Data query system and method based on privacy calculation, medium, and device

Abstract

This disclosure relates to a data query system, method, medium, and device based on privacy computing, belonging to the field of big data processing technology. The method includes: a first device corresponding to a query request initiator and a second device corresponding to a query request responder; wherein: the first device is used to perform privacy intersection calculation on a first set of identifiers and a second set of identifiers corresponding to second user privacy data to obtain an intersection alignment result; the second device is used to construct a responder identifier index and a responder data packet based on the intersection alignment result; the first device is used to construct a queryer identifier index based on the responder data packet and the intersection alignment result, and determine a target user identifier corresponding to the original user identifier to be queried based on the queryer identifier index; the second device is used to perform data query based on the target user identifier to be queried and the responder identifier index. This disclosure improves the security of user privacy data.

Description

Technical Field

[0001] This disclosure relates to the field of big data processing technology, and more specifically, to a data query system based on privacy computing, a data query method based on privacy computing, a computer-readable storage medium, and an electronic device. Background Technology

[0002] In personal data query scenarios, querying organizations need to initiate queries against specific user identifiers to obtain data such as scores or verification results. However, this method has the following drawbacks: it increases the frequency of sensitive data leaving the domain and expands the attack surface, thereby reducing the security of user privacy data.

[0003] It should be noted that the information in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] The purpose of this disclosure is to provide a privacy-based computing-based data query system, a privacy-based computing-based data query method, a computer-readable storage medium, and an electronic device, thereby overcoming, to at least some extent, the problem of low security of user privacy data caused by the limitations and defects of related technologies.

[0005] According to one aspect of this disclosure, a data query system based on privacy computing is provided, comprising: a first device corresponding to a query request initiator and a second device corresponding to a query request responder, wherein the first device and the second device are communicatively connected; the first device holds first user privacy data, and the second device holds second user privacy data; wherein: the first device is configured to generate a first identifier set based on the first user privacy data, and perform privacy intersection on the first identifier set and the second identifier set corresponding to the second user privacy data to obtain an intersection alignment result; the second device is configured to construct a responder identifier index and a responder data packet based on the intersection alignment result; the responder data packet includes at least a responder identifier checksum and a target identifier set in the intersection alignment result; the first device is configured to construct a queryer identifier index based on the responder data packet and the intersection alignment result, and determine a target user identifier corresponding to the original user identifier to be queried based on the queryer identifier index; the second device is configured to perform a data query based on the target user identifier to be queried and the responder identifier index, and feed back the obtained data query result to the first device.

[0006] In one exemplary embodiment of this disclosure, the first device is further configured to: perform de-identification processing on the first user privacy data to obtain a first de-identification processing result; the first user privacy data includes a first user unique identifier and / or a first device unique identifier; and sort the first de-identification processing result based on a preset sorting rule to obtain a first identifier set, or bin the first de-identification processing result based on a preset binning rule to obtain a first identifier set; the second device is further configured to: perform de-identification processing on the second user privacy data to obtain a second de-identification processing result; the second user privacy data includes a second user unique identifier and / or a second device unique identifier; and sort the second de-identification processing result based on a preset sorting rule to obtain a second identifier set, or bin the second de-identification processing result based on a preset binning rule to obtain a second identifier set.

[0007] In one exemplary embodiment of this disclosure, the second device is further configured to: parse the intersection alignment result to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, the target unique identifiers being de-identified unique identifiers; match the original unique identifier of the response end corresponding to the target unique identifier from the second user privacy data; the original unique identifier of the response end is a unique identifier that has not undergone de-identification processing; and construct a response end identifier index and a response end data packet based on the target unique identifier and the original unique identifier of the response end.

[0008] In one exemplary embodiment of this disclosure, the second device is further configured to: establish a response end identifier mapping relationship between the target unique identifier and the original unique identifier of the response end, and generate a response end identifier index based on the response end identifier mapping relationship; generate a response end identifier check code corresponding to the target unique identifier based on the original unique identifier of the response end, and generate the response end data packet according to the response end identifier check code and the target unique identifier.

[0009] In an exemplary embodiment of this disclosure, the first device is further configured to: parse the intersection alignment result to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, the target unique identifiers being de-identified unique identifiers; match the original unique identifier of the request end corresponding to the target unique identifier from the first user privacy data; the original unique identifier of the request end is a unique identifier that has not undergone de-identification processing; and construct the query end identifier index based on the response end data packet, the original unique identifier of the request end, and the target unique identifier.

[0010] In an exemplary embodiment of this disclosure, the first device is further configured to: generate a request end identifier check code based on the original unique identifier of the request end, and compare the consistency between the response end identifier check code in the response end data packet and the request end identifier check code; in response to the consistency comparison result being consistent with the response end identifier check code and the request end identifier check code, establish a request end identifier mapping relationship between the original unique identifier of the request end and the target unique identifier, and construct the query end identifier index based on the request end identifier mapping relationship.

