Data processing method, verification method and aggregation server

Abstract

The invention provides a data processing method, a verification method and an aggregation server, the aggregation server obtains ciphertext data and public keys provided by a plurality of clients, the ciphertext data is data obtained after each client encrypts respective user data based on own private keys, and the plurality of clients are from the same device group; and the aggregation server calculates a first round public key of the current round based on respective public keys provided by the plurality of clients, and decrypts the ciphertext data based on the first round public key and a first round private key corresponding to the device group to obtain first user portrait data of the device group in the current round.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a data processing method, a verification method, and an aggregation server. Background Art

[0002] At present, in various application scenarios that require the protection of private data, such as federated learning, distributed computing, and data statistical analysis, secure aggregation protocols are usually used to encrypt and anonymize data, enabling effective data analysis and calculation while protecting data privacy and preventing data leakage and tampering.

[0003] However, the current security aggregation protocol is designed from the perspective of avoiding the leakage of private data. It requires multiple clients participating in security aggregation to frequently conduct many-to-many communications, resulting in high power consumption of the electronic devices where the clients are located, seriously affecting the performance of the electronic devices. Summary of the Invention

[0004] In view of the above problems, this application discloses the following technical solutions:

[0005] The first aspect of the present application provides a data processing method, comprising:

[0006] Obtaining ciphertext data and public keys provided by multiple clients, wherein the ciphertext data is data obtained by encrypting respective user data of each client using its own private key, and the multiple clients are from the same device group;

[0007] Calculating a first-round public key for this round based on the public keys provided by the multiple clients;

[0008] The ciphertext data is decrypted based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

[0009] In one possible implementation, decrypting the ciphertext data based on the first-round public key and the first-round private key corresponding to the device group includes at least one of the following:

[0010] Securely aggregating the ciphertext data provided by the multiple clients to obtain target ciphertext data for this round, and decrypting the target ciphertext data for this round based on the first round public key and the first round private key corresponding to the device group to obtain first user profile data of the device group in this round;

[0011] Based on the first-round public key and the first-round private key corresponding to the device group, the ciphertext data provided by the multiple clients are decrypted respectively, and the decrypted plaintext data are securely aggregated to obtain the first user portrait data of the device group in this round.

[0012] In one possible implementation, at least one of the following is further included:

[0013] Publicizing a first portion of the ciphertext data provided by the client to a target audit server, so that the client can verify the credibility of the aggregation server providing the aggregation service based on the first portion of the ciphertext data stored on the target audit server;

[0014] Calculate the hash value of the first part of the ciphertext data in the current round and the hash value of the first part of the ciphertext data in the previous round to obtain a chain hash value, and publish the chain hash value to the target audit server.

[0015] In a possible implementation, the method further includes:

[0016] Calculate the product of the first part of the ciphertext data provided by multiple clients in this round to obtain the first target data;

[0017] Feedback the first target data to the multiple clients, so that each client obtains its own corresponding encrypted ciphertext data based on the first target data, wherein the encrypted ciphertext data can be used to determine the status information of the client.

[0018] In one possible implementation, decrypting the ciphertext data based on the first-round public key and the first-round private key corresponding to the device group includes:

[0019] Determining the client's status information based on the encrypted ciphertext data fed back by the client;

[0020] Determining a first portion of ciphertext data and a second portion of ciphertext data to be decrypted based on the state information;

[0021] Based on the status information, updating the first-round public key and the first-round private key corresponding to the device group;

[0022] Decrypting the first portion of ciphertext data and the second portion of ciphertext data to be decrypted based on the updated first-round private key and the first-round public key to obtain plaintext data corresponding to each online client;

[0023] The plaintext data corresponding to each online client is securely aggregated to obtain the first user portrait data of the device group in this round.

[0024] In a possible implementation, the method further includes:

[0025] Obtaining second user portrait data of the device group in a second round and / or third user portrait data in a third round, where the second round and the third round are rounds before or after the current round;

[0026] The second user portrait data and / or the third user portrait data and the first user portrait data are aggregated to obtain target user portrait data of the device group.

[0027] In a possible implementation, the method further includes:

[0028] The target client in the device group obtains the ciphertext data to be audited in the target audit server and the first client ciphertext data fed back by the first part of the clients in the device group, so that the target client verifies the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the first client ciphertext data.

[0029] In a possible implementation, the target client verifies the credibility of the aggregation server based on the ciphertext data to be audited and the ciphertext data of the first client, including at least one of the following:

[0030] The target client performs a consistency comparison on the ciphertext data to be audited and the ciphertext data of the first client, so as to determine the credibility of the aggregation server based on the obtained consistency comparison result;

[0031] The target client obtains second client ciphertext data of a second part of clients in the device group, calculates a client hash value of the client ciphertext data of this round based on the first client ciphertext data and the second client ciphertext data, and compares and verifies the client hash value to determine the credibility of the aggregation server;

[0032] The target client calculates the second target data of this round based on the client ciphertext data, and performs equivalence verification on the first target data obtained by multiplying the second target data and the first part of the ciphertext data in the ciphertext data provided by multiple clients in this round calculated by the aggregation server to determine the credibility of the aggregation server.

[0033] The second aspect of the present application further provides a verification method, comprising:

[0034] The target client obtains first-client ciphertext data fed back by the first-part clients; the first-part clients and the target client are from the same device group, and the first-client ciphertext data is data obtained by encrypting respective user data of the first-part clients using their own private keys;

[0035] The target client obtains the ciphertext data to be audited corresponding to the first part of the clients from the target audit server;

[0036] The target client verifies the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the ciphertext data of the first client.

[0037] A third aspect of the present application further provides an aggregation server, comprising: at least one communication element, at least one memory, and at least one processor, wherein:

[0038] The communication component is configured to obtain ciphertext data and public keys provided by multiple clients, wherein the ciphertext data is data obtained by encrypting user data of each client using its own private key, and the multiple clients are from the same device group;

[0039] The memory is used to store a plurality of computer instructions;

[0040] The processor is configured to load and execute the computer instructions to implement the following steps:

[0041] Calculating a first-round public key for this round based on the public keys provided by the multiple clients;

[0042] The ciphertext data is decrypted based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale.

[0044] Figure 1 A flowchart of the data processing method provided in Example 1 of the present application;

[0045] Figure 2 A flowchart of the data processing method provided in Example 2 of the present application;

[0046] Figure 3 A schematic diagram of an application scenario of the data processing method provided in an embodiment of the present application;

[0047] Figure 4 A flowchart of the data processing method provided in Example 3 of the present application;

[0048] Figure 5 A flowchart of the data processing method provided in Example 4 of the present application;

[0049] Figure 6 This is a flowchart of the verification method proposed in Example 1 of this application;

[0050] Figure 7 This is a flow chart of the verification method proposed in Example 2 of this application;

[0051] Figure 8 A schematic diagram of the structure of a data processing device proposed in an embodiment of the present application;

[0052] Figure 9 A schematic diagram of the structure of the verification device proposed in an embodiment of the present application;

[0053] Figure 10 A schematic diagram of the hardware structure of an aggregation server proposed in an embodiment of the present application. DETAILED DESCRIPTION

[0054] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation methods section of this application are only used to explain the specific embodiments of the present application and are not intended to limit this application. The embodiments of the present application are described below in conjunction with the drawings. It is known to those skilled in the art that with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0055] The terms "first", "second" etc. in the present application and in the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, and this is merely a way of distinguishing the objects of the same attributes when describing them in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0056] To address the above issues, the present application provides a data processing method and verification method. It proposes implementing communication between different clients in a business scenario through an aggregation server, transferring the communication between different clients to the protocol trusted certification process. This avoids frequent many-to-many communication between different clients during the security aggregation process, which adversely affects the performance and power consumption of the end-side device. The data processing method and verification method of the present application are described in detail below with reference to the accompanying drawings.

