Method, device and system for safely processing astronomical sensitive data based on privacy calculation and storage medium

Abstract

The invention relates to the technical field of computers, discloses an astronomical sensitive data security processing method, device and system based on privacy calculation, and a storage medium, and aims to solve the problems that in astronomical data cross-mechanism joint analysis, original data is easy to leak, the cooperation efficiency is low, and a traditional desensitization or encryption method is difficult to consider security and availability at the same time. The method specifically comprises the following steps: each participant deploys a private computing agent node locally, and original data is not out of a domain; the task coordination center issues an analysis task; the proxy node extracts and preprocesses local data, and loads a corresponding secure multi-party computing protocol template; according to the method, share segmentation is carried out on multi-modal data such as images, spectrums and star catalogues by adopting addition homomorphic secret sharing, and distribution is carried out through a national secret SM4 encryption channel; and multiple parties cooperatively execute task-oriented security calculation in an encrypted state, and the result is aggregated and returned with the minimum information amount. The method has the effect of realizing high-precision safe collaborative analysis which is available and invisible.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a method, apparatus, system and storage medium for secure processing of astronomically sensitive data based on privacy computing. Background Technology

[0002] With the rapid development of astronomical observation technology, large-scale sky surveys and space telescopes continuously generate massive amounts of high-precision data, including a large amount of sensitive astronomical data related to national space security, strategic resource allocation, or the coordinates of sensitive celestial bodies. Such data is of extremely high value in scientific collaboration, inter-institutional sharing, and international cooperation; however, its leakage could trigger geopolitical risks or be used for unauthorized target identification, thus imposing stringent requirements on privacy protection during data processing. Traditional astronomical data processing systems generally adopt a "centralized first, then analyzed" model, uploading raw observational data to a centralized computing platform for unified processing. While this model facilitates algorithm deployment and result consistency management, it exposes sensitive information to a single storage node, making it highly susceptible to data theft, man-in-the-middle attacks, or internal misuse, seriously threatening national security and research ethics.

[0003] Among them, the privacy-preserving computation-based method for secure processing of astronomically sensitive data aims to complete joint analysis tasks without exposing the original data through cryptography and distributed architecture. The core of this approach is to achieve "data usable but invisible," that is, while ensuring that multiple participants cannot obtain each other's original observation records, they can still collaboratively complete key scientific calculations such as star catalog cross-matching, orbital parameter fitting, or anomalous celestial object identification.

[0004] However, existing technologies face multiple structural contradictions when applied to astronomical scenarios: existing privacy computing frameworks are mostly designed for general structured data and are difficult to adapt to the high-dimensional sparsity, coordinate system dependence and time series asynchronicity unique to astronomical data; multi-party secure computing protocols experience a surge in communication overhead when processing TB-level image cubes or spectral datasets, resulting in computational delays exceeding the response time window for astronomical events.

[0005] Therefore, there is an urgent need for a method, device, system, and storage medium for secure processing of astronomically sensitive data based on privacy computing, which can ensure end-to-end data confidentiality while taking into account computational efficiency, scientific accuracy, and policy flexibility, in order to solve the problem of secure use of large-scale astronomically sensitive data in an open and collaborative environment. Summary of the Invention

[0006] This invention provides a method, apparatus, system, and storage medium for secure processing of astronomically sensitive data based on privacy computing. It aims to address the problems of high risk of raw data leakage, low efficiency of multi-party collaboration, and the inability of traditional anonymization or encryption methods to simultaneously ensure data usability and security during cross-institutional collaborative analysis of astronomical observation data. In existing technologies, when sharing sensitive observation data such as star catalogs, spectra, and images, astronomical observatories, space telescope projects, and research institutions typically employ centralized storage combined with access control strategies, or distribute the data after static anonymization. Such methods reveal fundamental flaws when faced with new scientific research paradigms such as multi-source heterogeneous data fusion and distributed collaborative modeling: First, once the original data leaves the local security domain, it faces the risk of being intercepted, copied, or reverse-constructed by unauthorized parties; second, static desensitization severely damages the statistical characteristics and physical correlation of the data, leading to distortion of subsequent scientific analysis results; third, single technical solutions based on homomorphic encryption or differential privacy either cannot support the processing of massive astronomical data due to excessive computational overhead, or introduce uncontrollable errors due to noise injection mechanisms, failing to meet the stringent requirements of high-precision astrometry and cosmological parameter extrapolation.

[0007] In a first aspect, as an embodiment of the present invention, a method for secure processing of astronomically sensitive data based on privacy computing is provided, comprising the following steps: First, privacy computing proxy nodes are deployed locally at each participating party. The proxy nodes are connected to the local astronomical data storage system via a dedicated high-speed internal bus to ensure that the original observation data does not leave the domain. Second, the task coordination center broadcasts a joint analysis task description to each proxy node. The task description includes the target celestial region coordinate range, the required data type, the time window, and the identifier of the scientific algorithm to be executed. Then, each proxy node extracts the corresponding subset of original observation data from the local database according to the task description, and performs standardized preprocessing on the subset, including coordinate system transformation, timestamp unification, instrument response function correction, and bad pixel removal, to form a structured local intermediate dataset. Subsequently, each agent node loads a secure multi-party computation protocol template corresponding to the scientific algorithm identifier. The protocol template defines the number of participants, input and output formats, computational logic topology, and key negotiation mechanism. Based on this, each agent node uses secret sharing technology to divide its local intermediate dataset into multiple shares according to the protocol template and distributes the shares to the agent nodes of other participants through a peer-to-peer encrypted channel. After receiving all the shares, all agent nodes collaboratively execute distributed secure computation according to the computational logic topology defined in the protocol template. The entire computation process is performed in an encrypted state, without exposing any plaintext intermediate results. Finally, the computation results are returned to the task coordination center in aggregate form, which is a statistical summary, model parameters, or encrypted scientific output file, containing only the minimum amount of information required by the task.

[0008] Furthermore, the secret-sharing technique employs an additive homomorphic secret-sharing scheme, where numerical elements in each local intermediate dataset are represented as integers or fixed-point numbers and decomposed into two or more shares. This ensures that any combination with fewer than all shares cannot reconstruct the original value, while the sum of all shares equals the original value. For image data, it is first divided into fixed-size tile units. The pixel matrix of each tile unit is flattened into a one-dimensional vector in row-major order, and then share partitioning is performed on each element in the vector. For spectral data, the flux value of each channel is independently partitioned using its wavelength channel as an index. For star catalog data, the position, brightness, and redshift attributes of each celestial body are partitioned separately using its object number as the key.