[0011] In one exemplary embodiment of this disclosure, the first device is further configured to: invoke a preset checksum generation model, and input the original unique identifier of the requesting end and the preset model prompt information into the preset checksum generation model to obtain the requesting end identifier checksum.

[0012] In one exemplary embodiment of this disclosure, the first device is further configured to: in response to an input operation on a data query interface, determine an original user identifier to be queried and a data query category; the original user identifier to be queried is a unique identifier that has not undergone de-identification processing; determine a target user identifier to be queried corresponding to the original user identifier to be queried based on the query interface identifier index; the target user identifier to be queried is a unique identifier after de-identification; generate a data query request according to the target user identifier to be queried and the data query category, and send the data query request to the second device.

[0013] In one exemplary embodiment of this disclosure, the second device is further configured to: parse the data query request to obtain a target user identifier and a data query category; determine a response terminal query identifier associated with the target user identifier based on the response terminal identifier index; the response terminal query identifier is a unique identifier that has not undergone de-identification processing; generate one or more data query tasks according to the response terminal query identifier and the data query category, and execute the data query tasks to perform data queries and obtain data query results.

[0014] According to one aspect of this disclosure, a data query method based on privacy computing is provided, configured on a first device corresponding to a query request initiator, the first device holding first user privacy data. The method includes: generating a first identifier set based on the first user privacy data, and receiving a second identifier set sent by a second device corresponding to a query request responder; the second identifier set is generated based on the second user privacy data held by the second device; performing privacy intersection on the first identifier set and the second identifier set to obtain an intersection alignment result, and receiving a response data packet generated by the second device based on the intersection alignment result; the response data packet includes at least a response identifier checksum and a target identifier set from the intersection alignment result; constructing a query identifier index based on the response data packet and the intersection alignment result, and determining a target user identifier corresponding to the original user identifier to be queried based on the query identifier index; sending the target user identifier to the second device, and receiving a data query result obtained by data query based on the target user identifier and the response identifier index sent by the second device.

[0015] According to one aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the data query method based on privacy computing as described in any of the preceding claims.

[0016] According to one aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the privacy-based computation-based data query method described above by executing the executable instructions.

[0017] This disclosure provides a privacy-based data query system. Firstly, a first device generates a first identifier set based on first user privacy data, and performs a privacy intersection calculation on the first identifier set and a second identifier set corresponding to second user privacy data to obtain an intersection alignment result. Then, a second device constructs a response identifier index and a response data packet based on the intersection alignment result. Next, the first device constructs a query identifier index based on the response data packet and the intersection alignment result, and determines a target user identifier corresponding to the original user identifier to be queried based on the query identifier index. Finally, the second device... Data queries are performed using user identifiers and response end identifier indexes, and the results are fed back to the first device. Since data queries can be performed based on de-identified user identifiers, sensitive data is prevented from leaving the domain and the attack surface is avoided, improving the security of user privacy data. Furthermore, because the first and second devices construct data packets based on the same intersection alignment result, the problem of low accuracy in data query results can be avoided, as de-identified unique identifiers are often generated and maintained by a single organization, thus only valid within that organization and unable to be directly used to locate the same person across organizations. This improves the accuracy of data query results.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 The diagram illustrates an example architecture of a privacy-based computation-based data query system according to an example embodiment of the present disclosure.

[0021] Figure 2 An example diagram illustrating a first user privacy data according to an exemplary embodiment of this disclosure is shown.

[0022] Figure 3 An example diagram illustrating a second user privacy data according to an exemplary embodiment of this disclosure is shown.

[0023] Figure 4 The diagram illustrates a scenario example of a hash value mapping result obtained according to an example embodiment of the present disclosure.

[0024] Figure 5 The diagram illustrates a scenario example of a data query interface displayed according to an exemplary embodiment of the present disclosure.

[0025] Figure 6 The diagram illustrates a scenario example of data query results displayed according to an exemplary embodiment of the present disclosure.

[0026] Figure 7 The diagram illustrates a flowchart of a data query method based on privacy computing according to an example embodiment of the present disclosure.

[0027] Figure 8 The illustration shows an example diagram of an electronic device for implementing a privacy-based computation data query method according to an example embodiment of the present disclosure. Detailed Implementation

[0028] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0029] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0030] Privacy-preserving computation enables data to be usable but not visible while ensuring security and compliance during the data computation process. Based on this, privacy-preserving computation is widely used in cross-institutional data collaboration in various business scenarios such as financial risk control, anti-fraud, marketing evaluation, and data verification.

[0031] In some example implementations, in personal data query scenarios, the querying organization (e.g., the data service requester) needs to initiate a query targeting a specific user identifier to the queried organization (e.g., the data service provider) to obtain data such as scores or verification results. In other example implementations, in the financial industry, represented by banks, due to compliance requirements, sensitive data such as personal identification information (e.g., mobile phone numbers, ID numbers, and email addresses) are usually de-identified, and when accessing third-party data service providers, only Sensitive Information De-identification (SID) can be sent.