[0057] Reference Figure 1 , which is a flow chart of the data processing method provided in the first embodiment of the present application. The data processing method can be applied to the aggregation server, which can be one or more physical servers. The present application does not limit the deployment environment of the aggregation server, which can be determined according to the situation. Based on this, Figure 1 As shown, the data processing method provided in the embodiment of the present application may include but is not limited to the following steps:

[0058] Step S11, obtaining ciphertext data and public keys provided by multiple clients; the ciphertext data is data obtained by each client encrypting its own user data based on its own private key, and the multiple clients are from the same device group;

[0059] In this application, the aggregation server can group the clients used by each user participating in the security aggregation of the application scenario according to the actual requirements of the application scenario to obtain at least one device group, and each device group can include multiple clients.

[0060] The client can be a terminal device used by the corresponding user to implement the service, such as a smartphone, laptop, wearable device, in-vehicle device, augmented reality (AR) / virtual reality (VR) device, desktop computer, or smart medical device. Of course, in some security aggregation application scenarios, the client can also include an application (i.e., software) installed on the terminal device, or the terminal device and software can work together to ensure data security and privacy protection. This application does not limit the product form of the client, which can be determined according to the situation.

[0061] For example, in various application scenarios based on federated learning (a distributed machine learning technology) (such as healthcare, financial services, smart homes or traffic management), without sharing the original data, multiple terminal devices (such as multiple institutional devices participating in disease analysis; those involved in financial business such as financial institutions, operators, fiscal institutions and insurance institutions; multiple smart home devices in the same spatial environment; traffic management equipment in various cities, etc.) that jointly participate in the training of a machine learning model (such as a disease prediction model, a credit scoring model, a smart device control model or a traffic flow prediction model, etc.) are divided into a device group, so as to combine the data processing method proposed in this application to improve the model accuracy while ensuring data privacy.

[0062] In the application scenario of an enterprise-level security management system, the various client software deployed on the enterprise terminal can be divided into a device group to achieve terminal security protection and data aggregation; or in a multi-party online chat scenario (such as online meetings / teaching, etc.), the corresponding chat software is configured with a security aggregation function. For all users who use terminal devices to log in to the chat software, the clients of each user in the same chat room can be divided into a device group, etc. This application does not limit the implementation method of grouping a large number of clients of different product forms.

[0063] In one possible implementation, during the process of acquiring device groups, the clients used by all users participating in security aggregation can be divided into different device groups based on the business type and requirements for implementing the security aggregation function, such as user age, gender, region or other classification attributes, or even by random grouping.

[0064] To distinguish different device groups, a one-to-one corresponding group identifier, such as a group number or address, can be configured for each device group, and the group identifier can be recorded in each client included in the corresponding device group so that each client knows which device group it belongs to. Of course, to distinguish different clients, each client can be configured with a one-to-one corresponding client identifier, such as a client account, address ID, unique device identifier or number, etc. This application does not limit the content of the group identifier and client identifier.

[0065] In any of the application scenarios listed above, each client participating in security aggregation will record its own user data, namely, usage data of the user using the client, such as browsing history, purchase transaction records, travel logs, work logs, application usage data, hardware resource utilization data, etc. This data can be determined based on the client's usage in the actual application scenario and the security aggregation requirements. It should be understood that the user data of the same client in different application scenarios may be different, and the user data of different clients in the same application scenario may also be different. This application does not limit the content of the user data of each client or the method of obtaining it.

[0066] To improve data security, each client's own user data must first be encrypted and converted into ciphertext data. To this end, this application proposes that the client generate its own key pair, namely, a private key and a public key, based on, for example, the Elgamal algorithm (an asymmetric encryption algorithm based on the discrete logarithm problem) or other asymmetric encryption algorithms (such as the RSA algorithm, the ECDSA (Elliptic Curve Digital Signature Algorithm) algorithm, and the Diffie-Hellman algorithm). It should be noted that in addition to generating each client's private key based on these asymmetric encryption algorithms, it can also be generated based on random number calculations, such as using a cryptographically secure pseudo-random number generator to generate each client's own private key and calculate the associated public key. Alternatively, it can be generated programmatically using specific tools or commands (such as the openssl command, gpg command, or ssh-keygen command). According to actual needs, in the process of generating the private key of each client itself, one or more data such as the client's device information, user data, related environmental data, etc. can also be combined to generate the private key. This application does not limit the method of generating the private key of each client itself and its associated public key. The key pairs of different clients can be generated in the same or different ways, and this application does not impose any restrictions.

[0067] In this way, after the aggregation server initiates an aggregation request for multiple clients included in any device group, each client belonging to the device group obtains its own private key and the associated public key, and can encrypt the client's own user data based on the private key and the client's own ciphertext data. After that, each client can feed back its own ciphertext data, public key, client ID, group ID of the device group it belongs to, and other business data to the aggregation server to execute subsequent processing steps.

[0068] In the various federated learning application scenarios listed above, the jointly trained machine learning model usually requires multiple rounds of training to complete. When the aggregation server initiates an aggregation request for the training business of the machine learning model, it can configure the group identifier of the device group used to jointly train the machine learning model and the round number identifier of the machine learning model training in this round in the aggregation request (which can be continuously updated as the number of training rounds increases at any time). In this case, each client belonging to the device group can feedback its own ciphertext data, public key, client identifier, and the group identifier and round number identifier to the aggregation server according to the method described above, so that the aggregation server can distinguish the ciphertext data and public key data fed back by different clients in different rounds and obtain the ciphertext data aggregated in this round. This application does not limit the content of the tuple data fed back by the client and its data structure / representation form.

[0069] Step S12: Calculate the first round public key of this round based on the public keys provided by the multiple clients;

[0070] Step S13: decrypt the ciphertext data based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

[0071] Following the above analysis, after the aggregation server receives the ciphertext data and public keys provided by multiple clients participating in this round of aggregation, since the aggregation server cannot know the private keys of each client, in order to solve the ciphertext data provided by these multiple clients, this application will combine the encryption method of the ciphertext data and analyze the calculation relationship between the public keys, ciphertext data and their respective private keys provided by multiple clients to realize the decryption of the ciphertext data.

[0072] Thus, based on the calculation relationship derived from the above analysis, the public keys provided by each client participating in this round of aggregation can be calculated to obtain the public key corresponding to the device group in this round, recorded as the first-round public key. Subsequently, based on the ciphertext data provided by multiple clients in the device group, the first-round private key corresponding to the device group can be obtained. This can represent the data obtained by using the private keys of each of these multiple clients according to a certain calculation relationship. Subsequently, the ciphertext data obtained by aggregating the ciphertext data provided by multiple clients can be decrypted based on the first-round public key and the first-round private key, combining the encryption methods obtained for the ciphertext data provided by each client. This can yield user data for each client in the device group requested for this aggregation. Consequently, based on the user data of each client in the device group, group user profile data for the device group can be determined, i.e., user profile data for the device group in this round for these multiple clients (this can be recorded as first user profile data to distinguish it from user profile data from other rounds).

[0073] For example, in the application scenario based on federated learning as exemplified above, the aggregation server decrypts the ciphertext data provided by multiple clients participating in the current round of training of the machine learning model according to the method described above. The updated parameters of the training model provided by each client itself after decryption can be used to determine the model parameters and performance of the machine learning model after the device group executes this round of training.

