Method for cross-domain financial data fusion analysis based on anonymous query and secure multi-party statistics

Abstract

The application discloses a kind of based on anonymous query and secure multi-party statistical cross-domain financial data fusion analysis method, this method is by query initiator, data provider and trusted third-party audit platform three parties jointly executed, through pre-authorization synchronization, query generation audit, data slice commitment, secure multi-party computation, differential privacy processing, data packet assembly verification and audit reproduction nine steps, design a new type of statistical result data packet form, differential disclosure control, query plan, secret state certificate are unified into data structure and release protocol.The application simultaneously realizes the interpretable output of statistical result, the controllable risk of backstepping and the reproducible audit of result, solves the internal contradiction among the three, is suitable for cross-institution credit risk assessment, anti-money laundering joint monitoring these financial scenes, with safe and reliable, general and expandable, in line with the advantages of regulatory requirements.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, specifically to a method for cross-domain financial data fusion analysis based on anonymous querying and secure multi-party statistics. Background Technology

[0002] With the deepening of digital transformation in the financial industry, cross-institutional data fusion and analysis has become a core support for financial institutions to improve their risk control capabilities, precision marketing levels, and regulatory compliance efficiency. However, the high sensitivity of financial data means that directly sharing data in plaintext poses a serious risk of information leakage, which runs counter to increasingly stringent legal and regulatory requirements. Against this backdrop, privacy computing technologies, especially anonymous querying and secure multi-party computation, are considered key technological paths to break down "data silos" and achieve "data usable but invisible," and have already demonstrated application potential in scenarios such as financial supervision and joint risk control.

[0003] Current mainstream security analysis technologies all fall short in addressing the triple requirements of "interpretable output," "controllable reverse-engineering risks," and "reproducible and auditable results" in cross-domain financial analysis. First, many anonymous query-based systems focus on protecting the privacy of raw data, but their computation process itself can become a "black box," making the intermediate decision-making logic and final statistical results difficult for business personnel or regulatory agencies to understand and trust, resulting in insufficient interpretability. Second, although secure computation restricts the direct exposure of raw data, it is still possible to deduce sensitive information from statistical results or model parameters through differential attacks, inference attacks, etc., meaning the reverse-engineering risk is not completely eliminated. Finally, existing systems generally face auditing challenges: due to the non-deterministic nature of the computing environment (such as differences in floating-point operations and the randomness of concurrent scheduling), the computation process under the same input may produce slight deviations, leading to results that cannot be fully reproduced, thus failing to meet the stringent requirements of financial audits for traceable and verifiable results.

[0004] The inherent contradictions among these three factors—the trade-off between output interpretability and the strength of privacy protection, the conflict between computational accuracy and algorithm security, and the tension between distributed computing efficiency and audit certainty—have become key bottlenecks restricting the secure sharing and compliant application of cross-domain financial data. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics. By designing a new statistical result data packet format, differential disclosure control, query plan, and confidentiality proof are unified into the data structure and publishing protocol, which simultaneously meets the three core requirements and resolves the contradictions and conflicts among them.

[0006] The objective of this invention is achieved as follows: A cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics includes the following steps: Pre-authorization and basic information synchronization complete system initialization, participant identity authentication, data metadata registration, statistical standardization, and data access authorization rule configuration; The query initiator generates and submits a digitally signed query request, which includes a query plan and a differential privacy budget request. A trusted third-party auditing platform reviews the compliance and access permissions of query requests, allocates differential privacy budgets, and generates query authorizations. Each data provider extracts data slices based on the query authorization, generates a data slice commitment, and submits it to a trusted third-party auditing platform; The query initiator and the data provider use a secure multi-party computation technique based on secret sharing to complete joint statistical computation in a secret state to obtain the initial result; The query initiator adds differential privacy noise based on the allocated budget, generates an output mask seed and noise ledger, and submits it for auditing. The query initiator assembles and signs a statistical results data packet containing statistical results, caliber version, interpretable information, slice proof, access path commitment, mask seed, and noise ledger; The authenticity and compliance of the data packet are verified by multiple parties, and it is released after being audited by a trusted third-party auditing platform. The auditors used the data packet information to reproduce the calculation process in an isolated environment and generated an audit report.