[0009] Furthermore, the computational logic topology defined in the secure multi-party computation protocol template is pre-defined for different types of astronomical science tasks. For the task of cross-identifying celestial positions, the topology is a two-party set intersection operation, employing a private set intersection protocol based on unintentional transmission extension to ensure that each party only knows the celestial numbers shared by both parties, without revealing its own unique list of celestial bodies. For the multi-band photometric joint fitting task, the topology is a multi-party linear regression calculation, where each proxy node performs matrix multiplication and inversion operations in the share domain, ultimately aggregating to obtain the encrypted share of the fitting coefficients. For the task of estimating the power spectrum of large-scale cosmic structures, the topology is a multi-party fast Fourier transform and correlation function calculation, utilizing the additive homomorphic property to complete data superposition and statistical accumulation in the frequency domain.

[0010] Furthermore, before distributing the share, the proxy nodes must complete session key negotiation based on elliptic curve cryptography. Each proxy node is pre-configured with a digital certificate issued by a trusted certificate authority, containing its public key and the identity information of its affiliated authority. At task startup, each proxy node exchanges its digital certificate and verifies its validity. Subsequently, a point-to-point session key is generated using the Diffie-Hellman key exchange protocol for symmetric encryption of subsequent share transmissions. The encryption algorithm uses the SM4 block cipher, operating in counter mode to ensure that the same share generates different ciphertexts in different transmissions.

[0011] Furthermore, after receiving the aggregation results, the mission coordination center performs result verification and decryption. If the aggregation result is a statistical summary, it is published directly; if it is model parameters or scientific output documents, the result shares held by each agent node need to be collected, and the plaintext results are reconstructed over a finite domain using Lagrange interpolation. The reconstruction process is performed by the mission coordination center in an isolated and secure computing environment, and the reconstructed plaintext results are immediately used to generate the final scientific report. The original shares are destroyed immediately after verification.

[0012] Secondly, as one embodiment of the present invention, a privacy-preserving computation-based astronomical sensitive data security processing system is provided, comprising: a privacy-preserving computation agent node cluster deployed locally at each astronomical data holder, a task coordination center server, and a high-bandwidth, low-latency dedicated communication network connecting each node. The privacy-preserving computation agent node cluster includes a data access unit, a preprocessing unit, a protocol loading unit, a share generation and distribution unit, a secure computation execution unit, and a result share management unit. The data access unit connects to a local astronomical database via a fiber optic interface, supporting direct reading of standard astronomical data formats such as FITS and HDF5. The preprocessing unit incorporates a coordinate transformation engine, a time synchronization module, an instrument calibration parameter library, and a data quality evaluator to generate standardized intermediate datasets that meet task requirements. The protocol loading unit stores a pre-compiled secure multi-party computation protocol template library, which is indexed according to scientific task type. The share generation and distribution unit integrates a secret sharing algorithm core and the national cryptographic SM4 encryption engine, responsible for data share generation, encryption, and point-to-point transmission. The secure computation execution unit includes a virtualized execution environment capable of dynamically loading protocol templates and scheduling multi-party collaborative computation tasks. The results share management unit is used to temporarily store the results shares generated by local computation and to respond to share reclamation requests from the task coordination center. The task coordination center server includes a task scheduler, protocol distributor, results aggregator, and audit log recorder, and is responsible for the control and traceability of the entire joint analysis process.

[0013] Furthermore, the dedicated communication network adopts a dual-plane architecture. The control plane is used to transmit task instructions, protocol templates, and key negotiation messages, while the data plane is used to transmit encrypted data shares. The two planes are physically isolated, deployed on independent fiber optic links, and configured with hardware-based security gateways to implement traffic filtering and intrusion detection.

[0014] Furthermore, each agent node in the privacy computing agent node cluster runs within a trusted execution environment (TEA). This TEA is built on hardware-level security extensions embedded in the central processing unit (CPU), ensuring that the share generation, computation, and storage processes are not spied on or tampered with by the operating system or other applications. The agent node's operating system kernel is minimally trimmed, retaining only the drivers and service modules necessary for network communication, cryptographic operations, and astronomical data processing.

[0015] Thirdly, as one embodiment of the present invention, a security processing device for astronomically sensitive data based on privacy computing is provided, comprising: The deployment module is used to deploy privacy computing agent nodes locally on each participating party's premises. The privacy computing agent nodes are connected to the local astronomical data storage system via a dedicated high-speed internal bus. The task broadcasting module is used by the task coordination center to broadcast a joint analysis task description to each privacy computing agent node. The joint analysis task description includes the target sky area coordinate range, the required data types, the time window, and the identifier of the scientific algorithm to be executed. The data preprocessing module is used by each privacy computing agent node to extract the corresponding raw observation data subset from the local database according to the joint analysis task description, and to perform standardized preprocessing on the raw observation data subset to form a structured local intermediate dataset. The protocol loading module is used by each privacy computing agent node to load the secure multi-party computation protocol template corresponding to the scientific algorithm identifier. The secure multi-party computation protocol template defines the number of participants, input and output formats, computation logic topology and key negotiation mechanism. The share processing module is used by each privacy computing agent node to divide the local intermediate dataset into multiple shares based on the secure multi-party computation protocol template and using secret sharing technology, and distribute the shares to the privacy computing agent nodes of other participants through a peer-to-peer encrypted channel. The secure computing module is used by all privacy computing agent nodes to collaboratively execute distributed secure computing according to the computing logic topology defined in the secure multi-party computing protocol template after receiving all the shares. The distributed secure computing is carried out in an encrypted state throughout the process and does not expose any plaintext intermediate results. The results return module is used to return the calculation results to the task coordination center in aggregate form. The aggregate form can be a statistical summary, model parameters, or an encrypted scientific output file, and contains only the minimum amount of information required by the task.

[0016] Fourthly, as one embodiment of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one instruction, at least one program, code set or instruction set, wherein the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the privacy-based computation-based secure processing method for astronomically sensitive data as shown in any possible implementation of the first aspect.