[0074] In summary, in the embodiment of the present application, each client corresponding to the same device group participating in this round of aggregation can encrypt their own user data based on their own private key to obtain ciphertext data. After that, each client only needs to send their own ciphertext data and public key to the aggregation server. After the aggregation server successfully obtains the ciphertext data and public keys provided by multiple clients of the same device group, it calculates the first round public key of this round based on these public keys, that is, the public key for the ciphertext data after aggregation in this round. Combined with the first round private key corresponding to the device group, that is, the private key for the ciphertext data after aggregation in this round, the ciphertext data obtained in this round can be reliably decrypted to obtain the first user portrait data of the device group in this round. It can be seen that during the entire data processing process, the client and the aggregation server use ciphertext data for transmission, and the aggregation server cannot know the private key of each client, thereby avoiding the leakage of private data. Moreover, there is no need for multiple clients in the device group to directly interact with the plaintext data to be aggregated (i.e., their respective user data) through many-to-many communication to jointly complete data processing and aggregation. This solves the serious impact of frequent interactions between multiple clients on the performance and power consumption of the end-side devices, realizes lightweight processing of secure aggregation, avoids the adverse impact of the data processing process on client performance, and reduces client power consumption.

[0075] Reference Figure 2 , is a flow chart of the data processing method provided in the second embodiment of the present application. This embodiment can describe an optional implementation method of how to decrypt the ciphertext data in the data processing method described in the above embodiment, such as Figure 2 As shown, the data processing method proposed in this embodiment may include:

[0076] Step S21, obtaining ciphertext data and public keys provided by multiple clients; the ciphertext data is data obtained by each client encrypting its own user data based on its own private key, and the multiple clients are from the same device group;

[0077] Combined with the description of the corresponding part of the above embodiment, in some embodiments, after determining each device group and each client contained therein, the aggregation server initiates the current round of aggregation request for any device group. If the group identifier of the device group is represented as Groupid, and the round identifier of the current round of aggregation is represented as Iterationid, the aggregation request may include (Groupid, Iterationid). After each client receives the aggregation request, it can compare the recorded group identifier of the device group to which it belongs with the device identifier in the aggregation request. If they are the same, it means that the client participates in the current round of aggregation of the aggregation request; if they are different, it means that the client does not participate in the current round of aggregation of the aggregation request, but may participate in the current round of aggregation of other aggregation requests. It can be seen that the aggregation server can initiate multiple aggregation requests at the same time or at different times. The group identifiers contained in different aggregation requests can be different, and the round identifiers contained can be the same or different. The client's processing process for each aggregation request is similar, and this application does not give detailed examples one by one.

[0078] Taking the processing process after any aggregation request initiated by the aggregation server as an example, after the group identifier comparison described above, for each of the multiple clients corresponding to the group identifier contained in the aggregation request, this application uses the Elgamal algorithm to obtain the private key of each client and calculate the corresponding public key to encrypt the user data of the corresponding client itself and obtain the ciphertext data as an example to illustrate the implementation method.

[0079] For a device group containing N clients in this request aggregation, assume that the private key of the i-th client in the device group is represented by x i , whose public key is denoted as y i , whose client identifier is represented by Clientid i , the user data, i.e. the plaintext data to be aggregated, can be expressed as M i , using Elgamal algorithm to calculate M i The encrypted ciphertext data can be expressed as E(M i ), and E(M i )=( α i ,β i ). It can be seen that the encryption algorithm is used to encrypt a plaintext data to obtain two ciphertext data, namely α i and β i It is understandable that if other encryption algorithms are used to encrypt the plaintext data, the amount and content of the obtained ciphertext data may change accordingly, and this application will not give detailed examples one by one here.

[0080] Among them, in the process of generating the key pair for each client based on the Elgamal algorithm, a large prime number p and a primitive element g of this prime number p (i.e., the generator, which is an integer) can be selected. An integer a is randomly selected (the selected a needs to satisfy the condition 1 < a < (p - 1)), and this integer a can be used as the private key x of the client. After that, the corresponding public key y can be calculated, that is, (p, g, A), where A = g a mod p, and mod represents the modulo operation, that is, the remainder operation. In this way, the private key x of the i-th client can be calculated i and the public key y i .

[0081] In the process of the i-th client encrypting its own user data M i using its own private key, the client can randomly select an integer k (the selected k needs to satisfy the condition 1 < k < (p - 1), where p is the prime number selected in the process of generating the private key of this client), and two ciphertexts α i and β i of the Elgamal algorithm can be calculated. α i = g k mod p, and β i = M i ×A k mod p, where A = g a mod p, and mod represents the modulo operation, and p represents the prime number p selected in the process of generating the private key x of the i-th client i The i-th client can form a six-tuple data with the encrypted ciphertext data (α i , β i ), the corresponding public key y i , the Groupid and Iterationid included in the aggregated request of this response, that is, (Groupid, Iterationid, Clientid, y i , α i , β i ), and send it to the aggregation server so that the aggregation server can obtain the ciphertext data and public keys provided by each client

[0082] ​​It should be understood that in the process of determining device groups based on different grouping attributes, the same client may be divided into different device groups to implement data processing in different application scenarios. In this case, the same client may respond to multiple aggregation requests to encrypt user data in corresponding application scenarios respectively, combine the obtained ciphertext data and public key with data such as the group identifier and round identifier in the corresponding aggregation request, and feedback to the aggregation server. In other words, the same client can respond to different aggregation requests at the same time / round and send multi-tuple data with different contents to the aggregation server. The implementation process is similar to the above example, and this application does not provide detailed examples one by one.

[0083] In addition, it should be noted that the client uses other encryption algorithms to encrypt its own user data. The encrypted data obtained can also be sent to the aggregation server together with the public key, group identifier and client identifier as described above, so that the aggregation server can be the key data provided by each client in a device group requesting aggregation or decrypt it and then securely aggregate it to obtain user portrait data of the device group.

[0084] Step S22: Calculate the first round public key of this round based on the public keys provided by the multiple clients;

[0085] Step S23: securely aggregate the ciphertext data provided by the multiple clients to obtain the target ciphertext data of this round;

[0086] Step S24: decrypt the target ciphertext data of this round based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

[0087] In one possible implementation, if the ciphertext data provided by the client is based on the Elgamal algorithm, if the private key x is known i , for the ciphertext data E(M i ) to decrypt, we can follow Mi=β i / α i xi This is achieved by mod p. The aggregation server does not know the private key x of each client. i In this case, if the embodiment of the present application securely aggregates the ciphertext data of each client before performing a decryption operation, the public key of each client can be processed to obtain the public key for the ciphertext data after secure aggregation in this round, which is recorded as the first-round public key and used in subsequent decryption operations. This application does not limit the calculation implementation method of the first-round public key.

[0088] For the ciphertext data provided by each client of the same device group, it can be securely aggregated first to obtain the target ciphertext data of this round, that is, the ciphertext data after secure aggregation, and then the target ciphertext data can be decrypted based on the first round public key and the first round private key of this round to securely and reliably obtain the user data of each client of the device group, thereby determining the group user portrait data of the device group in this round, which is recorded as the first user portrait data.

[0089] In one possible implementation, the public keys of the clients in the same device group can be multiplied to obtain the first round public key, that is, Y=∏y i In the process of securely aggregating the ciphertext data provided by each client, the E(M i ), i=1, 2, ..., N, perform a product operation to obtain the target ciphertext data of the device group, and then refer to the decryption method of the Elgamal algorithm to decrypt the target ciphertext data based on the first-round public key and the first-round private key corresponding to the device group to obtain the group portrait data of the device group in this round, that is, the first user portrait data.