[0032] However, existing solutions face the following challenges: Firstly, the scope of de-identified unique identifiers is limited. Specifically, since de-identified unique identifiers are often generated and maintained by a single organization, they are only valid within that organization and cannot be directly used to locate the same person across organizations, resulting in low accuracy of data query results. Secondly, the mapping relationship cannot go beyond the domain. That is, the mapping relationship between unique identifiers and plaintext personal identification information is highly sensitive data and therefore cannot be transmitted in plaintext across organizations. Even transmitting hash values ​​faces risks of enumeration, credential stuffing, and compliance audits. Thirdly, the online query chain is highly sensitive. That is, if each online call requires the querying organization to upload identification information that can be associated with the individual, it will increase the frequency of sensitive data going beyond the domain and the attack surface, and increase application costs.

[0033] Therefore, a de-identified data query scheme is needed to overcome the scope limitations of de-identified unique identifiers without transmitting personal identification information and its mapping relationships in plaintext across institutions, and to provide a highly available online query service. Based on this, this disclosure first provides a data query system based on privacy computing. Specifically, refer to... Figure 1As shown, the privacy-based data query system may include a first device 110 corresponding to the query request initiator and a second device 120 corresponding to the query request responder, with the first device and the second device connected communicatively. The first device holds first user privacy data, and the second device holds second user privacy data. In practical application, the first device generates a first identifier set based on the first user privacy data and performs a privacy intersection calculation on the first identifier set and the second identifier set corresponding to the second user privacy data to obtain an intersection alignment result. The second device constructs a response identifier index and a response data packet based on the intersection alignment result. The response data packet includes at least a response identifier checksum and a target identifier set from the intersection alignment result. The first device constructs a query identifier index based on the response data packet and the intersection alignment result, and determines a target user identifier corresponding to the original user identifier based on the query identifier index. The second device performs a data query based on the target user identifier and the response identifier index, and feeds back the obtained data query result to the first device.

[0034] In the aforementioned privacy-based computation-based data query system, on one hand, a first identifier set is generated by a first device based on the first user's privacy data, and a privacy intersection is performed on the first identifier set and the second identifier set corresponding to the second user's privacy data to obtain an intersection alignment result; then, a response identifier index and a response data packet are constructed by the second device based on the intersection alignment result; next, a query identifier index is constructed by the first device based on the response data packet and the intersection alignment result, and a target query user identifier corresponding to the original query user identifier is determined based on the query identifier index; finally, the target query user identifier is determined by the second device based on the target query user identifier. The system uses the identifier and response end identifier index to perform data queries and feeds back the results to the first device. Since data queries can be performed based on de-identified user identifiers, sensitive data is prevented from leaving the domain and attack surface, thus improving the security of user privacy data. On the other hand, since the first and second devices construct data packets based on the same intersection alignment results, the system avoids the problem that de-identified unique identifiers are often generated and maintained by a single organization, thus only valid within that organization and cannot be directly used to locate the same person across organizations, resulting in low accuracy of data query results. This improves the accuracy of data query results.

[0035] The following will provide a detailed explanation and description of the privacy-based data query system described in the exemplary embodiments of this disclosure, in conjunction with the accompanying drawings.

[0036] First, the technical implementation principles of the exemplary embodiments of this disclosure will be explained and described. Specifically, the privacy-based computation-based data query system described in the exemplary embodiments of this disclosure can perform data queries using a privacy-based computation-based de-identification data query method. In practical applications, data queries can be implemented using a two-stage approach: offline SID alignment and online SID query. Based on the privacy-based computation-based data query system described in the exemplary embodiments of this disclosure, at least the following technical problems can be solved: On the one hand, under the condition that the querying institution can only provide de-identified unique identifiers (SIDs) to the outside world, the queried institution can provide data query services. On the other hand, without transmitting mapping relationship data across institutions in plaintext, cross-institutional data set alignment and the set of de-identified unique identifiers (SIDs) of the intersection part can be achieved. Furthermore, in the online stage, the querying institution only needs to transmit the SID to complete the query request for the specified data and return the result.

[0037] Secondly, the query request initiator and query request responder involved in the exemplary embodiments of this disclosure will be explained and described. Specifically, the query request initiator described herein may also be referred to as the query agency, which holds the first user privacy data (the first user privacy data can be specifically referred to...). Figure 2 As shown in the example, the first user privacy data can be a set of all user identifiers to be queried, or it can be a set of some user identifiers to be queried. This example does not impose any special restrictions on this. In practical applications, the query request initiator can deploy the privacy computing platform using a peer-to-peer network deployment method, or it can deploy it by embedding a lightweight client (Client-SDK) into the existing business system.