[0017] In summary, this application includes at least one of the following beneficial technical effects: This invention constructs an end-to-end privacy computing framework, enabling secure collaborative analysis of sensitive astronomical data under the principle of "usable but invisible." Raw observational data remains within the local security domains of each participating party, fundamentally eliminating the source of data leakage. Employing a technical approach combining secret sharing and secure multi-party computation avoids the enormous computational overhead of homomorphic encryption while overcoming the drawback of differential privacy, which introduces random noise that reduces scientific accuracy. Addressing the multimodal nature of astronomical data, share partitioning and secure computation protocols are designed for different data types such as images, spectra, and star catalogs, ensuring the universality and efficiency of data processing. Through a pre-defined science-task-oriented computational logic topology, complex astronomical analysis algorithms are transformed into provably secure multi-party collaborative computation processes, significantly improving the efficiency and security of cross-institutional scientific collaboration. The entire system architecture deeply integrates a hardware-level trusted execution environment and national cryptographic algorithms, meeting national compliance requirements for the security of critical scientific data and providing a solid technical foundation for future large-scale sky surveys, space telescope arrays, and international astronomical collaborations. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall technical solution architecture proposed in this invention. Detailed Implementation

[0019] This invention provides a method, apparatus, system, and storage medium for secure processing of astronomically sensitive data based on privacy computing. It aims to address the problems of high risk of raw data leakage, low efficiency of multi-party collaboration, and the inability of traditional anonymization or encryption methods to simultaneously ensure data usability and security during cross-institutional collaborative analysis of astronomical observation data. In existing technologies, when sharing sensitive observation data such as star catalogs, spectra, and images, astronomical observatories, space telescope projects, and research institutions typically employ centralized storage combined with access control strategies, or distribute the data after static anonymization. Such methods reveal fundamental flaws when faced with new scientific research paradigms such as multi-source heterogeneous data fusion and distributed collaborative modeling: First, once the original data leaves the local security domain, it faces the risk of being intercepted, copied, or reverse-constructed by unauthorized parties; second, static desensitization severely damages the statistical characteristics and physical correlation of the data, leading to distortion of subsequent scientific analysis results; third, single technical solutions based on homomorphic encryption or differential privacy either cannot support the processing of massive astronomical data due to excessive computational overhead, or introduce uncontrollable errors due to noise injection mechanisms, failing to meet the stringent requirements of high-precision astrometry and cosmological parameter extrapolation.

[0020] Firstly, as an embodiment of the present invention, this application discloses a method for securely processing astronomically sensitive data based on privacy computing, in conjunction with the appendix. Figure 1 This includes the following steps: S1, deploy privacy computing agent nodes locally at each participating party. The agent nodes are connected to the local astronomical data storage system through a dedicated high-speed internal bus to ensure that the original observation data does not leave the domain; S2, the task coordination center broadcasts the joint analysis task description to each agent node. The task description includes the target sky area coordinate range, required data types, time window, and the scientific algorithm identifier to be executed. S3, each agent node extracts the corresponding raw observation data subset from the local database according to the task description, and performs standardized preprocessing on the subset, including coordinate system transformation, timestamp unification, instrument response function correction and bad pixel removal, to form a structured local intermediate dataset; S4, each agent node loads the secure multi-party computation protocol template corresponding to the scientific algorithm identifier. The protocol template defines the number of participants, input and output formats, computation logic topology and key negotiation mechanism. S5, each agent node uses a secret sharing technology to divide the local intermediate dataset into multiple shares based on the protocol template, and distributes the shares to the agent nodes of other participants through a peer-to-peer encrypted channel; S6: After receiving all the shares, all agent nodes will collaboratively execute distributed secure computation according to the computation logic topology defined in the protocol template. The entire computation process will be carried out in an encrypted state and will not expose any plaintext intermediate results. S7. The calculation results are returned to the task coordination center in aggregate form, which may be a statistical summary, model parameters, or an encrypted scientific output file, and contains only the minimum amount of information required by the task.

[0021] Regarding step S1 above, which involves deploying privacy-preserving computation proxy nodes locally at each participating party, with the proxy nodes connected to the local astronomical data storage system via a dedicated high-speed internal bus to ensure that the original observation data does not leave the domain, the specific steps include: S101: Deploy privacy computing agent nodes locally at each participating party. The agent nodes are connected to the local astronomical data storage system via a dedicated high-speed internal bus to ensure that the original observation data does not leave the domain.

[0022] Astronomical observation data are typically stored in high-performance parallel file systems in standard formats such as FITS and HDF5, and their data size can reach TB or even PB levels.

[0023] S102: Directly transmitting such data to an external computing platform not only puts enormous strain on network bandwidth but also poses a risk of the original data being illegally intercepted or copied. Therefore, it is essential to build an isolated and controlled computing environment locally on the data holder's premises.

[0024] To achieve an isolated and controlled computing environment, this embodiment employs the following technical means for construction: At the hardware-level isolation level: The isolated computing environment is built upon a hardware-level trusted execution environment integrated within the central processing unit. Specifically, CPUs supporting Intel SGX or AMD SEV technologies are used to create a secure enclave isolated from the main operating system at the physical hardware level. All sensitive operations involving raw observation data, data shares, and intermediate computation results are confined to this secure enclave. The code and data within the enclave are encrypted using the CPU's built-in memory encryption engine, preventing even attackers with operating system kernel privileges from viewing or tampering with its contents.

[0025] At the system-level control layer: a controlled computing environment is achieved by minimizing the operating system kernel of the agent nodes. Specific pruning measures include: Remove or disable all system services, background processes, and device drivers that are not related to astronomical data processing, network communication, and cryptographic operations.

[0026] Close all network ports except those designated by the Task Coordination Center.

[0027] Integrate a mandatory access control module into the kernel to strictly limit process access permissions to file systems, memory, and CPU resources, ensuring that only authorized pre-built services can run.

[0028] Communication channel isolation layer: The physical connection between the agent node and the local astronomical database is achieved through a dedicated high-speed internal bus. This bus is independent of the bus carrying the public service network, and the data transmitted on it does not pass through the organization's external routers or switches. In this embodiment, the dedicated bus is a fiber optic channel and is configured in a point-to-point direct connection mode, physically isolating access paths from other network devices.

[0029] At the startup and operational control level: the trusted state of the computing environment is established and maintained through a secure boot chain. Upon startup, the agent node first verifies the digital signatures of the bootloader and operating system kernel using the hardware root of trust, ensuring they have not been tampered with. Subsequently, a self-test is executed to verify the TEE's functional status, firmware integrity, and identity certificates. Only after all verifications pass does the agent node load its core service modules and enter a controlled standby state. During operation, all external data exchanges are conducted through predefined encrypted channels and are subject to real-time security monitoring.

[0030] By combining the aforementioned four technologies—hardware isolation, system simplification, dedicated channels, and startup control—a deeply defended, isolated, and controlled computing environment is formed, providing a reliable foundation for the secure processing of raw astronomical data without it leaving the local domain.

[0031] The above steps connect to the local storage system via a dedicated internal bus, preventing the original data from being transmitted outside, thereby fundamentally reducing the risk of data leakage and alleviating the pressure on network bandwidth caused by large-scale data transmission.

[0032] S103: The privacy computing agent node is a dedicated hardware server. Its motherboard integrates a central processing unit that supports a trusted execution environment. This processor has a built-in hardware-level security extension module that can create a secure enclave isolated from the operating system.