[0090] The first-round private key for the device group in this round can be obtained based on ciphertext data provided by each client in the device group and data obtained by each client processing at least a portion of the ciphertext data using its own private key. Alternatively, each client in the device group can calculate the private key based on its own private key and then send it to the aggregation server, thereby avoiding the need for the client to directly send its own private key to the aggregation server. This application does not limit the method for obtaining the first-round private key.

[0091] It can be seen that in an embodiment of the present application, when it is necessary to securely aggregate user data of multiple clients of the same device group, in order to avoid frequent many-to-many communications between these multiple clients and the leakage of user data during transmission, and to improve the security of user data, this embodiment proposes that these multiple clients encrypt their respective user data based on their own private keys to obtain ciphertext data, and then send it to the aggregation server in combination with their respective public keys and other information. Direct interaction between clients is no longer required to achieve secure aggregation. Instead, the aggregation server securely aggregates the ciphertext data provided by these multiple clients, and after obtaining the target ciphertext data of this round, it successfully decrypts the target ciphertext data based on the first round public key and the first round private key corresponding to the device group in this round, and securely and reliably obtains the first user portrait data of the device group in this round, thereby solving the performance and power consumption losses caused by frequent communication on the end side and avoiding the leakage of privacy data.

[0092] In some embodiments, according to the method described above, the aggregation server does not need to first securely aggregate the ciphertext data provided by each client of the device group and decrypt it according to the above method to directly obtain the group user portrait data of the device group. Instead, after obtaining the first-round public key and the first-round private key corresponding to the device group in this round, the aggregation server can directly decrypt the ciphertext data provided by each client of the device group based on the first-round public key and the first-round private key to obtain the plaintext data of each client, that is, the user data, and then securely aggregate the plaintext data of each client, such as classifying and statistically summing the user data such as the application usage data or the frequency of hardware resource usage of each client, so as to obtain the group user portrait data of the device group in this round.

[0093] It should be understood that no matter whether the aggregation server first securely aggregates the ciphertext data provided by each client of the same device group and then performs the above-mentioned decryption operation, or first decrypts the ciphertext data and then performs the secure aggregation operation, the obtained group user portrait data of the device group, that is, the first user portrait data, is the same, which can effectively avoid frequent communication between the clients in the device group and the adverse effects on client performance and power consumption.

[0094] In other embodiments proposed in this application, in the data processing methods proposed in the above embodiments, such as Figure 3 As shown, the present application can also introduce a target audit server so that the client can adopt a post-audit design concept to verify the credibility of the aggregation server providing the aggregation service. Therefore, after the aggregation server obtains the ciphertext data provided by multiple clients of the same device group, it can disclose the first part of the ciphertext data provided by each client to the target audit server, so that the client can verify the credibility of the aggregation server providing the aggregation service based on the first part of the ciphertext data stored on the target audit server.

[0095] Taking the above scenario of generating each client's own private key based on the Elgamal algorithm and encrypting the corresponding client's user data to obtain ciphertext data as an example, the aggregation server can obtain the (Groupid, Iterationid, Clientid, y i , α i ,β i ) and other contents, and then, Figure 3 As shown, the first part of the ciphertext data α of each client can be i , and the client ID used to identify the client and the group ID of the device group to which it belongs, such as (Groupid, Iterationid, Clientid, α i) is sent to the target audit server open to each client so that subsequent clients can verify the credibility of the aggregation server based on it. The implementation process can refer to the description of the corresponding part of the verification method embodiment below, and this embodiment will not be described in detail here.

[0096] In some other embodiments proposed in the present application, after the aggregation server determines the first part of the ciphertext data of each client obtained in this round, it can calculate the hash value of each first part of the ciphertext data, and combine it with the hash value of the first part of the ciphertext data provided by the same client in the previous round to obtain the chain hash value stored in this round, that is, calculate the hash value of the first part of the ciphertext data in the ciphertext data of this round and the hash value of the first part of the ciphertext data in the previous round to obtain the chain hash value (which can be expressed as Hash), and disclose the chain hash value to the target audit server, such as Figure 3 The Hash of the target audit server is shown in the , so that the client calculates the hash value of the first part of the ciphertext data stored locally, verifies the consistency with the corresponding chain hash value in the target audit server, and evaluates the credibility of the aggregation service (security aggregation protocol) provided by the aggregation server to determine whether the data processing process protects the client's user data from being leaked.

[0097] In one possible implementation, in the process of obtaining the chained hash value described above, after obtaining the hash value of the first portion of the ciphertext data of each client in the device group in each round according to the hash function, the hash values ​​of the first portion of the ciphertext data obtained for the same client in the same device group in the current round and the previous round can be concatenated, and then the concatenated hash values ​​are calculated according to the hash function to obtain the chained hash value of the client in the device group in the current round. It can be seen that as the number of rounds in which the client in the device group participates in aggregation increases, the chained hash value obtained according to this calculation method will also be synchronously updated. The implementation process is similar, and this application does not provide detailed examples one by one.

[0098] Reference Figure 4 , is a flow chart of the data processing method provided in Example 3 of the present application, combined with the data processing method described in the above embodiments, such as Figure 4 As shown, the data processing method proposed in this embodiment may include but is not limited to the following steps:

[0099] Step S41: Obtain ciphertext data and public keys provided by multiple clients; the ciphertext data is data obtained by each client encrypting its own user data based on its own private key, and the multiple clients are from the same device group;

[0100] Step S42: Calculate the first round public key of this round based on the public keys provided by the multiple clients;

[0101] Step S43, calculating the product of the first part of the ciphertext data provided by multiple clients in this round to obtain the first target data;

[0102] Still taking the scenario where the client obtains its own ciphertext data based on the Elgamal algorithm and sends it to the aggregation server as an example, the first part of the ciphertext data can be the ciphertext data of the client i (α i ,β i ) in i , the first target data α can be expressed as: α=∏α i , i=1, 2..., N, ∏ represents the product operation. Similarly, the public keys of N clients are multiplied to obtain the first round public key Y of this round, that is, Y=∏y i .

[0103] Step S44: Feedback the first target data to multiple clients in this round, so that each client obtains its corresponding encrypted ciphertext data based on the first target data;

[0104] During the data processing process, the clients in the device group may enter an offline state due to certain factors (such as failure, shutdown, or network disconnection, etc.), so that the encrypted data they have sent to the aggregation server will no longer participate in the subsequent security aggregation processing. In order to safely and accurately identify whether each client in the device group is online or offline.

[0105] To improve the security of the ciphertext data, after the aggregation server has determined the first target data α of the device group, it can be sent to each client included in the device group. Afterwards, the online clients (such clients can be called online clients, and the offline clients can be called offline clients) can obtain the corresponding encrypted ciphertext data based on the first target data. Optionally, combined with the decryption principle of the Elgamal algorithm, each online client can use its own private key to process the first target data and obtain the corresponding encrypted ciphertext data, such as α xi , where xi is the private key x of the i-th client i The encrypted ciphertext data can be used to determine the status information of the corresponding client, and the implementation process can refer to but is not limited to the method described in the following steps.

[0106] Based on this, in the process of the aggregation server obtaining the first user portrait data of the device group in this round, in order to improve the accuracy and reliability of the first user portrait data, the plaintext data of each online client in the device group can be used to obtain it. It is only necessary to decrypt the ciphertext data provided by these online clients. The ciphertext data provided by the offline clients in the device group does not need to participate in subsequent processing steps, which reduces the data processing workload and the power consumption during the data processing process. At the same time, it also avoids the interference of the ciphertext data of the offline clients on the subsequent decryption process, thereby improving the decryption efficiency and reliability.