[0038] Furthermore, the respondent of the query request described herein can also be referred to as the queried entity; the queried entity holds second user privacy data (the specific details of which can be found in [reference needed]). Figure 3 As shown in the figure, and the model score or verification result corresponding to the second user privacy data; in actual application, this query agency needs to deploy server nodes to provide privacy computing services such as Private Set Intersection (PSI) and online query interface services. It should also be noted that the first device and the second device mentioned above can be clients and servers in user consumption scenarios, clients and servers in risk prediction scenarios, clients and servers in medical scenarios, etc., and this example does not impose any special restrictions on them.

[0039] In one possible example embodiment, the model score described above may be a model score obtained by predicting the user based on the corresponding user data using a corresponding deep neural network model or decision tree model; based on the model score, the user's consumption category, risk category, or disease category, etc., can be determined, and this example does not impose any special limitations on this; the verification result described above may be the result obtained by further verifying the user based on the corresponding deep neural network model or decision tree model using the corresponding user data, etc.

[0040] The following will combine Figure 2 as well as Figure 3 right Figure 1 The privacy-based computation-based data query system shown will be further explained and illustrated. Specifically:

[0041] In one example embodiment, the specific process for determining the first identifier set described above is as follows: the first user privacy data is de-identified to obtain a first de-identification processing result; the first user privacy data includes a first user unique identifier and / or a first device unique identifier; and the first de-identification processing result is sorted based on a preset sorting rule to obtain a first identifier set, or the first de-identification processing result is binned based on a preset binning rule to obtain a first identifier set. Further, the specific process for determining the second identifier set is as follows: the second user privacy data is de-identified to obtain a second de-identification processing result; the second user privacy data includes a second user unique identifier and / or a second device unique identifier; and the second de-identification processing result is sorted based on a preset sorting rule to obtain a second identifier set, or the second de-identification processing result is binned based on a preset binning rule to obtain a second identifier set.

[0042] In one example embodiment, the determination processes for the first and second identifier sets are both completed offline. In practical applications, after the first and second devices normalize the personal identifier information, they can calculate de-identified identifiers and form sets; they can then be sorted or binned according to agreed-upon rules to obtain the first and second identifier sets. Further, using first user privacy data as an example, the specific determination process for the first identifier set will be explained and illustrated further.

[0043] First, the first user privacy data is de-identified to obtain the first de-identification result (i.e., SID). Specifically, the first user privacy data recorded here may include, but is not limited to, the user's mobile phone number, device identifier, and identification number (such as ID card number, bank card number, or other identification number, etc.), or a combination of mobile phone number, device identifier, and identification number, etc. The core of the de-identification process recorded here is to eliminate the ability of data to directly / indirectly identify natural persons while retaining the data's value for use in business, and the processed data can be reversibly restored using the key (as opposed to irreversible anonymization). Under this premise, the de-identification process can be implemented using MD5+SHA256 (hash, used to generate identifiers), and the key system used can be a master key (MK) + data key (DK) for hierarchical management.

[0044] Secondly, the first de-identification processing result is sorted according to a preset sorting rule to obtain a first identifier set. Specifically, the goal of the sorting process described here is to arrange the first de-identification result (including SID) in an ordered manner according to the preset rule, generating a structured and traceable first identifier set, preserving business relevance value and not leaking privacy. Based on this, the specific sorting process can be implemented as follows: First, a preset sorting rule (preset rule) is defined. Specifically, the preset sorting rule described here may include, but is not limited to, sorting dimensions, sorting directions, and priorities. At the same time, the preset sorting rule is only based on the de-identified data fields (i.e., the first de-identification processing result, and the use of the first user privacy data is prohibited). Second, the first identifier set is obtained by performing a specific sorting operation. During the sorting process, a sorting task can be generated according to the sorting dimension, the priority of the dimension, and the sorting direction. Executing the sorting task will obtain the first identifier set.

[0045] Furthermore, the first de-identification processing result is bucketed based on a preset bucketing rule to obtain a first identifier set. This can be achieved as follows: based on the hash value included in the first de-identification processing result, the first de-identification processing result is mapped to the hash bucket corresponding to that hash value to obtain the first identifier set; wherein, the obtained hash value mapping result can be referenced... Figure 4 As shown.

[0046] It should be further explained here that the specific process of determining the second set of identifiers is similar to that of determining the first set of identifiers, and will not be elaborated further here.

[0047] In one example embodiment, obtaining the intersection alignment result by performing privacy set intersection on the first identifier set and the second identifier set corresponding to the second user privacy data can be achieved as follows: First, for the first device, after receiving the second identifier set sent by the second device, it can generate a privacy set intersection (PSI) task based on the combination of the first identifier set and the second identifier; on this basis, executing the privacy set intersection task can obtain the intersection ID alignment result (i.e., the intersection alignment result) without disclosing the respective non-intersection IDs; Second, for the second device, after receiving the first identifier set sent by the first device, it can generate a privacy set intersection (PSI) task based on the combination of the first identifier set and the second identifier; on this basis, executing the privacy set intersection task can obtain the intersection ID alignment result (i.e., the intersection alignment result) without disclosing the respective non-intersection IDs. It should be noted that in practical applications, the first and second devices can each perform the Privacy Set Intersection (PSI) task separately; alternatively, the first device can perform the PSI task and then feed back the intersection alignment result to the second device. In practical applications, the appropriate implementation method can be selected according to actual needs, and this example does not impose any special restrictions on this.