[0033] The specific steps involved in establishing a safe enclave are as follows: S103a: Secure Enclave Initialization. Hardware-level security extension modules within the CPU (such as Intel SGX's EnclavePageCache-EPC, or AMDSEV's Secure Encrypted Virtualization Memory Region) are activated. The dedicated enclave management driver on the agent node invokes specific CPU instructions (such as Intel's ECREATE) to delineate a hardware-protected, isolated region in physical memory—the secure enclave. The memory pages in this region are encrypted in real-time by the CPU's built-in memory encryption engine. The encryption key is generated internally by the CPU and does not leave the chip, ensuring that no external software, including the operating system kernel and virtual machine monitor, can directly access or decrypt its contents.

[0034] S103b: Secure Enclave Loading and Measurement. After the secure enclave is created, trusted code (including secret-sharing algorithms, secure multi-party computation protocol execution engines, etc.) used for processing astronomical data and performing secure computations is loaded into the enclave. During this process, the CPU executes a series of extended instructions (such as Intel's EADD and EEXTEND) to calculate the cryptographic hash values ​​of the loaded code and initialization data page by page, forming a unique and tamper-proof enclave metric. This metric is recorded in the enclave's metadata structure as proof of its identity and integrity.

[0035] S103c: Secure Enclave Activation and Security Authentication. Once the enclave is loaded, it is locked and activated by executing specific instructions (such as Intel's EINIT). Afterward, any attempt to access code or data within the enclave must pass the CPU hardware's access control check. When a trusted session needs to be established with the Task Coordination Center or other agent nodes, the enclave can initiate a remote authentication process (such as Intel's EPID or DCAP). In this process, the CPU hardware generates a cryptographic report containing enclave metrics, which is verified by the authentication service to confirm that the parties involved are indeed running in an authentic, intended secure enclave environment, and not simulated malware.

[0036] Through the hardware-instruction-driven initialization, metric loading, and activation authentication processes described above, a secure execution environment, completely isolated from the operating system and guaranteed by hardware enforcement, was successfully created. All sensitive raw observation data, data shares, and intermediate calculation results exist only in plaintext within this secure enclave, ensuring their confidentiality and integrity during processing.

[0037] S104: The agent node provides a Fibre Channel interface via a Fibre Channel Host Bus Adapter (HBA) card installed on its motherboard. This HBA card interacts directly with the central processing unit and memory via a PCIe 4.0 x16 or higher system bus, which is a "dedicated high-speed internal bus" with a theoretical bandwidth sufficient to support data transfer requirements exceeding 100Gbps.

[0038] The Fibre Channel interface connects directly to the core switch or front-end port of the Storage Area Network (SAN) where the local astronomical database is located via a dedicated point-to-point fiber optic link, forming a data transmission channel that is physically isolated from the business network.

[0039] To achieve "direct connection," the data access unit on the proxy node directly reads and writes logical units mapped from the astronomical database storage system in block device access mode via the Fibre Channel driver in the operating system kernel. This architecture bypasses general file servers and TCP / IP network protocol stacks, enabling low-latency, high-bandwidth direct data exchange between the proxy node and the storage device, thereby ensuring that data reading efficiency meets the requirements of processing massive amounts of astronomical data.

[0040] S105: After the agent node starts, it executes a secure boot and self-test procedure based on the hardware root of trust. The specific steps are as follows: After the node powers on, it is first started by a hardware root of trust stored in the CPU or motherboard's read-only memory. This root of trust contains a cryptographic key used to verify the digital signature of the bootloader. Execution is only transferred after the signature verification is successful, confirming that the bootloader has not been tampered with.

[0041] The bootloader then sequentially verifies the digital signatures of the operating system kernel image, the trusted execution environment driver, and the privacy computing core service. Each level of code is only loaded and executed after passing the integrity verification of the previous level, thus forming a traceable chain of trust.

[0042] After the operating system and security enclave are initialized, the self-test program calls specific CPU instructions to read and verify the status register of the hardware security module, confirming that it is in an active and secure state that has not been triggered by errors.

[0043] The self-checking procedure further verifies whether the cryptographic hash value of the firmware version matches the expected value, and verifies whether the node identity certificate issued by the trusted certificate authority is valid and has not been revoked.

[0044] Only when all the above verification steps are successfully completed will the proxy node finally confirm that it is in a trusted state and enter a standby state, ready to receive task instructions. If any verification step fails, the node will terminate the startup process and issue a security alert.

[0045] S106: The agent node is in standby mode, waiting to receive task instructions from the task coordination center.

[0046] In summary, step S1, through local deployment of dedicated hardware nodes, construction of a trusted execution environment, implementation of system minimization, and establishment of high-speed direct connection channels, established a secure and efficient local data computation boundary. This ensures that the original observation data does not leave the domain from the source, laying the physical and logical foundation for subsequent secure collaborative computing. Under this premise, with the proxy nodes of all participants ready, the system can enter the joint analysis task phase uniformly scheduled by the task coordination center.

[0047] In step S2, the task coordination center broadcasts the joint analysis task description to each agent node. The task description includes the target sky area coordinate range, the required data type, the time window, and the scientific algorithm identifier to be executed. Specifically, it includes the following steps. S201: The Task Coordination Center generates a structured joint analysis task description.

[0048] The mission coordination center serves as the central control unit for the entire joint analysis process, and is deployed at a national-level astronomical data center or a coordination node designated by the International Astronomical Union. The mission description uses a structured message format, defining field semantics with JSON Schema, specifically including: The target celestial coordinate range is expressed in right ascension and declination, with an accuracy of no less than arcseconds; The required data types, whose enumerated values ​​include optical images, near-infrared spectra, radio interferograms, X-ray event lists, and star catalog records; The time window is based on International Atomic Time, with start and end times accurate to milliseconds. The scientific algorithm identifier to be executed is a globally unique string that corresponds to a pre-compiled secure multi-party computation protocol template.

[0049] S202: The Task Coordination Center conducts a participant qualification review. After generating the task description and before broadcasting, the Task Coordination Center must complete the participant qualification review to confirm that the organization to which each privacy computing agent node belongs has the corresponding data access permissions and sufficient computing resources required for the task.

[0050] S203: Broadcast the task description via a secure channel. The joint analysis task description is broadcast via a dedicated control plane channel. This channel is configured with a hardware-based security gateway, featuring traffic filtering and intrusion detection capabilities to ensure the integrity and confidentiality of task instructions during transmission, and to provide resistance to replay attacks.