[0107] Step S45: determining the status information of each client based on the encrypted ciphertext data fed back by the client;

[0108] Following the above analysis, to determine the status of each client in the current device group, and to stop processing data related to offline clients and only continue processing data related to online clients, the aggregation server can determine whether a client is offline or online by whether the client returns encrypted ciphertext data. In this way, if the aggregation server receives encrypted ciphertext data from the client, it indicates that the client is online; conversely, if it does not receive encrypted ciphertext data from the client, it indicates that the client is offline, thus accurately determining the status of each client in the device group.

[0109] It can be seen that the status information of the client can indicate whether the client is online or offline, and can be represented by a corresponding status identifier, etc. The present application does not limit the content of the status information. In the process of each online client feeding back encrypted ciphertext data to the aggregation server, in order to distinguish other device groups, other clients of the device group, and other rounds of the client, the encrypted ciphertext data obtained by the client in which round of data processing can be fed back at the same time, and the corresponding group identifier, round identifier, and client identifier can be fed back to the aggregation server together with the encrypted ciphertext data. For example, (Groupid, Iterationid, Clientid, α xi )This quad-tuple data is sent to the aggregation server, etc.

[0110] It should be noted that the method for obtaining the status information of each client in the same device group includes but is not limited to the implementation method described above. It can also monitor the status information of each client through communication mechanisms such as response mechanism / heartbeat mechanism, or when the client enters the offline state, actively send a status change message to the aggregation server to notify the aggregation server that the client switches from the online state to the offline state, and the aggregation server no longer needs to screen the online clients in the device group.

[0111] Step S46: Based on the status information, determine the first part of ciphertext data and the second part of ciphertext data to be decrypted;

[0112] According to the method described above, after receiving each (Groupid, Iterationid, Clientid, α xi ) four - tuple data group, it can be determined that the client with this Clientid is in an online state, and each online client in this round of the device group with this Groupid can be obtained. Delete the ciphertext data corresponding to the clients that are in an offline state at this time, that is, a type of client that has not received the corresponding encrypted ciphertext data (denoted as offline clients), and determine the ciphertext data of each online client in this device group as the first part of ciphertext data and the second part of ciphertext data to be decrypted.

[0113] Still taking the scenario where clients obtain their respective ciphertext data based on the Elgamal algorithm as an example, when the aggregation server obtains the ciphertext data of N clients in the same device group, after detecting whether the clients are online according to the above method, the aggregation server receives the encrypted ciphertext data of N' clients. If N' < N, it means that some clients in this device group are offline. According to the client identifier and group identifier of the corresponding clients that are synchronized and fed back with the encrypted ciphertext data, select the ciphertext data provided by these N' clients from the ciphertext data provided by the N clients in this device group as the first part of ciphertext data and the second part of ciphertext data to be decrypted, that is, determine the α data and β data of each online client.

[0114] Among them, if N' = N, it means that all clients in this device group are in an online state, and the ciphertext data of this device group obtained can be directly decrypted based on the public key of the first round and the private key of the first round corresponding to this device group. This decryption process can refer to the description of the corresponding part of the above - mentioned embodiment, such as the decryption method described in Embodiment 2, or other decryption methods different from Embodiment 2, etc. The implementation process is not elaborated in this application.

[0115] Step S47: Based on the status information, update the public key of the first round and the private key of the first round corresponding to this device group;

[0116] When N' < N, that is, after the aggregation server obtains the ciphertext data provided by multiple clients, but some of the clients are offline, resulting in the obtained first-round public key and first-round private key no longer being suitable, for the decryption process of the first part of the ciphertext data and the second ciphertext data to be decrypted that are re-determined, it is necessary to recalculate the matching new first-round private key and first-round public key. Therefore, according to the method described above, after determining each online client in the online state based on the status information of each client, the public keys of each online client in the device group can be used to calculate the first-round public key of this round, and the encrypted ciphertext data and the first part of the ciphertext data fed back by each online client can be used to calculate the first-round private key of this round.

[0117] It should be understood that if before performing the decryption operation (such as performing step S48), the first-round public key and first-round private key corresponding to the device group of this round have not been calculated, that is, before calculating the first-round public key and first-round private key, first determine the status information of each client in the device group, and then based on the status information, according to the method described above, calculate the first-round public key and first-round private key that match the first part of the ciphertext data and the second part of the ciphertext data to be decrypted currently. If before performing the decryption operation, the aggregation server has already obtained the first-round public key and first-round private key corresponding to the device group of this round, the first-round public key and first-round private key can be updated based on the status information, and the update process can be implemented according to the calculation process described above, which will not be elaborated in this application.

[0118] Step S48, based on the updated first-round public key and first-round private key, decrypt the first part of the ciphertext data and the second part of the ciphertext data to be decrypted, and obtain the plaintext data corresponding to each online client;

[0119] Step S49, perform secure aggregation on the plaintext data corresponding to the online clients, and obtain the first user portrait data of the device group in this round.

[0120] Following the above analysis, after obtaining the first-round private key and first-round public key that match the ciphertext data to be decrypted currently provided by the device group, during the decryption process of the ciphertext data, the first part of the ciphertext data and the second part of the ciphertext data to be decrypted of each online client can be securely aggregated first to obtain the target ciphertext data of this round, and then based on the updated first-round public key and first-round private key, decrypt the target ciphertext data to obtain the first user portrait data of the device group in this round.

[0121] Optionally, in the process of decrypting the ciphertext data to be decrypted obtained in the above round, the first part of the ciphertext data and the second part of the ciphertext data to be decrypted of each online client in the device group can be decrypted based on the updated first-round public key and the first-round private key to obtain the plaintext data of each online client, such as the user data of each online client itself, and then the plaintext data of each online client of the device group are securely aggregated to obtain the first user portrait data of the device group in this round.

[0122] To sum up, in the embodiment of the present application, after the aggregation server obtains the ciphertext data and private keys of multiple clients from the same device group, the clients in the device group may be offline at any time during the subsequent processing. In order to safely and reliably obtain the group user portrait data of the device group, the aggregation server can multiply the first part of the ciphertext data provided by each client to obtain the first target data and feed it back to each client participating in this round of aggregation, that is, each client in the device group, so that the client in the online state can process the first target data based on its own private key and feed the obtained encrypted ciphertext data back to the aggregation server to inform the aggregation server. At this time, the client is online, and for the client that switches to the offline state, the first target data will not be processed, and the encrypted ciphertext data will not be fed back to the aggregation server, so that the aggregation server can accurately determine the first part of the ciphertext data and the second part of the ciphertext data to be decrypted of each online client from the ciphertext data of the device group, and determine the first round public key and the first round private key that match these ciphertext data to be decrypted based on the status information of each client, thereby realizing the decryption processing of these ciphertext data to be decrypted, quickly and reliably obtaining the first user portrait data of the device group in this round, and supporting the client offline scenario, thereby enhancing the adaptability to application scenarios.

[0123] In the data processing methods described in the above embodiments, in the various application scenarios of federated learning listed above, in the process of jointly training the machine learning model by multiple clients included in the device group of the application scenario, it is usually necessary to perform multiple rounds of joint training on the machine learning model to obtain a machine learning model that meets the processing requirements of the application scenario. In each round of joint training, it can be implemented according to the data processing method described in any of the above embodiments.

[0124] Based on this, according to the above data processing method, after obtaining the first user portrait data of the device group in this round, if the next round of data processing still needs to be performed, since the status information and user data of each client may change, such as the model parameters updated by the machine learning model training, etc., through the next round of data processing method, the first user portrait data of the device group in the next round can be obtained, and the processing is repeated in this way until the business processing requirements of the current application scenario are completed, such as completing the training and testing of the machine learning model.