[0007] A cross-domain financial data fusion and analysis device based on anonymous querying and secure multi-party statistics includes: The pre-authorization module is used to perform the pre-authorization and basic information synchronization steps; The query generation module is used to execute the steps of generating and submitting query requests; The review and authorization module is used to perform the review and authorization steps for query requests; The data slicing module is used to perform the data slicing and commitment generation steps; The secure computation module is used to perform secure multi-party statistical computation steps; The noise addition module is used to perform the differential privacy noise addition and mask generation steps; The data packet assembly module is used to perform the statistical result data packet assembly step; The verification and publication module is used to perform the verification and publication steps for statistical results; The audit reproduction module is used to reproduce the results and perform the audit steps.

[0008] Positive and beneficial effects: This invention, through the design of a novel statistical result data packet format, achieves interpretable output of statistical results, precise and controllable risk inference, and reproducible auditable results, resolving the inherent contradictions among these three aspects. This invention employs multiple mature cryptographic technologies to ensure system security and reliability, is applicable to various financial statistical analysis tasks, possesses good versatility and scalability, and strictly complies with laws, regulations, and regulatory requirements. Attached Figure Description

[0009] Figure 1 This is an overall flowchart of the present invention; Figure 2 This is a flowchart illustrating the pre-authorization and basic information synchronization in an embodiment of the present invention; Figure 3 This is a flowchart of differential privacy noise addition and mask generation in an embodiment of the present invention. Detailed Implementation

[0010] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments and accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] The embodiments of this invention are applicable to all scenarios requiring cross-institutional and cross-domain fusion and statistical analysis of sensitive financial data, including but not limited to cross-bank credit risk joint assessment, cross-institutional anti-money laundering transaction monitoring, cross-industry customer behavior profiling analysis, regulatory compliance statistical verification, and insurance company risk pricing data sharing. The methods described in this invention can be executed by a cross-domain financial data fusion and analysis system, which consists of three types of hardware devices: query initiator nodes, multiple data provider nodes, and trusted third-party audit platform nodes. These nodes interact with each other via an encrypted communication network.

[0012] The core terms involved in this invention are defined as follows: Statistical results data package: a structured data encapsulation format that organically integrates statistical result values, interpretability information, cryptographic proof information, and audit traceability information into a single data unit. It is the core carrier for achieving the three core objectives of this invention.

[0013] Data slice commitment: A digital certificate generated based on a cryptographic commitment scheme that can prove the existence, integrity, and generation time of a data slice without revealing its specific content.

[0014] Access path commitment: Digital credentials generated based on hash chain technology fully record the entire execution path of statistical calculation from query initiation to result generation, ensuring that the calculation process cannot be tampered with.

[0015] Noise Ledger: A standardized audit log format that fully records the generation parameters, generation process, and addition order of differential privacy noise, serving as the core evidence for reproducible results.

[0016] The basic method flow of this invention consists of nine core steps that are strictly executed in chronological order, such as... Figure 1 As shown, the input data, technical principles, execution actions, and output results for each step are as follows: S101. Pre-authorization and basic information synchronization: identity information, data element information, statistical caliber requirements, and authorization rule requirements of each participant; by pre-completing system initialization, identity authentication, metadata registration, caliber unification, and authorization configuration, a unified cross-domain data interaction standard and trust foundation are established to avoid problems such as inconsistent standards, unclear identities, and chaotic permissions during subsequent queries; completion of system global parameter generation and synchronization, participant identity authentication and digital certificate issuance, data element information registration and management, statistical caliber standard formulation and version control, and data access authorization rule configuration and activation; system global parameter set, participant digital certificate library, data element information directory, unified statistical caliber version library, and data access authorization rule library.

[0017] S102. Query request generation and submission: business requirements document, unified statistical standards, system global parameters; the query initiator independently completes the query plan formulation and privacy budget application locally to ensure the confidentiality of business requirements, while ensuring the integrity and non-repudiation of the query request through digital signature; parsing business requirements and mapping them to unified statistical standards, formulating standardized query plans, calculating the required differential privacy budget amount, digitally signing the query plan and budget application, and submitting the query request to a trusted third-party auditing platform; standardized query request file with digital signature.

