrypted data); then, the first node merges hash value 1 and encrypted data 2 and sends them to the second node.

[0106] 4. After the second node receives the data sent by the first node, it can split out the hash value 1 and the encrypted data 2. For the hash value 1, the hash value can be analyzed to determine whether the original data is the same. For the encrypted data 2, the encrypted data corresponding to each field can be split out, and then the data difference of different first nodes can be analyzed in the encrypted state to determine whether it is within the preset range. Specifically, the second node can obtain the encrypted data a and b of the corresponding fields 4 of the two first nodes, and then calculate ab in the encrypted state, and subtract the result of ab from the threshold c. Afterwards, decrypt with the private key stored in the second node, judge whether the final decryption result is greater than zero or less than 0, and determine whether the difference of the original data is within the preset range.

[0107] 5. The second node determines whether the difference between the original data of the two first nodes meets the requirements based on the analysis result of whether the matching result of hash value 1 and the difference of encrypted data 2 are within a preset range, so as to facilitate subsequent processing.

[0108] The process of privacy intersection of multiple data is to first analyze whether the data of different nodes are consistent. If they are consistent, similarity analysis can be omitted for this part of data. If they are inconsistent, similarity analysis can be performed on the inconsistent part of data.

[0109] In addition, in this solution, the second node can also receive the plaintext data of the same field of the first node, such as the part with low data security requirements, to analyze the data differences.

[0110] In addition, the two second nodes can be connected to the two first nodes at the same time, so that the homomorphically encrypted data can be transmitted separately to two different first nodes to prevent collusion. The encrypted data of different fields can be homomorphically encrypted and analyzed at the two first nodes respectively, and then the analysis results are merged to determine the final similar analysis results.

[0111] In addition, the data processing process of the second node can run in a trusted execution environment, and the operation process in the trusted execution environment can be managed, thereby ensuring that when the second node uses the private key, it decrypts the calculation result (the result after subtracting the threshold) instead of decrypting the original data.

[0112] In addition, the data of the same field of the two first nodes can be first divided into corresponding levels. For example, if the two data are 13.26 and 13.15 (or 13.26 and 15.86), the second node can send the level division rules to the first node, and the two data can be first divided into corresponding levels. For example, the data in the interval 1-2 is one level, and the two data belong to the level f corresponding to the interval 13-14. Afterwards, f can be hashed and uploaded to the trusted execution environment of the second node. The second node matches the hash value of f in the trusted execution environment to determine whether the two data belong to the same level. If so, the above-mentioned similarity analysis can be performed on the data belonging to the same level later. If they do not belong to the same level, it is determined that the difference between the two data is too large and they are not similar. Among them, if the data of the first node is close to one side of the interval, the data can be divided into two levels, and the two levels are hashed and uploaded to the second node respectively. The second node matches according to the two hash values ​​of the same data. For example, if the data of the first node m is 13.02, it can be divided into level d of 12-13 and level f of 13-14. The data of the second node n is 12.95, which can be divided into level d of 12-13 and level f of 13-14, so as to be uploaded to the second node for matching.

[0113] Since the system / device described in the above embodiments of the present invention is a system / device used to implement the method of the above embodiments of the present invention, a person skilled in the art can understand the specific structure and deformation of the system / device based on the method described in the above embodiments of the present invention, and thus will not be described in detail here. All systems / devices used in the method of the above embodiments of the present invention belong to the scope of protection of the present invention.

[0114] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions.

[0116] It should be noted that in the claims, any reference numerals placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention may be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In the claims enumerating several means, several of these means may be embodied by the same hardware. The use of the words first, second, third, etc., is for convenience of expression only and does not indicate any order. These words may be understood as part of the component name.

[0117] In addition, it should be noted that, in the description of this specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0118] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments after knowing the basic creative concept. Therefore, the claims should be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

[0119] Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention should also include these modifications and variations.

Claims

1. A node communication method without a public IP address, characterized in that: include: The second node determines whether it has received the activity data packets sent to the second node by the N first nodes respectively through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes respectively through the long connection. The second node is a node with a public IP address, and the first node is a node without a public IP address. The M first nodes receive the homomorphic encryption scheme, the level division rule, and the hash scheme, encrypt the local data respectively by the homomorphic encryption scheme to obtain M encrypted data, divide the local data into levels by the level division rule to obtain corresponding levels, perform hash calculation on the levels by the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second node; The second node receives M of the first hash values ​​and M of the encrypted data, and determines whether there is an identical first hash value among the M first hash values. If so, the first nodes with the identical first hash value are regarded as nodes of the same level, and a difference analysis is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain an analysis result.