[0125] If the round described in the above embodiments is recorded as the first round, according to the above data processing method, the aggregation server can also obtain the second user portrait data of the same device group in the second round, and / or the third user portrait data of the device group in the third round, etc. The second round and the third round can be rounds before or after the first round. Afterwards, the second user portrait data and / or the third user portrait data and the first user portrait data can be aggregated to obtain the target user portrait data of the device group to meet the processing requirements of the application scenario.

[0126] Depending on the number of rounds required by the application scenario, it may be necessary to obtain user profile data for each device group in more rounds. The implementation process is similar, and this application does not provide detailed examples one by one. In this way, the aggregation server can obtain the target user profile data for the device group based on the user profile data of the same device group in multiple rounds. In addition, the data processing method for other device groups participating in security aggregation is similar and is not described in detail in this embodiment.

[0127] In some embodiments, combined Figure 5 The flowchart of the data processing method provided in the fourth embodiment of the present application is shown. The scenario in which the client obtains its own ciphertext data based on the Elgamal algorithm and sends it to the aggregation server is used as an example for explanation. The aggregation server initiates an aggregation request (Groupid, Iterationid). Each client belonging to the device group corresponding to the Groupid group identifier generates its own private key x based on the Elgamal algorithm. i and public key y i , for its own user data (i.e. plaintext data to be aggregated) M i Encrypt and get the ciphertext data (α i ,β i ), get (Groupid, Iterationid, Clientid, y i , α i ,β i ) is sent to the aggregation server so that the aggregation server can generate the first part of the ciphertext data α based on the first part of the ciphertext data provided by each client in the device group. i, get the first target ciphertext data α, that is, α=∏α i , the first target ciphertext data is sent to the N clients of the device group, and for each client in the online state, based on its own private key x i The first target ciphertext data α is processed and the encrypted ciphertext data α is obtained. xi Feedback to the aggregation server, so that the aggregation server can determine the online clients that feedback the encrypted ciphertext data, and use their public key y i , calculate the first round public key Y of this round, that is, Y=∏y i , using the second part of the ciphertext data of each online client, calculate the ciphertext data of this round, that is, β=∏β i , since αx=∏α i xi The aggregation server will obtain the α obtained at this time and the encrypted ciphertext data α corresponding to each online client i xi Substitute this formula and calculate x, since x=∑x i , using the Elgamal algorithm to decrypt the ciphertext data of each online client, and obtain the first user portrait data M of the device group in this round, that is, the plaintext data M after decryption of each online client in the device group i The sum is M.

[0128] After the aggregation server obtains the ciphertext data provided by each client of the device group, it can i It is made public to the target audit server and the chain hash value is calculated, so that the client can verify the credibility of the aggregation server.

[0129] In a possible implementation, the target client in the device group can obtain the ciphertext data to be audited in the target audit server and the first client ciphertext data fed back by the first part of the clients in the device group, so that the target client can verify the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the first client ciphertext data. The implementation process can refer to the relevant description of the verification method embodiment below, and this embodiment will not be described in detail here. The ciphertext data to be audited may include various α i .

[0130] Reference Figure 6 , is a flow chart of the verification method proposed in the first embodiment of the present application, which can be applied to the target client, such as any client in any of the above-mentioned device groups, such as Figure 6 As shown, the verification method proposed in this embodiment may include:

[0131] In step S61, the target client obtains first-client ciphertext data fed back by the first-part clients; the first-part clients and the target client are from the same device group, and the first-client ciphertext data is data obtained by encrypting the respective user data of the first-part clients using their own private keys;

[0132] In the embodiment of the present application, the first part of the clients may be other clients in the device group except the target client. Figure 7 As shown, the target client initiates a verification request, which may include the group identifier of the device group to which the target client belongs and the round identifier of the requested verification, namely (Groupid, Iterationid). In this way, each other client belonging to the device group can successfully return their respective first client ciphertext data, that is, they can successfully respond to the verification request and return the first part of the client's own ciphertext data and the client identifier, as well as the (Groupid, Iterationid) included in the verification request to the target client, namely (Groupid, Iterationid, Clientid, α i ), at least one client that successfully returns the ciphertext data can be recorded as the first part of clients.

[0133] It should be noted that the first part of clients is not necessarily all other clients in the device group except the target client, but may be some other clients (that is, some clients in the device group are offline and some clients are online). This can be determined based on the status information of other clients and the response to the verification request. This application does not impose any restrictions.

[0134] Step S62: The target client obtains the ciphertext data to be audited corresponding to the first part of the client from the target audit server;

[0135] Step S63: The target client verifies the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the ciphertext data of the first client.

[0136] The target client can obtain the ciphertext data to be audited corresponding to the first portion of clients from the target audit server. That is, during the aforementioned data processing process, the aggregation server discloses the first portion of ciphertext data corresponding to the first portion of clients to the target audit server during the request verification round, and determines the content of the ciphertext data to be audited in combination with the disclosure process in the aforementioned data processing method. This application does not impose any restrictions on this. The target client can then determine the credibility of the aggregation server providing the aggregation service based on obtaining the first client ciphertext data and the ciphertext data to be audited corresponding to the same client from different locations.

[0137] In a possible implementation, if the target client obtains the ciphertext data to be audited from the target audit server as follows: (Groupid, Iterationid, Clientid, α i ), which can be compared with the first client ciphertext data provided by the first part of the clients for consistency, so as to determine the credibility of the aggregation server based on the consistency comparison result. Optionally, the credibility of the aggregation server can be evaluated based on the ratio between the number of consistent first part clients and the total number of clients included in the device group. For example, if the ratio is above 50%, it can be considered that the aggregation server has faithfully used the user data of 50% of the clients to participate in the calculation. The user data of the current target client is mixed with the user data of these first part clients. The secure aggregation protocol can protect the user data of the target client from being leaked to the aggregation server, but is not limited to the credibility verification method described in this embodiment.

[0138] In another possible implementation, when the target audit server stores a chain hash value, the target client obtains the second client ciphertext data of the second part of the clients in the device group, calculates the client hash value of the client ciphertext data of this round based on the first client ciphertext data and the second client ciphertext data, and compares and verifies the client hash value to determine the credibility of the aggregation server.

[0139] For example, the target client calculates the corresponding client hash value based on the client ciphertext data fed back by the clients in its device group, and compares and verifies it with the chain hash value corresponding to the corresponding device group identifier, client identifier and round identifier in the target audit server. Usually, after multiple rounds of data processing, the hash value of the chain hash value is obtained and then stored, and the hash value is compared and verified with the client hash value calculated locally to determine whether the two are consistent / matched. Afterwards, the proportion of the number of clients with consistent / matching comparison and verification results to the total number of clients in the device group can still be counted to determine the credibility of the aggregation server.

[0140] In another possible implementation, Figure 7 As shown, the target client initiates a verification request and obtains the device group it belongs to ( Figure 7 Only device group A is used as an example for explanation. The implementation process for other device groups is similar. After the client ciphertext data returned by each client in the device group is obtained, the client ciphertext data cannot be returned for clients in an offline state. The ciphertext data to be audited of such clients can be obtained from the target audit server, thereby determining the first part of the ciphertext data α of each client included in the device group. i , after the product operation, the second target data α of this round is obtained, that is, the target client can calculate the second target data of this round based on the client ciphertext data, that is, α=∏αi After that, the second target data can be verified for equivalence with the first target data α obtained from the aggregation server in the same round, that is, the first target data obtained by multiplying the second target data and the first part of the ciphertext data in the ciphertext data provided by multiple clients in this round calculated by the aggregation server (the acquisition process can refer to the description of the corresponding part in the above data processing method, which will not be described in detail in this embodiment) is verified for equivalence to determine the credibility of the aggregation server.