[0051] S204: The agent node receives and verifies the task instruction. After receiving the task description while in standby mode, each agent node first verifies the digital signature of the message to confirm the legitimacy of the instruction's source and that it has not been tampered with. Specifically: During system initialization, each proxy node has pre-configured or dynamically acquired a digital certificate issued by a trusted certificate authority for the task coordination center through secure channels. This certificate contains the task coordination center's identity information and its public key for an asymmetric encryption algorithm. Upon receiving the task description, the proxy node uses the pre-configured public key to verify the cryptographic hash value of the task description data (calculated using the SM3 hash algorithm) against the digital signature attached to the message. Specifically, a verification algorithm corresponding to the signature generation algorithm is used (e.g., if the signature is generated using the SM2 elliptic curve digital signature algorithm, then the SM2 verification algorithm is used here). If the verification passes, it confirms that the task description was indeed issued by a legitimate task coordination center and has not been tampered with during transmission, thus confirming the legitimate source of the instruction. If the verification fails, the message is deemed invalid, and the proxy node discards the task description and returns an authentication failure error message to the task coordination center.

[0052] S205: The proxy nodes perform local feasibility verification. After the signature verification is successful, each proxy node parses the task description and checks whether its local database contains a subset of raw observation data that matches the "target sky area coordinate range," "required data type," and "time window." If the local data meets the task requirements, the proxy node proceeds to step S3; otherwise, it returns a specific error code to the task coordination center and terminates the task.

[0053] S3: Each agent node extracts the corresponding subset of raw observation data from the local database according to the task description, and performs standardized preprocessing on the subset to form a structured local intermediate dataset.

[0054] Specifically, it includes the following sub-steps: S301: Each agent node extracts the corresponding subset of raw observation data from the local astronomical database through its data access unit, based on the "target sky area coordinate range", "required data type" and "time window" specified in the joint analysis task description.

[0055] Specifically, the data access unit reads the required data files in standard formats such as FITS and HDF5 from the astronomical database storage system via a point-to-point direct connection mode through a dedicated fiber optic channel interface established in S104, using a block device direct access method. This process bypasses general file servers and TCP / IP network protocol stacks, achieving efficient and secure data reading through a dedicated hardware channel, ensuring that the raw observation data does not leave the local security domain during the extraction stage.

[0056] S302: Perform coordinate system transformation. To address the inconsistency of physical quantities caused by differences in coordinate reference systems among different astronomical observatories, the coordinate system transformation module performs the transformation from the International Celestial Reference System to the local observation coordinate system. This transformation is achieved by calling pre-built standard astronomical calculation libraries (such as SOFA or IAUstandardsofFundamentalAstronomy functions).

[0057] The specific conversion process includes: First, based on the mission time window, the instantaneous celestial intermediate pole position is calculated using the IAU2000A precession-nutation model; second, based on the geocentric coordinates of the observatory, annual aberration correction is calculated and applied; finally, for high-precision requirements, a relativistic gravitational delay (Shapiro delay) correction is introduced. The above calculation process is completed by an integrated chain of transformation matrices, which is obtained by sequentially multiplying the transformation matrices from each of the above steps.

[0058] S303: The time system conversion and data resampling are performed by the timestamp unification module. First, based on the preset jump-second history of International Atomic Time (TAI) and Coordinated Universal Time (UTC), the local observation time based on UTC is accurately converted into a TAI timestamp. Then, based on the unified TAI time reference, the time series data is resampled using a linear interpolation algorithm, unifying non-uniform or different sampling frequencies to a preset reference frequency (e.g., 10 Hz). This process ensures that the data from all participants are aligned on a unified, continuous time axis, laying the foundation for subsequent joint time-domain analysis.

[0059] The above sub-steps solve the problem of heterogeneity of astronomical data in space (coordinate system) and time (time stamp), providing a unified space-time reference for subsequent collaborative computing.

[0060] S304: The instrument response function correction module calls the pre-stored equipment calibration parameter library to restore the physical dimensions of the original count rate in the subset of original observation data and convert it into a standard flow value in Jansky (Jy) units.

[0061] The specific calibration process is performed according to the following model: Standard flow rate = (original count rate - dark current) / (flat field coefficient × exposure time × quantum efficiency), where: dark current: comes from dark field images acquired under the same environment; flat field coefficient: comes from flat field images obtained from observation of a uniform surface source, used to correct the non-uniformity of response between pixels; quantum efficiency: is the photon conversion efficiency of the detector at different wavelengths, obtained through laboratory calibration.

[0062] All calibration parameters are derived from the factory calibration data of the observation equipment and periodic on-orbit calibration data, and are stored in the parameter library.

[0063] S305: The bad pixel removal module automatically marks invalid pixel regions by querying a pre-stored bad pixel map, which is a binary mask file generated based on historical quality assessment reports. For pixels marked as bad, a median filtering algorithm based on valid neighboring pixels is used for repair; that is, the median value of all valid pixels in the surrounding 3×3 neighborhood of the bad pixel is used to replace it. This repair process is performed directly on the temporarily stored local intermediate dataset within a trusted execution environment, ensuring that invalid data is seamlessly repaired, while the entire process does not leak the original defect information.

[0064] S306: After preprocessing, a subset of the original observation data is transformed into a structured local intermediate dataset. The organization of this dataset (including dimensions, data types, and metadata tags) strictly adheres to the input format specified in the task description. The local intermediate dataset is temporarily stored in the trusted execution environment memory of the proxy node and is not written to any persistent storage. It is deleted after processing to prevent residual information leakage of sensitive data during processing.

[0065] In summary, through the standardized preprocessing in step S3, all participants generated local intermediate datasets with uniform format, consistent physical quantities, and temporary storage in a secure environment, providing reliable and secure input for cross-organizational collaborative computing.

[0066] Building upon this, the system enters the privacy-preserving computation phase. As in step S4, each agent node loads the secure multi-party computation protocol template corresponding to the task to define the subsequent secure computation process. Step S4 specifically includes: S401: Upon receiving a scientific algorithm identifier, the proxy node first calculates a fixed-length hash digest using a pre-defined hash function (such as SHA-256). Then, the proxy node uses this hash digest as the key to query a pre-defined hash mapping table in its read-only memory. This mapping table maintains a direct mapping from the hash digest to the starting address of the protocol template storage. Through this mechanism, the proxy node can quickly locate and prepare to read the corresponding secure multi-party computation protocol template without performing a full database scan.

[0067] S402: Load the located protocol template into the virtualized execution environment of the proxy node. The virtualized execution environment is a lightweight sandbox built on the WebAssembly (WASM) runtime. After the environment starts, it first verifies the integrity of the loaded protocol template bytecode, and then the built-in interpreter dynamically parses the computation graph description and share operation instruction sequence. During the parsing process, the execution environment calls the corresponding underlying cryptographic primitive function library (such as the secret sharing arithmetic library and homomorphic encryption library) according to the instructions, and initializes the computation state according to the security parameter configuration. By confining the entire computation logic to this isolated sandbox, it ensures that the multi-party collaborative computation process strictly follows the definition of the protocol template, thereby guaranteeing the consistency between the computation logic and the security policy.