[0018] S103. Query Request Review and Authorization: Query request files, data access authorization rule base, and system global parameters; An independent, trusted third-party auditing platform conducts comprehensive compliance review and authorization verification of query requests to ensure that all query activities comply with legal and regulatory requirements, regulatory provisions, and the authorization scope of the data provider, while achieving centralized management and control of the differential privacy budget; Verifying the digital signature of the query request, reviewing the compliance of the query plan, verifying the access rights of the query initiator, reviewing and allocating the differential privacy budget, generating and distributing the query authorization file, and recording the query review process to the audit log; Digitally signed query authorization files, updated differential privacy budget ledgers, and tamper-proof query review audit records.

[0019] S104. Data Slicing and Commitment Generation: This involves querying authorization documents, the original financial database, and unified statistical standards. Each data provider independently completes data slice extraction and cryptographic commitment generation locally, ensuring that the original data never leaves the local machine. Cryptographic commitments guarantee the authenticity and integrity of the data slices, preventing data providers from tampering with or providing false data. The process includes verifying the authenticity and legality of the query authorization document, extracting eligible data slices based on the query authorization, calculating the hash value of the data slice, generating data slice commitments based on the hash values, and submitting the commitment information to a trusted third-party auditing platform. The system includes local data slice files, data slice hash values, data slice commitment files, and tamper-proof data slice commitment audit records.

[0020] S105. Secure multi-party statistical computation, querying authorization files, local data slice files, and system global parameters; employing secure multi-party computation technology based on secret sharing, the original data slice is divided into multiple secret shares and distributed to different participants. All computations are performed in a secret-sharing state, ensuring that no participant can obtain the original data information of other participants. At the same time, zero-knowledge proof technology is used to ensure the correctness of the computation process; the overall computation task is decomposed into basic sub-computation tasks, generating secret shares of local data slices and distributing them, distributing the execution of each sub-computation task, verifying the correctness of intermediate results through zero-knowledge proof, and aggregating the computation result shares of all participants to obtain the initial statistical results; initial statistical computation results without added noise and verification records of intermediate computation results.

[0021] S106. Differential privacy noise addition and mask generation: Initial statistical calculation results, allocated differential privacy budget, and system global parameters; based on the sensitivity of the query and the allocated privacy budget, add an appropriate amount of differential privacy noise to the initial statistical results, while controlling the disclosure granularity of the results through the output mask, effectively preventing attackers from reverse-engineering individual information through multiple queries and conditional filtering while ensuring the availability of the results; select an appropriate differential privacy mechanism according to the statistical analysis type, calculate noise parameters, generate a cryptographically secure output mask seed, generate a noise sequence and add it to the initial statistical results, generate a complete noise ledger, and submit the noise ledger to a trusted third-party auditing platform; noisy statistical results, output mask seed, noise ledger file, and tamper-proof noise addition audit records.

[0022] S107. Assemble the statistical result data package, including noisy statistical results, query plan, query authorization file, data slice commitment file, access path information, output mask seed, and noise ledger file; assemble the statistical result values, interpretability information, cryptographic proof information, and audit traceability information into a single statistical result data package according to a standardized format, achieving "one data package solves all needs," while ensuring the integrity and non-repudiation of the data package through digital signature; extract standardized interpretability information, collect all cryptographic proof information, generate a complete access path commitment, apply an output mask to control the granularity of result disclosure, assemble the statistical result data package according to a standardized format, and digitally sign the entire data package; the standardized statistical result data package is then digitally signed.

[0023] S108. Statistical Result Verification and Release: This includes the statistical result data package, query authorization file, data slice commitment file, noise ledger file, and system global parameters. All participating parties jointly conduct a comprehensive verification of the statistical result data package to ensure its authenticity, integrity, and compliance. Only data packages that pass all verifications can be released and used. Simultaneously, the audit signature from a trusted third-party auditing platform provides authoritative endorsement for the data package. Verification includes: verifying the digital signature of the data package; verifying the consistency between interpretability information and query authorization; verifying the authenticity of the data slice commitment; verifying the integrity and compliance of the access path; verifying the compliance of differential privacy noise addition; adding an audit signature and releasing the data package; and recording the data package release process in the audit log. The final statistical result data package with the audit signature and the unalterable result release audit record are then included.