[0141] Among them, if the second target data of the device group in the same round is the same as the first target data, it means that the number of trusted clients calculated in this round is N. Based on the ratio of N to the number of all clients, the credibility of the aggregation server is determined. If the ratio is greater than the threshold (such as 50%), it can be considered that the aggregation server faithfully uses the user data of 50% of the clients to participate in the calculation, and the user data of the current target client is mixed with the user data of these clients. The secure aggregation protocol can protect the user data of the target client from being leaked to the aggregation server, but it is not limited to the ratio threshold of 50% and can be determined according to actual conditions.

[0142] It should be noted that in the above-mentioned verification method execution scenario, for each client participating in the calculation, during the above-mentioned data processing process, the intermediate data and ciphertext data obtained in the most recent rounds can be cached, which can be determined according to the application scenario, such as caching the various data received and generated by each client within the last hour, 5 hours, or day, such as the above-mentioned ciphertext data, the first target data, the encrypted ciphertext data, etc., so that when the client executes the verification method as a target client, the cached data can be used to complete the verification method.

[0143] To sum up, in the embodiment of the present application, after the aggregation server implements security aggregation processing in any application scenario according to the above-mentioned data processing method, in order to verify the credibility of the aggregation server, any client participating in the calculation can initiate a verification request as a target client to perform credibility verification on any round of security aggregation process of the device group. In this implementation process, not only can the client ciphertext data be obtained from other online clients of the device group, but the ciphertext data to be audited can also be obtained from the target audit server, so that when the client is offline during the verification phase, the target client can obtain the client ciphertext data of this type of client from the target audit server, thereby determining the credibility of the aggregation server based on the obtained ciphertext data.

[0144] As can be seen, this application migrates many-to-many communication between clients to the trusted verification stage, avoiding many-to-many communication between clients during the security aggregation process (i.e., the aforementioned data processing method), which can reduce client-side performance and increase power consumption. Furthermore, it supports any client initiating verification requests, allowing multiple clients to collaboratively verify the trustworthiness of the security aggregation protocol. Because this trusted verification process is decoupled from the data processing process (i.e., the security aggregation process), it is not executed frequently, reducing power consumption. It can serve as a means of self-certifying trustworthiness to clients. By providing clients with a certain number of uses, the trustworthiness of the aggregation server can be reliably assessed.

[0145] The above describes a data processing method and a verification method provided in an embodiment of the present application. The following describes a device for executing the above data processing method and a device for executing the above verification method, respectively.

[0146] Reference Figure 8 , which is a structural diagram of the data processing device proposed in the embodiment of the present application, can be applied to the aggregation server, such as Figure 8 As shown, the data processing device may include:

[0147] A first obtaining module 81 is configured to obtain ciphertext data and public keys provided by multiple clients, wherein the ciphertext data is obtained by encrypting user data of each client using its own private key, and the multiple clients are from the same device group;

[0148] A first calculation module 82 is configured to calculate a first round public key of this round based on the public keys provided by the plurality of clients;

[0149] The first decryption module 83 is used to decrypt the ciphertext data based on the first round public key and the first round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

[0150] In a possible implementation, the first decryption module 83 includes at least one of the following units:

[0151] a first decryption processing unit, configured to securely aggregate the ciphertext data provided by the multiple clients to obtain target ciphertext data for this round, and decrypt the target ciphertext data for this round based on the first round public key and the first round private key corresponding to the device group to obtain first user profile data of the device group for this round;

[0152] The second decryption processing unit is used to decrypt the ciphertext data provided by the multiple clients respectively based on the first-round public key and the first-round private key corresponding to the device group, and securely aggregate the plaintext data obtained by decryption to obtain the first user portrait data of the device group in this round.

[0153] In some embodiments, the data processing device may further include at least one of the following modules:

[0154] a first disclosure module, configured to disclose a first portion of the ciphertext data provided by the client to a target audit server, so that the client can verify the credibility of the aggregation server providing the aggregation service based on the first portion of the ciphertext data stored on the target audit server;

[0155] The second calculation module is used to calculate the hash value of the first part of the ciphertext data in the current round and the hash value of the first part of the ciphertext data in the previous round to obtain a chain hash value, and disclose the chain hash value to the target audit server.

[0156] In some embodiments, the data processing device may further include:

[0157] A first target data obtaining module, configured to calculate the product of a first portion of ciphertext data in the ciphertext data provided by multiple clients in this round to obtain the first target data;

[0158] The first target data sending module is used to feed back the first target data to the multiple clients, so that each client obtains its own corresponding encrypted ciphertext data based on the first target data, wherein the encrypted ciphertext data can be used to determine the status information of the client.

[0159] In a possible implementation, the first decryption module 83 may include:

[0160] A first determining unit, configured to determine the status information of the client based on the encrypted ciphertext data fed back by the client;

[0161] a second determining unit, configured to determine a first portion of ciphertext data and a second portion of ciphertext data to be decrypted based on the state information;

[0162] an updating unit, configured to update the first-round public key and the first-round private key corresponding to the device group based on the status information;

[0163] A first decryption unit is configured to decrypt the first portion of ciphertext data and the second portion of ciphertext data to be decrypted based on the updated first-round private key and the first-round public key to obtain plaintext data corresponding to each online client;

[0164] The plaintext data corresponding to each online client is securely aggregated to obtain the first user portrait data of the device group in this round.

[0165] In some embodiments, the data processing device may further include:

[0166] A second obtaining module is configured to obtain second user portrait data of the device group in a second round and / or third user portrait data in a third round, where the second round and the third round are rounds before or after the current round;

[0167] An aggregation processing module is used to aggregate the second user portrait data and / or the third user portrait data and the first user portrait data to obtain the target user portrait data of the device group.

[0168] In some embodiments, the data processing device may further include:

[0169] The third acquisition module is used to obtain the ciphertext data to be audited in the target audit server and the first client ciphertext data fed back by the first part of the clients in the device group through the target client in the device group, so that the target client can verify the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the first client ciphertext data.

[0170] Reference Figure 9 , which is a structural diagram of the verification device proposed in the embodiment of the present application, can be applied to the target client, that is, the terminal device, such as Figure 9 As shown, the verification device may include:

[0171] An obtaining module 91 is configured to obtain first client ciphertext data fed back by a first portion of clients; the first portion of clients and the target client are from the same device group, and the first client ciphertext data is data obtained by encrypting respective user data of the first portion of clients using their own private keys;

[0172] An acquisition module 92 is configured to acquire the ciphertext data to be audited corresponding to the first part of the clients from a target audit server;

[0173] The verification module 93 is used to verify the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the first client ciphertext data.

[0174] In some embodiments, the verification module 93 may include at least one of the following verification units:

[0175] a first verification unit, configured to perform a consistency comparison between the ciphertext data to be audited and the ciphertext data of the first client, so as to determine the credibility of the aggregation server based on the obtained consistency comparison result;

[0176] a second verification unit, configured to obtain second client ciphertext data of a second portion of clients in the device group, calculate a client hash value of the client ciphertext data of this round based on the first client ciphertext data and the second client ciphertext data, and compare and verify the client hash value to determine the credibility of the aggregation server;

[0177] The third verification unit is used to calculate the second target data of this round based on the client ciphertext data, and perform equivalence verification on the first target data obtained by multiplying the second target data and the first part of the ciphertext data in the ciphertext data provided by multiple clients in this round calculated by the aggregation server, so as to determine the credibility of the aggregation server.

[0178] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the corresponding device implements any data processing method or verification method proposed in the present application that is applicable to the device.