[0068] S403: The Secure Multi-Party Computation Protocol Template is a pre-compiled bytecode file that serves as the core carrier for transforming specific astronomical algorithms into a provably secure multi-party collaborative computation process. The template contains the following core elements: Computation graph description: Defines the data dependencies and computation order among the participants in the form of a directed acyclic graph; Share operation instruction sequence: specifies the specific arithmetic or logical operation to be performed within the secret shared domain; Security parameter configuration: including finite field size, number of shares, fault tolerance threshold, etc.

[0069] S404: The proxy node initializes its computation state according to the rules defined in the protocol template, following these steps: Based on the "number of participants" and "computational logic topology", establish a point-to-point secure communication link with other agent nodes involved in the task.

[0070] Initialize the local data serialization / deserialization module according to the "input / output format" to ensure data format compatibility.

[0071] Load the “computation graph description” from the template into memory and instantiate it as a schedulable task dependency graph.

[0072] Based on the "Security Parameter Configuration" and "Key Negotiation Mechanism", generate or import the cryptographic materials required for this task (such as public-private key pairs, shared secrets, etc.) to prepare for subsequent share generation and secure computation.

[0073] The above sub-steps complete the entire process from protocol template location to rule application. By transforming the abstract "scientific algorithm identifier" into an executable template containing a specific computation graph, security instructions, and parameters, a precise and secure blueprint is established for subsequent collaborative computation within a secret shared domain.

[0074] S405: Protocol templates are categorized and indexed according to scientific mission type, such as categories like "astronomical cross-identification," "multi-band photometric fitting," and "power spectrum estimation," to enable rapid retrieval and accurate matching.

[0075] Through steps S401 to S404, which involve locating, loading, parsing, and initializing the state of the secure multi-party computation protocol template, each agent node is fully prepared to perform privacy computation, possessing clear participant relationships, computation logic, and security parameters.

[0076] Based on this, as in step S5, each agent node will begin to secretly share the local intermediate dataset based on the loaded protocol template, thereby achieving the secure conversion and distribution of data from plaintext to encrypted share.

[0077] In step S5, each agent node, based on the protocol template, uses secret sharing technology to divide its local intermediate dataset into multiple shares, and distributes these shares to the agent nodes of other participating parties via a peer-to-peer encrypted channel. Specifically, this includes the following sub-steps: S501: Employs a secret sharing scheme based on additive homomorphisms, operating over a finite field of prime order. Prime numbers are greater than twice the maximum absolute value of all possible data values. For a numerical element x, it is divided into n shares s1, s2, ..., s... n Satisfying s1+s2+...+s n ≡x(mod p), where p is the modulus of a finite field and n is the total number of participants. This embodiment adopts a full threshold scheme, meaning that any n-1 shares cannot obtain any information about x, and all n shares are required to reconstruct x.

[0078] S502: For different types of astronomical data, perform the following segmentation operations respectively: Image data: First, divide it into fixed-size tile units. The pixel matrix of each tile unit is flattened into a one-dimensional vector in row-major order. Then, perform share segmentation independently on each element in the vector. Spectral data: indexed by its wavelength channels, the flow value of each channel is independently divided into fractions; Star catalog data: Each celestial body is partitioned into shares based on its position, brightness, and redshift attributes, using its celestial body number as the key.

[0079] The above sub-steps realize the process of converting local astronomical data in various formats into secret shared shares. By combining a unified mathematical foundation with a data-characteristic-oriented partitioning strategy, the availability and security of multimodal data in the secret shared domain are ensured.

[0080] S503: After the share generation is completed, the agent node will distribute the share to other participants according to the following process: The proxy node reuses the peer-to-peer session key established with the target proxy node at task initiation (based on the Diffie-Hellman key exchange protocol). This session key remains valid throughout the task period and is used for encryption of this and all subsequent share transfers.

[0081] For each share of data that needs to be distributed to a specific target agent node, the agent node independently encrypts it using the SM4 block cipher in counter mode. This mode ensures that even when transmitting the same share of data, each encryption will produce a different ciphertext.

[0082] The encrypted share ciphertext is transmitted point-to-point through a dedicated data plane channel physically isolated from the control plane. This channel has a bandwidth of at least 40 gigabits per second to ensure the timeliness of large-scale share distribution.

[0083] S504: Each agent node distributes the encrypted share to the agent nodes of other participants in a peer-to-peer manner to ensure that all participants receive the corresponding data share.

[0084] By dividing and securely distributing the local intermediate dataset in step S5, all participants now hold encrypted data shares from other parties, thus completing the input preparation required for privacy computation.

[0085] Based on this, as in step S6, each proxy node will collaboratively perform distributed secure computation in an encrypted state, according to the computational logic topology defined in the protocol template. After the computation is completed, as in step S7, all parties will aggregate the computation results according to the principle of minimum information content and return them to the task coordination center, thus completing this joint analysis task.

[0086] Specifically, in step S6, after receiving all the shares, all agent nodes collaboratively execute distributed secure computation according to the computational logic topology defined in the protocol template. This includes the following: S601: After the secure computing execution unit loads the protocol template in the trusted execution environment, it establishes the secure computing environment by following these steps: Parse the computational logic topology: Read the computational graph description (stored in a directed acyclic graph format) in the protocol template, parse it into a graph data structure in memory, and clarify the computational task dependencies of each participant; Constructing a collaborative state machine: Based on the computational topology obtained from the analysis, a multi-party collaborative state machine is initialized. This state machine includes four states: "to be executed", "in computation", "waiting for synchronization", and "completed". It exchanges state information with other nodes through the control plane. Registration computation operation: Based on the share operation instruction sequence in the protocol template, register the corresponding cryptographic primitive operation functions in the secure computing environment and establish a memory mapping table from instruction to function.

[0087] S602: For different types of astronomical science missions, the following corresponding secure computing protocols shall be executed respectively: For the task of cross-identifying celestial positions: each party maps its local set of celestial numbers into a hash tree using a hash function; exchanges hash tree node information through an unintentional transmission extension protocol; compares the hash tree structure, identifies and outputs the shared celestial number ciphertext.

[0088] For the multi-band photometric joint fitting task: each agent node locally calculates the encrypted shares of XᵀX and Xᵀy within the share domain; secure matrix multiplication is achieved using Beaver triples; matrix inversion is performed within the share domain using Gaussian elimination; and the encrypted shares of the fitting coefficient β are obtained by aggregation.