[0048] It should be noted that if the first device has a newly added ID set, and if the intersection alignment result needs to be calculated, only incremental PSI and incremental mapping can be executed, reducing the need for full redundant calculations. Furthermore, if the first device consists of multiple different querying organizations, each querying organization (i.e., the second device) can maintain its own SID system or version space corresponding to each querying organization.

[0049] In one example embodiment, the aforementioned response end identifier index and response end data packet are generated as follows: The intersection alignment result is parsed to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, which are de-identified unique identifiers; the original unique identifier of the response end corresponding to the target unique identifier is matched from the second user privacy data; the original unique identifier of the response end is a unique identifier that has not undergone de-identification processing; and the response end identifier index and response end data packet are constructed based on the target unique identifier and the original unique identifier of the response end. Specifically, the process of establishing the response end index identifier is as follows: a response end identifier mapping relationship is established between the target unique identifier and the original unique identifier of the response end, and a response end identifier index is generated based on the response end identifier mapping relationship; simultaneously, the process of establishing the response end data packet is as follows: a response end identifier checksum corresponding to the target unique identifier is generated based on the original unique identifier of the response end, and the response end data packet is generated based on the response end identifier checksum and the target unique identifier. In practical applications, the second device establishes a mapping table T_A (i.e., the response end index identifier) ​​for the target unique identifier in the intersection alignment result within its own domain: SID → ID index (or internal primary key). This mapping table remains within the domain and is stored only on the second device. Based on this, the second device also needs to generate a mapping relationship data packet (i.e., the response end data packet) M and send it to the querying agency (i.e., the first device). M contains at least: a de-identified unique identifier SID (i.e., the target unique identifier) ​​and a response end identifier checksum CHK corresponding to that unique identifier. The response end identifier checksum CHK is used to verify the consistency of the target unique identifier held by both parties when establishing a "local ID-ID" (i.e., the query end identifier index) relationship on the querying agency (i.e., the first device) side, thereby improving the accuracy of the data query results.

[0050] In one possible example embodiment, the specific generation process of the response end identifier checksum can be implemented as follows: A preset checksum generation model is invoked, and the original unique identifier of the response end and preset model prompt information are input into the preset checksum generation model to obtain the request end identifier checksum. The preset checksum generation model described here can be based on a preset digest generation model; for example, a digest is generated from the original unique identifier of the response end based on the preset digest generation model to obtain a response end digest generation result; based on this, a portion of the digest fragment from the response end digest generation result is extracted as the response end identifier checksum according to the fragment extraction rules agreed upon by both parties; the preset digest generation model described here can be a large language model, a BERT-based digest generation model, or a Transformer-based digest generation model; this example does not impose any special limitations on this.

[0051] In one possible example embodiment, the specific process of generating the response end identifier check code can be implemented based on a preset encryption algorithm (e.g., MD5). For example, the original unique identifier of the response end is encrypted based on the preset encryption algorithm to obtain the response end identifier encryption result. On this basis, a partial digest fragment from the response end identifier encryption result is extracted as the response end identifier check code based on the fragment extraction rules agreed upon by both parties.

[0052] It should be noted here that the specific generation process of the response end's verification code can also rely on other consistency verification fields; in practical applications, both parties only need to agree on the corresponding generation method, and this example does not impose any special restrictions on this. Furthermore, if there is a situation where one query request responder corresponds to multiple query request initiators, they can agree on their respective generation methods or use the same generation method; this example does not impose any special restrictions on this.

[0053] In one example embodiment, after obtaining the response end identifier index and the response end data packet, it is also necessary to send the response end data packet to the first device. It should be noted that the mapping relationship data packet (i.e. the response end data packet) does not contain any plaintext personal identification information, nor is it required to transmit the complete de-identified identifier, thereby achieving the purpose of reducing data out-of-domain sensitivity.

[0054] In one example embodiment, the specific process of determining the query endpoint identifier index can be implemented as follows: Parsing the intersection alignment result to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, which are de-identified unique identifiers; matching the original unique identifier of the request endpoint corresponding to the target unique identifier from the first user privacy data; the original unique identifier of the request endpoint is a unique identifier that has not undergone de-identification processing; constructing the query endpoint identifier index based on the response data packet, the original unique identifier of the request endpoint, and the target unique identifier. Simultaneously, in determining the query endpoint identifier index, it is also necessary to generate a request endpoint identifier checksum based on the original unique identifier of the request endpoint, and compare the consistency between the response identifier checksum in the response data packet and the request endpoint identifier checksum; in response to the consistency comparison result showing that the response identifier checksum and the request endpoint identifier checksum are consistent, establishing a request endpoint identifier mapping relationship between the original unique identifier of the request endpoint and the target unique identifier, and constructing the query endpoint identifier index based on the request endpoint identifier mapping relationship.