[0179] Reference Figure 10 , is a schematic diagram of the hardware structure of an aggregation server proposed in an embodiment of the present application, referring to Figure 3 and Figure 5 The system architecture of the application scenario shown in the figure is as follows: Figure 10 As shown, the aggregation server may include at least one communication element 101, at least one memory 102, and at least one processor 103, wherein:

[0180] The at least one communication element 101, the at least one memory 102, and the at least one processor 103 can communicate with each other via a bus. The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 The bus is represented by only one bidirectional line, but this does not mean that there is only one bus or one type of bus.

[0181] The communication component 101 can be used to obtain ciphertext data and public keys provided by multiple clients. The ciphertext data is the result of each client encrypting its own user data using its own private key. These multiple clients are from the same device group. It can also be used to implement data or command transmission between components within the aggregation server.

[0182] Based on this, in embodiments of the present application, the communication element 101 may include a communication element that supports wireless communication methods such as Wi-Fi, Bluetooth, and 5G / 6G mobile communications, so that the aggregation server can use the communication element to transmit data with other devices (such as various clients, target audit servers, etc.). It may also include one or more interfaces that support wired communication methods, such as general-purpose input / output (GPIO) interfaces, USB interfaces, and universal asynchronous receiver / transmitter (UART) interfaces, to enable data transmission between various components within the aggregation server. This application does not limit the component structure of the communication element 101 to achieve this function and its corresponding communication transmission mechanism, which can be determined according to the actual situation.

[0183] The memory 102 can be used to store multiple computer instructions for implementing the data processing method proposed in the embodiment of the present application; the processor 103 can load and execute the multiple computer instructions stored in the memory 102 to implement the various steps of the data processing method proposed in the embodiment of the present application. The implementation process can refer to the description of the corresponding part of the method embodiment above.

[0184] In the embodiment of the present application, the memory 102 may include a storage medium such as a floppy disk, a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. The processor 101 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), a digital signal processor (DSP), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

[0185] It should be understood that Figure 10 The structure of the aggregation server shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the aggregation server may include Figure 10 This application does not provide detailed examples of more or fewer components shown, or combinations of certain components.

[0186] A terminal device is also provided in an embodiment of the present application, which acts as a client to implement the verification method described in the above embodiment of the present application. The terminal device may include at least one memory and at least one processor. The processor can execute computer instructions stored in the memory to implement the verification method proposed in the embodiment of the present application. The implementation process is not described in detail in this application.

[0187] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, any data processing method provided in the embodiment of the present application is implemented.

[0188] It should also be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided in this application, the connection relationship between the modules indicates that there is a communication connection between them, which can be specifically implemented as one or more communication buses or signal lines.

[0189] Through the description of the above embodiments, in the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, training equipment or data center to another website, computer, training equipment or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a training device, data center, etc. that includes one or more available media integrations. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)).

[0190] Furthermore, the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. References to the common and similar parts between the various embodiments are sufficient. The devices and aggregation servers disclosed in the embodiments correspond to the methods disclosed in the embodiments, so their descriptions are relatively simple. For relevant details, refer to the method descriptions.

[0191] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, comprising: Obtaining ciphertext data and public keys provided by multiple clients, wherein the ciphertext data is data obtained after each client encrypts its own user data based on its own private key, and the multiple clients are from the same device group; Calculate the first round public key of this round based on the respective public keys provided by the multiple clients; The ciphertext data is decrypted based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

2. The method according to claim 1, wherein: Decrypting the ciphertext data based on the first-round public key and the first-round private key corresponding to the device group includes at least one of the following: Securely aggregate the ciphertext data provided by the multiple clients to obtain target ciphertext data of this round, and decrypt the target ciphertext data of this round based on the first round public key and the first round private key corresponding to the device group to obtain first user portrait data of the device group in this round; The ciphertext data provided by the multiple clients are decrypted respectively based on the first-round public key and the first-round private key corresponding to the device group, and the decrypted plaintext data are securely aggregated to obtain the first user portrait data of the device group in this round.

3. The method according to claim 1 or 2, further comprising at least one of the following: Publicizing a first portion of the ciphertext data provided by the client to a target audit server, so that the client can verify the credibility of the aggregation server providing the aggregation service based on the first portion of the ciphertext data stored on the target audit server; Calculate the hash value of the first part of the ciphertext data in the current round and the hash value of the first part of the ciphertext data in the previous round to obtain a chain hash value, and publish the chain hash value to the target audit server.

4. The method according to claim 1, further comprising: Calculate the product of the first part of the ciphertext data provided by multiple clients in this round to obtain the first target data; The first target data is fed back to the multiple clients, so that each client obtains its corresponding encrypted ciphertext data based on the first target data, wherein the encrypted ciphertext data can be used to determine the status information of the client.

5. The method according to claim 1 or 4, wherein: Decrypting the ciphertext data based on the first-round public key and the first-round private key corresponding to the device group includes: Determine the status information of the client based on the encrypted ciphertext data fed back by the client; Based on the state information, determining a first portion of ciphertext data and a second portion of ciphertext data to be decrypted; Based on the status information, updating the first round public key and the first round private key corresponding to the device group; Based on the updated first-round private key and the first-round public key, the first part of the ciphertext data and the second part of the ciphertext data to be decrypted are decrypted to obtain the plaintext data corresponding to each online client; The plaintext data corresponding to each online client is securely aggregated to obtain the first user portrait data of the device group in this round.

6. The method according to claim 1, further comprising: Obtaining second user portrait data of the device group in a second round and / or third user portrait data in a third round, where the second round and the third round are rounds before or after the current round; The second user portrait data and / or the third user portrait data and the first user portrait data are aggregated to obtain target user portrait data of the device group.

7. The method according to claim 1, further comprising: The target client in the device group obtains the ciphertext data to be audited in the target audit server and the first client ciphertext data fed back by the first part of the clients in the device group, so that the target client verifies the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the first client ciphertext data.

8. The method according to claim 7, wherein: The target client verifies the credibility of the aggregation server based on the ciphertext data to be audited and the ciphertext data of the first client, including at least one of the following: The target client performs a consistency comparison on the ciphertext data to be audited and the ciphertext data of the first client, so as to determine the credibility of the aggregation server based on the obtained consistency comparison result; The target client obtains second client ciphertext data of the second part of clients in the device group, calculates the client hash value of the client ciphertext data of this round based on the first client ciphertext data and the second client ciphertext data, and compares and verifies the client hash value to determine the credibility of the aggregation server; The target client calculates the second target data of this round based on the client ciphertext data, and performs equivalence verification on the first target data obtained by multiplying the second target data and the first part of the ciphertext data in the ciphertext data provided by multiple clients in this round calculated by the aggregation server to determine the credibility of the aggregation server.

9. A verification method, comprising: The target client obtains the first client ciphertext data fed back by the first client; The first part of clients and the target client are from the same device group, and the first part of client ciphertext data is data obtained by encrypting respective user data by the first part of clients based on their own private keys; The target client obtains the to-be-audited ciphertext data corresponding to the first part of the clients from the target audit server; The target client verifies the credibility of the aggregation server providing the aggregation service based on the ciphertext data to be audited and the ciphertext data of the first client.

10. An aggregation server, comprising: at least one communication element, at least one memory, and at least one processor, wherein: The communication element is used to obtain ciphertext data and public keys provided by multiple clients, wherein the ciphertext data is data obtained after each client encrypts its own user data based on its own private key, and the multiple clients are from the same device group; The memory is used to store a plurality of computer instructions; The processor is used to load and execute the computer instructions to implement the following steps: Calculate the first round public key of this round based on the respective public keys provided by the multiple clients; The ciphertext data is decrypted based on the first-round public key and the first-round private key corresponding to the device group to obtain the first user portrait data of the device group in this round.

Images