[0089] For the task of estimating the power spectrum of large-scale structures in the universe: each agent node performs a fast Fourier transform on the local density field in the share domain; data superposition is performed in the frequency domain using the additive homomorphism property; and the power spectrum P(k) = <|δ(k)| is calculated. 2 >The encrypted share.

[0090] S603: During the computation process, each agent node ensures computational security and reliability through the following mechanisms: After each node completes a computation phase, it broadcasts a hash value containing the identifier of the current phase as a synchronization signal through the control plane. All nodes will only enter the next phase after receiving the synchronization signals from other participants. At the beginning of each computation phase, each node uses a random number as a commitment and broadcasts its hash value to other nodes. In subsequent computations, this random number must be made public to prove the continuity of the computation behavior. After each critical computation step, each node generates a non-interactive zero-knowledge proof demonstrating that its computational behavior in this step conforms to the protocol specifications. Other nodes verify the validity of this proof. If verification fails, the computation task is terminated.

[0091] S604: All intermediate results in the computation process exist in the form of shares and are not restored to plaintext at any node, ensuring that the entire computation is carried out in an encrypted state and that no plaintext intermediate results are exposed.

[0092] Regarding step S7: The calculation results are returned to the task coordination center in aggregate form, containing only the minimum amount of information required by the task. Specifically, this includes: S701: After receiving the result shares uploaded by each agent node, the task coordination center verifies them according to the following steps: Integrity verification: For each received share data packet, calculate its SM3 hash value and compare it with the hash value attached to the share during transmission to ensure that the data has not been tampered with or damaged during transmission.

[0093] Consistency verification: Check whether the result shares submitted by all participants conform to the expected data format and dimensions of the protocol template. For model parameters that need to be aggregated, further verify whether the shares submitted by each node originate from the same computation task, for example, by verifying whether the task ID signatures attached to the shares are consistent.

[0094] S702: The task coordination center automatically identifies and distributes the received results based on the predefined result type identifier obtained from the protocol template. If the result type identifier indicates a statistical summary (such as number of celestial bodies, mean redshift, total luminosity, etc.), it will be published directly. These results are aggregated macroscopic statistics and do not contain information that identifies individual data. If the result type identifier indicates a model parameter or scientific output file, then proceed to the next step, S703, the reconstruction process.

[0095] Through the above mechanisms, the system enables the direct release of non-sensitive data and further secure processing of sensitive data.

[0096] S703: For model parameters or scientific output files that require reconstruction, the mission coordination center performs the reconstruction in an isolated, secure computing environment by following these steps: Prepare the reconstruction parameters: Assign a unique non-zero identity identifier idᵢ (e.g., 1, 2, ..., n) to each participant as an element in a finite field.

[0097] Calculate the Lagrange coefficients: Based on identity, calculate the Lagrange coefficient λᵢ for each participant using the following formula: λᵢ=Π_{1≤j≤n,j≠i}(id_j / (id_j-id_i))modp Where p is the finite field modulus consistent with the secret sharing scheme.

[0098] Execute share reconstruction: Collect all n result shares s1, s2, ..., s n , using the formula x=Σᵢ =1 n sᵢ·λᵢmodp reconstructs the plaintext result x over a finite field.

[0099] S704: After reconstruction, the system processes the results and data according to the following steps: Automatic report generation: Within the same trusted execution environment after the reconstruction operation is completed, plaintext results are automatically imported into a preset scientific report template to generate a final scientific report containing charts, parameter tables, and uncertainty analysis.

[0100] Secure data destruction: Upon report generation, the system immediately performs an overwrite operation (at least once) on the original share and the reconstructed plaintext result stored in memory, and then releases memory resources. The entire process is completed in the isolated secure computing environment of the task coordination center, ensuring that no original share or intermediate plaintext data is left behind.

[0101] S705: After completing the result processing, the Task Coordination Center performs the following audit log operations: Log recording: The complete audit log, including task ID, participant list, protocol template hash, calculation time and result hash, is appended to the append-only tamper-proof log system.

[0102] Log protection: Immediately calculate the SM3 hash of the recorded log entries and anchor the hash value to the blockchain or submit it to a trusted timestamp service organization such as the National Time Service Center to ensure the integrity and timeliness of the logs.

[0103] Traceability review: When compliance review is required, authorized personnel can query relevant log records through the audit interface based on task ID or participant identity, and verify the integrity and authenticity of the logs by verifying the hash chain and timestamp.

[0104] This method, through the aforementioned seven interconnected steps, systematically resolves the security and availability contradictions faced by astronomically sensitive data in cross-institutional joint analysis, ultimately achieving a high-precision, secure collaborative analysis effect of "data not leaving the domain and usable but not visible," providing a solid technical guarantee for scientific research collaboration in the astronomical field.

[0105] Secondly, the privacy-preserving computation-based astronomical sensitive data security processing system disclosed in this embodiment includes: a privacy-preserving computation agent node cluster deployed locally at each astronomical data holder, a task coordination center server, and a high-bandwidth, low-latency dedicated communication network connecting each node. The privacy-preserving computation agent node cluster includes a data access unit, a preprocessing unit, a protocol loading unit, a share generation and distribution unit, a secure computation execution unit, and a result share management unit. The data access unit connects to the local astronomical database via a fiber optic interface, supporting direct reading of standard astronomical data formats such as FITS and HDF5, and features a built-in hardware acceleration engine for zero-copy data transmission. The preprocessing unit incorporates a coordinate transformation engine, a time synchronization module, an instrument calibration parameter library, and a data quality evaluator to generate standardized intermediate datasets that meet task requirements; all preprocessing operations are completed within a trusted execution environment. The protocol loading unit stores a pre-compiled secure multi-party computation protocol template library, categorized and indexed by scientific task type, and uses read-only memory to prevent tampering. The share generation and distribution unit integrates the core secret sharing algorithm and the national cryptographic SM4 encryption engine, responsible for data share generation, encryption, and point-to-point transmission, supporting parallel share processing to improve throughput. The secure computation execution unit comprises a virtualized execution environment capable of dynamically loading protocol templates and scheduling multi-party collaborative computation tasks. It also features a built-in security status monitor that detects abnormal behavior in real time. The result share management unit temporarily stores result shares generated by local computation and responds to share revocation requests from the task coordination center, employing memory encryption technology to protect share storage security. The task coordination center server includes a task scheduler, protocol distributor, result aggregator, and audit log recorder, responsible for the control and traceability of the entire collaborative analysis process. Its hardware platform has passed the national commercial cryptography product certification.