[0055] In one example embodiment, the specific generation process of the verification code on the responding end can be implemented as follows: A preset verification code generation model is invoked, and the original unique identifier of the requesting end and preset model hint information are input into the preset verification code generation model to obtain the requesting end identifier verification code. The preset verification code generation model described here can be based on a preset digest generation model; for example, a digest is generated from the original unique identifier of the responding end based on the preset digest generation model to obtain a response end digest generation result; based on this, a portion of the digest fragment from the response end digest generation result is extracted as the requesting end identifier verification code according to the fragment extraction rules agreed upon by both parties; the preset digest generation model described here can be a large language model, a BERT-based digest generation model, or a Transformer-based digest generation model, and this example does not impose any special restrictions on it.

[0056] In one example embodiment, during data querying, the first device needs to execute the following process: In response to an input operation on the data query interface, determine the original user identifier to be queried and the data query category; the original user identifier to be queried is a unique identifier without de-identification processing; determine the target user identifier to be queried corresponding to the original user identifier based on the query terminal identifier index; the target user identifier to be queried is a unique identifier after de-identification; generate a data query request according to the target user identifier to be queried and the data query category, and send the data query request to the second device. That is, in practical applications, the querying agency (i.e., the first device) can initiate a query request for specified data by only carrying the SID as a request parameter during the query process; simultaneously, the original user identifier to be queried can be one or more, and the data query category can also include one or more; the corresponding data query interface can be referenced. Figure 5 As shown.

[0057] In one example embodiment, during the data query process, the second device also needs to execute the following steps: parse the data query request to obtain the target user identifier and the data query category; determine the response terminal query identifier associated with the target user identifier based on the response terminal identifier index; the response terminal query identifier is a unique identifier that has not undergone de-identification processing; generate one or more data query tasks based on the response terminal query identifier and the data query category, and execute the data query tasks to perform data queries and obtain data query results. That is, after receiving the target user identifier SID, the queried organization locates the ID index within its domain using T_A and returns the data query results (such as ratings, levels, score ranges, tag sets, hit results, statistical returns, etc.); simultaneously, during the online phase, the querying organization does not need to upload plaintext personal identification information or its mapping relationship.

[0058] Furthermore, after receiving the data query result at the first device, the data query result can be displayed; the obtained data query result can be used for reference. Figure 6 As shown.

[0059] It should also be noted that, to lower the deployment threshold of the privacy computing platform on the querying agency (i.e., the first device), the querying agency (i.e., the second device) can choose an upgrade option, namely, embedding a lightweight privacy computing client (Client-SDK) into its existing business system to invoke privacy computing capabilities. Based on this, compared to the traditional peer-to-peer network model between privacy computing nodes, the Client-SDK can proactively initiate communication requests, which are passively received by the querying agency's server, which returns the computation result in a single request. This reduces the need for the querying agency to purchase a separate server and expose external ports.

[0060] Thus, the privacy-based computation-based data query system described in the exemplary embodiments of this disclosure has been fully implemented. Based on the foregoing description, the privacy-based computation-based data query system described in the exemplary embodiments of this disclosure has at least the following advantages: Firstly, it can overcome the scope limitations of de-identified unique identifiers: through PSI intersection and the SID system, de-identified query identifiers usable across institutions can be achieved. Secondly, it achieves untextualized out-of-domain mapping relationships: the queried institution does not output the "SID-ID" mapping; the querying institution does not upload plaintext identifier information during the online phase. Furthermore, it achieves low sensitivity and high performance in online links: online operation relies solely on SIDs, reducing the frequency of sensitive data leaving the domain and the attack surface, adapting to high-concurrency business calls. Finally, it is easy to integrate and implement: the querying institution can use a lightweight Client-SDK approach to embed existing services, reducing server procurement and peer-to-peer network port opening processes, and lowering application costs.

[0061] This disclosure also provides a data query method based on privacy computing. This method can be run on a first device corresponding to the query request initiator, which can be a terminal device, server, server cluster, or cloud server, etc. Of course, those skilled in the art can also run the method of this disclosure on other platforms as needed, and this exemplary embodiment does not impose any special limitations on this. Specifically, refer to... Figure 7 As shown, this privacy-based computation-based data query method may include the following steps:

[0062] Step S710: Generate a first identifier set based on the first user privacy data, and receive a second identifier set sent by the second device corresponding to the query request responder; the second identifier set is generated based on the second user privacy data held by the second device.

[0063] Step S720: Perform privacy intersection on the first identifier set and the second identifier set to obtain the intersection alignment result, and receive the response data packet generated by the second device based on the intersection alignment result; the response data packet includes at least the response identifier check code and the target identifier set in the intersection alignment result;

[0064] Step S730: Construct a query endpoint identifier index based on the response data packet and the intersection alignment result, and determine the target query user identifier corresponding to the original query user identifier based on the query endpoint identifier index;

[0065] Step S740: Send the target user identifier to the second device and receive the data query result obtained by data query based on the target user identifier and the response terminal identifier index sent by the second device.