2. A node communication method without a public IP address as claimed in claim 1, characterized in that: The M first nodes classify the local data according to the class classification rule, and obtain corresponding classes including: Obtaining field data corresponding to different fields in the local data, determining the level intervals to which the field data belongs according to the level division rule, taking the level interval as the first interval, respectively calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval; A first level is obtained according to the first interval, and a second level is obtained according to the second interval.

3. A node communication method without a public IP address as claimed in claim 1, characterized in that: The M first nodes perform hash calculation on the levels by using the hash scheme to obtain M first hash values, and sending the M first hash values ​​and the M encrypted data to the second nodes includes: The M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and simultaneously perform hash calculation on the local data through the hash scheme to obtain M second hash values; Sending M first hash values, M second hash values, and M encrypted data to the second node; The second node performs a difference analysis on the nodes of the same level according to the encrypted data of the nodes of the same level, and obtains the analysis results including: Obtain the second hash value corresponding to the node of the same level, and determine whether the second hash value is the same. If the second hash value is the same, the node of the same level is the same data node; if the second hash value is different, the node of the same level is the different data node.

4. A node communication method without a public IP address as claimed in claim 3, characterized in that: The nodes of the same level are different data nodes including: The encrypted data corresponding to the different data node is obtained, an encryption difference value of the encrypted data is calculated, and it is determined whether the encryption difference value is lower than a second threshold value. If so, the different data node is a similar node.

5. A node communication method without a public IP address as claimed in claim 1, characterized in that: The second node performs difference analysis on the node at the same level according to the encrypted data of the node at the same level in a trusted execution environment.

6. A node communication system without a public IP address, characterized in that: include: The second node is used to determine whether it has received the activity data packets sent to the second node by N first nodes respectively through the heartbeat mechanism according to the preset period. If received, the second node establishes a long connection with the M first nodes corresponding to the activity data packet and sends the corresponding homomorphic encryption scheme, level division rule and hash scheme to the M first nodes respectively through the long connection, the second node is a node with a public IP address, and the first node is a node without a public IP address; and receives M first hash values ​​and M encrypted data, and determines whether there is an identical first hash value in the M first hash values. If so, the first node with the identical first hash value is regarded as a node of the same level, and the difference analysis of the nodes of the same level is performed on the nodes of the same level according to the encrypted data of the nodes of the same level to obtain the analysis result; M first nodes are used to receive the homomorphic encryption scheme, the level division rule and the hash scheme, encrypt local data through the homomorphic encryption scheme to obtain M encrypted data, divide the local data into levels through the level division rule to obtain corresponding levels, perform hash calculations on the levels through the hash scheme to obtain M first hash values, and send the M first hash values ​​and the M encrypted data to the second nodes.

7. A node communication system without a public IP address as claimed in claim 6, characterized in that: The M first nodes are specifically: Obtaining field data corresponding to different fields in the local data, determining the level intervals to which the field data belongs according to the level division rule, taking the level interval as the first interval, respectively calculating the level difference between the field data and two adjacent level intervals of the first interval, determining whether the level difference is lower than a first threshold, and if so, taking the level interval corresponding to the level difference lower than the first threshold as the second interval; A first level is obtained according to the first interval, and a second level is obtained according to the second interval.

8. A node communication system without a public IP address as claimed in claim 6, characterized in that: The M first nodes are specifically: The M first nodes perform hash calculation on the levels through the hash scheme to obtain M first hash values, and simultaneously perform hash calculation on the local data through the hash scheme to obtain M second hash values; Sending M first hash values, M second hash values, and M encrypted data to the second node; The second node is specifically: Obtain the second hash value corresponding to the node of the same level, and determine whether the second hash value is the same. If the second hash value is the same, the node of the same level is the same data node; if the second hash value is different, the node of the same level is the different data node.

9. A node communication system without a public IP address as claimed in claim 8, characterized in that: The second node is specifically: The encrypted data corresponding to the different data node is obtained, an encryption difference value of the encrypted data is calculated, and it is determined whether the encryption difference value is lower than a second threshold value. If so, the different data node is a similar node.

10. A node communication system without a public IP address as claimed in claim 6, characterized in that: The second node performs difference analysis on the node at the same level according to the encrypted data of the node at the same level in a trusted execution environment.

Images