[0106] Furthermore, the dedicated communication network adopts a dual-plane architecture. The control plane transmits task instructions, protocol templates, and key negotiation messages, while the data plane transmits encrypted data shares. The two planes are physically isolated, deployed on independent fiber optic links, and configured with hardware-based security gateways for traffic filtering and intrusion detection. The control plane employs a low-latency design to ensure task synchronization accuracy; the data plane utilizes a high-bandwidth design to support terabyte-level data share transmission. The network topology is a star structure, with the task coordination center located at the central node and each agent node serving as an edge node, avoiding the security risks introduced by multi-hop transmission.

[0107] Furthermore, each agent node in the privacy computing agent node cluster runs within a trusted execution environment (TEA). This TEA is built on hardware-level security extensions embedded in the central processing unit (CPU), ensuring that the share generation, computation, and storage processes are not spied on or tampered with by the operating system or other applications. The agent node's operating system kernel is minimally trimmed, retaining only the drivers and service modules necessary for network communication, cryptographic operations, and astronomical data processing. All sensitive operations are executed within a secure enclave, and memory access is protected by a hardware memory encryption engine to prevent cold start attacks and side-channel leaks.

[0108] Furthermore, this application provides a privacy-preserving computation-based secure processing device for astronomically sensitive data. This device includes the aforementioned first deployment module, second task broadcasting module, third data preprocessing module, fourth protocol loading module, fifth share processing module, sixth secure computation module, and seventh result return module. These modules can be implemented in software, hardware, or a combination of both, and deployed in a task coordination center or various privacy-preserving computation proxy nodes to collaboratively complete the secure processing flow of astronomically sensitive data. For example, the first deployment module is responsible for initializing the local proxy node environment; the second task broadcasting module parses and distributes task descriptions; the third data preprocessing module performs data standardization; the fourth protocol loading module dynamically loads the computation protocol; the fifth share processing module generates and encrypts data shares; the sixth secure computation module coordinates multi-party secure computation; and the seventh result return module aggregates and returns results. Through modular design, this device achieves efficient execution of method steps and optimized utilization of system resources.

[0109] Finally, this application provides a computer-readable storage medium, which may be a disk, optical disk, solid-state drive, or cloud storage medium, on which a computer program is stored. When the program is loaded and executed, it enables the computer to implement the aforementioned privacy-based computation-based secure processing method for astronomically sensitive data. The storage medium may also include an encrypted area or a read-only area to protect the integrity and security of the program code.

[0110] In summary, this invention achieves secure collaborative analysis of sensitive astronomical data under the principle of "usable but invisible" by constructing an end-to-end privacy computing framework. The original observational data remains within the local security domains of each participating party, fundamentally eliminating the source of data leakage. The technical approach combining secret sharing and secure multi-party computation avoids the enormous computational overhead of homomorphic encryption and overcomes the drawback of differential privacy, which introduces random noise that reduces scientific accuracy. Addressing the multimodal characteristics of astronomical data, share partitioning and secure computation protocols are designed for different data types such as images, spectra, and star catalogs, ensuring the universality and efficiency of data processing. Through a pre-defined science-task-oriented computational logic topology, complex astronomical analysis algorithms are transformed into provably secure multi-party collaborative computation processes, significantly improving the efficiency and security of cross-institutional scientific collaboration. The entire system architecture deeply integrates a hardware-level trusted execution environment and national cryptographic algorithms, meeting national compliance requirements for the security of critical scientific data and providing a solid technical foundation for future large-scale sky surveys, space telescope arrays, and international astronomical cooperation.

[0111] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention. Therefore, the embodiments should be regarded as exemplary and non-limiting in all respects.

[0112] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A method for secure processing of astronomical sensitive data based on privacy computation, characterized in that, Comprise: Deploy privacy computing agent nodes locally at each participant, which are connected with local astronomical data storage systems through a dedicated high-speed internal bus; Broadcast joint analysis task descriptions to each privacy computing agent node from the task coordination center, which contain target sky region coordinate ranges, required data types, time windows, and scientific algorithm identifiers to be executed; Each privacy computing agent node extracts corresponding subsets of raw observation data from local databases according to joint analysis task descriptions, and performs standardization preprocessing on the subsets to form structured local intermediate data sets; Each privacy computing agent node loads a secure multi-party computation protocol template corresponding to the scientific algorithm identifier, which defines the number of participants, input and output formats, computing logic topology, and key negotiation mechanism; Each privacy computing agent node splits the local intermediate data set into multiple shares based on the secure multi-party computation protocol template using secret sharing technology, and distributes the shares to privacy computing agent nodes of other participants through point-to-point encrypted channels; After receiving all shares, all privacy computing agent nodes perform distributed secure computation according to the computing logic topology defined in the secure multi-party computation protocol template, and the entire process is carried out in an encrypted state without exposing any plaintext intermediate results; The computing results are returned to the task coordination center in aggregated form, which is a statistical summary, model parameters, or encrypted scientific output file, and only contains the minimum amount of information required by the task.

2. The privacy computing-based astronomical sensitive data security processing method according to claim 1, characterized in that, Deploy privacy computing agent nodes locally at each participant, which are connected with local astronomical data storage systems through a dedicated high-speed internal bus, ensuring that raw observation data does not leave the domain, including: The privacy computing agent node runs in a trusted execution environment based on the hardware-level security extension built into the central processing unit; The privacy computing agent node is directly connected to the local astronomical database through a fiber channel interface, which works on a dedicated high-speed internal bus; The operating system kernel of the privacy computing agent node is minimized and only retains the necessary drivers and service modules for network communication, cryptographic operations, and astronomical data processing.

3. An astronomical sensitive data security processing system based on privacy computing, characterized in that, Comprise: Deploy privacy computing agent node clusters locally at each astronomical data holder, a task coordination center server, and a high-bandwidth low-latency dedicated communication network connecting each node; The privacy computing agent node cluster includes a data access unit, a preprocessing unit, a protocol loading unit, a share generation and distribution unit, a secure computation execution unit, and a result share management unit; The data access unit is connected to the local astronomical database through a fiber channel interface, supporting direct reading of FITS and HDF5 standard astronomical data formats; The preprocessing unit has a coordinate conversion engine, a time synchronization module, an instrument calibration parameter library, and a data quality evaluator for generating structured local intermediate data sets; The protocol loading unit stores a pre-compiled secure multi-party computation protocol template library, which is indexed by scientific task type; The share generation and distribution unit integrates the core of the secret sharing algorithm and the national cryptographic SM4 encryption engine, and is responsible for the generation, encryption and peer-to-peer transmission of data shares; The secure computing execution unit includes a virtualized execution environment for dynamically loading protocol templates and scheduling multi-party collaborative computing tasks; The result share management unit is used to temporarily store the result shares generated by local computation and to respond to share reclamation requests from the task coordination center. The task coordination center server includes a task scheduler, protocol distributor, result aggregator, and audit log recorder.

Images