[0066] The following example illustrates a scenario where mobile phone numbers are used as personal identifiers for cross-institutional rating data queries. Other scenarios can refer to this example. Step S1: Both parties generate de-identified identifier sets (i.e., the first identifier set and the second identifier set). The querying institution normalizes the mobile phone number and calculates the de-identified identifier, forming set B_set (i.e., the first de-identification result); the queried institution forms set A_set (i.e., the first de-identification result), which can be sorted or bucketed to obtain the first identifier set and the second identifier set. Step S2: Execute PSI to obtain the intersection alignment result. Both parties calculate the alignment result corresponding to the intersection based on the PSI protocol; neither party obtains non-intersection elements from the other. Step S3: The queried institution generates a SID and creates a table. The queried institution generates a SID for the intersection IDs and establishes a T_A: SID → ID index (i.e., the response identifier index) in its own domain. The SID can be bound to a version / period to support rotation and failure control. Step S4: Send the mapping relationship data packet (i.e., the response data packet M). The queried organization sends M={(SID, CHK)} to the querying organization. M does not contain plaintext personal identification information. Step S5: The querying organization parses and builds a local mapping table (i.e., the requesting party's identifier index). The querying organization matches the locally calculated checksum with the checksum in M ​​to establish T_B: Local ID → SID, and stores it encrypted. Step S6: Online query. The querying organization initiates an online query based solely on the SID. The queried organization locates the ID based on T_A and returns query results such as scores.

[0067] In the privacy-based data query method described above, on the one hand, a first identifier set is generated based on the first user privacy data, and a second identifier set sent by a second device corresponding to the query request responder is received; then, a privacy intersection is performed on the first identifier set and the second identifier set to obtain an intersection alignment result, and a response data packet generated based on the intersection alignment result is received from the second device; next, a query identifier index is constructed based on the response data packet and the intersection alignment result, and a target user identifier corresponding to the original user identifier to be queried is determined based on the query identifier index; finally, the target user identifier to be queried is sent to the second device, and the data query result obtained by data query based on the target user identifier to be queried and the response identifier index is received from the second device. Because data queries can be performed based on de-identified user identifiers, sensitive data is prevented from going out of domain and from attack surfaces, thus improving the security of user privacy data. On the other hand, since the first and second devices construct data packets based on the same intersection alignment results, the problem of low accuracy of data query results can be avoided, as de-identified unique identifiers are often generated and maintained by a single organization and are therefore only valid within that organization and cannot be directly used to locate the same person across organizations.

[0068] The specific details of each step in the above privacy-based computation-based data query method have been described in detail in the corresponding privacy-based computation-based data query system, so they will not be repeated here.

[0069] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0070] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0071] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0072] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0073] The following reference Figure 8 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0074] like Figure 8 As shown, the electronic device 800 is manifested in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including storage unit 820 and processing unit 810), and a display unit 840.

[0075] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 810 can perform actions such as... Figure 7 Step S710: Generate a first identifier set based on the first user privacy data, and receive a second identifier set sent by the second device corresponding to the query request responder; the second identifier set is generated based on the second user privacy data held by the second device. Step S720: Perform privacy intersection on the first identifier set and the second identifier set to obtain an intersection alignment result, and receive a response data packet generated by the second device based on the intersection alignment result; the response data packet includes at least a response identifier checksum and a target identifier set from the intersection alignment result. Step S730: Construct a query identifier index based on the response data packet and the intersection alignment result, and determine the target user identifier corresponding to the original user identifier to be queried based on the query identifier index. Step S740: Send the target user identifier to the second device, and receive a data query result obtained by data query based on the target user identifier and the response identifier index sent by the second device.

[0076] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 8201 and / or cache memory 8202, and may further include a read-only memory (ROM) 8203.

[0077] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0078] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0079] Electronic device 800 can also communicate with one or more external devices 900 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0080] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0081] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Exemplary Methods" section above.

[0082] The program product for implementing the above-described method according to embodiments of the present disclosure may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0083] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0084] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0085] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0086] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0087] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0088] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention described herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not invented by this disclosure. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

Claims

1. A data query system based on privacy computing, characterized in that, include: A first device corresponding to the query request initiator and a second device corresponding to the query request responder, wherein the first device and the second device are connected in communication. The first device holds the first user privacy data, and the second device holds the second user privacy data; wherein: The first device is configured to generate a first identifier set based on the first user privacy data, and perform privacy intersection calculation on the first identifier set and the second identifier set corresponding to the second user privacy data to obtain an intersection alignment result; The second device is used to construct a response end identifier index and a response end data packet based on the intersection alignment result; The response data packet includes at least the response identifier check code and the target identifier set in the intersection alignment result; The first device is configured to construct a query endpoint identifier index based on the response endpoint data packet and the intersection alignment result, and determine the target query user identifier corresponding to the original query user identifier based on the query endpoint identifier index. The second device is used to perform a data query based on the target user identifier and the response terminal identifier index, and to feed back the obtained data query results to the first device.

2. The data query system based on privacy computing according to claim 1, characterized in that, The first device is further configured to: perform de-identification processing on the first user privacy data to obtain a first de-identification processing result; the first user privacy data includes a first user unique identifier and / or a first device unique identifier; and sort the first de-identification processing result based on a preset sorting rule to obtain a first identifier set, or sort the first de-identification processing result based on a preset binning rule to obtain a first identifier set. The second device is further configured to: perform de-identification processing on the second user privacy data to obtain a second de-identification processing result; the second user privacy data includes a second user unique identifier and / or a second device unique identifier; and sort the second de-identification processing result based on a preset sorting rule to obtain a second identifier set, or sort the second de-identification processing result based on a preset binning rule to obtain a second identifier set.

3. The data query system based on privacy computing according to claim 1, characterized in that, The second device is further configured to: parse the intersection alignment result to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, the target unique identifiers being de-identified unique identifiers; Match the original unique identifier of the response end that corresponds to the target unique identifier from the second user privacy data; The original unique identifier of the response terminal is a unique identifier that has not undergone de-identification processing; Based on the target unique identifier and the original unique identifier of the response end, construct the response end identifier index and the response end data packet.

4. The data query system based on privacy computing according to claim 3, characterized in that, The second device is also used to: establish a response terminal identifier mapping relationship between the target unique identifier and the original unique identifier of the response terminal, and generate a response terminal identifier index based on the response terminal identifier mapping relationship; Based on the original unique identifier of the response end, a response end identifier check code corresponding to the target unique identifier is generated, and the response end data packet is generated according to the response end identifier check code and the target unique identifier.

5. The data query system based on privacy computing according to claim 1, characterized in that, The first device is also used for: The intersection alignment result is parsed to obtain a target identifier set; the target identifier set includes one or more target unique identifiers, which are unique identifiers after de-identification; Match the original unique identifier of the requesting end from the first user privacy data that corresponds to the target unique identifier; the original unique identifier of the requesting end is a unique identifier that has not undergone de-identification processing. The query identifier index is constructed based on the response data packet, the original unique identifier of the requesting end, and the target unique identifier.

6. The data query system based on privacy computing according to claim 5, characterized in that, The first device is also used for: A requester identifier check code is generated based on the original unique identifier of the requester, and the consistency between the response identifier check code in the response data packet and the requester identifier check code is compared. If the consistency comparison result shows that the response end identifier check code is consistent with the request end identifier check code, a request end identifier mapping relationship is established between the original unique identifier of the request end and the target unique identifier, and the query end identifier index is constructed based on the request end identifier mapping relationship.

7. The data query system based on privacy computing according to claim 6, characterized in that, The first device is also used for: A preset checksum generation model is invoked, and the original unique identifier of the requesting end and the preset model prompt information are input into the preset checksum generation model to obtain the requesting end identifier checksum.

8. The data query system based on privacy computing according to claim 1, characterized in that, The first device is also used for: In response to an input operation on the data query interface, the original user identifier to be queried and the data query category are determined; the original user identifier to be queried is a unique identifier that has not undergone de-identification processing; Based on the query endpoint identifier index, determine the target user identifier corresponding to the original user identifier to be queried; The target user identifier to be queried is a unique identifier after de-identification; A data query request is generated based on the target user identifier and the data query category, and the data query request is sent to the second device.

9. The data query system based on privacy computing according to claim 1, characterized in that, The second device is also used for: The data query request is parsed to obtain the target user identifier and the data query category; Based on the response endpoint identifier index, determine the response endpoint query identifier associated with the target query user identifier; The identifier to be queried at the response end is a unique identifier that has not undergone de-identification processing; One or more data query tasks are generated based on the query identifier of the response end and the data query category, and the data query tasks are executed to perform data queries and obtain data query results.

10. A data query method based on privacy computing, characterized in that, Configured on a first device corresponding to the query request initiator, the first device holding first user privacy data, the method includes: A first identifier set is generated based on the first user privacy data, and a second identifier set is received from the second device corresponding to the query request responder; the second identifier set is generated based on the second user privacy data held by the second device. A privacy-based intersection is performed on the first identifier set and the second identifier set to obtain an intersection alignment result, and a response data packet generated based on the intersection alignment result is received from the second device; the response data packet includes at least a response identifier checksum and the target identifier set from the intersection alignment result; A query endpoint identifier index is constructed based on the response endpoint data packet and the intersection alignment result, and the target query user identifier corresponding to the original query user identifier is determined based on the query endpoint identifier index. The target user identifier to be queried is sent to the second device, and the data query result obtained by the second device based on the target user identifier and the response terminal identifier index is received.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the privacy-based computation-based data query method of claim 10.

12. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the privacy-based computation-based data query method of claim 10 by executing the executable instructions.

Images