[0024] S109. Result Reproduction and Auditing: Audit request documents, statistical result data packages, audit logs, and unified statistical standards; using all supporting information and audit records contained in the statistical result data packages, fully reproduce the original calculation process and results in a completely isolated environment, proving that the calculation process has not been tampered with and that the authorized data slices at the time were indeed used, meeting the stringent audit requirements of regulatory authorities; verify the auditor's identity and permissions, obtain all relevant audit materials, build an isolated reproduction environment completely consistent with the original environment, verify the authenticity and integrity of the data slices, reproduce the secure multi-party statistical calculation process, reproduce the differential privacy noise addition and masking application process, compare the reproduced results with the original results, and generate a formal audit report; formal audit report documents and tamper-proof audit process records.

[0025] like Figure 2 As shown, steps S101, pre-authorization, and basic information synchronization are detailed. In this embodiment, the system initialization process is led by a trusted third-party auditing platform. Specifically, the trusted third-party auditing platform first generates a global system parameter set, including: Cryptographic algorithm parameters specify the standard parameters for the asymmetric encryption algorithm, hash algorithm, digital signature algorithm, cryptographic commitment scheme, secret sharing scheme, and zero-knowledge proof scheme used by the system; Differential privacy parameters specify the basic unit of the differential privacy budget, budget allocation rules, budget accumulation rules, and budget expiration rules; Data format parameters specify the standard specifications for query request format, query authorization format, data slice commitment format, noise ledger format, statistical result data package format, and audit log format. Communication protocol parameters specify the version of the encrypted communication protocol used by the system, the key exchange algorithm, and the data transmission encryption standard.

[0026] Optionally, the system's global parameter set can be configured differently according to different business scenarios. For example, for core business scenarios involving national financial security, cryptographic algorithms with higher security strength and stricter differential privacy budget allocation rules can be adopted; for ordinary business statistics scenarios, parameter configurations that balance security and performance can be adopted.

[0027] Specifically, the participant identity authentication process employs a multi-level authentication mechanism. First, each participant submits paper and electronic versions of identity verification materials to the trusted third-party auditing platform, including a business license, financial license, legal representative's identity certificate, power of attorney, and system administrator's identity certificate. The trusted third-party auditing platform manually reviews the paper materials and digitally verifies the electronic materials. Upon successful verification, the trusted third-party auditing platform generates a unique participant identifier for each participant and issues an X.509 digital certificate with its digital signature. The validity period of the digital certificate is determined based on the participant's type and credit rating, generally ranging from 1 to 3 years. Thirty days before the expiration of the digital certificate, each participant must submit a renewal application to the trusted third-party auditing platform. Upon approval, a new digital certificate will be issued.

[0028] For example, during the data metadata registration process, the metadata fields that the data provider needs to register include: Basic information about the dataset includes: unique identifier of the dataset, dataset name, dataset description, business domain to which the data belongs, data security level, data update frequency, data creation time, and data last update time. Data field information, including field unique identifier, field name, field description, field data type, field value range, whether the field allows null values, whether the field is a sensitive field, and the statistical definition reference for the field; Data quality information includes data integrity indicators, data accuracy indicators, data consistency indicators, and data timeliness indicators.

[0029] In some embodiments, the data metadata registration process can be automated. Data providers can use the system's API interface to automatically export metadata from their databases and register it with a trusted third-party auditing platform, reducing manual workload and error rates.

[0030] Furthermore, the standardization process adopts the principle of "joint formulation, joint confirmation, and joint maintenance." The trusted third-party auditing platform organizes all participating parties to form a standardization working group, responsible for drafting the initial draft of the unified statistical standard. After completion, the initial draft is sent to all participating parties for feedback, and revisions are made based on the feedback. The revised standard, after being jointly signed and confirmed by all participating parties, is officially released by the trusted third-party auditing platform, and a unique standard identifier and version number are assigned to each standard. When a standard needs to be changed, the standardization working group submits a change request, which, after joint confirmation by all participating parties, generates a new version number, and all historical versions are permanently retained for auditing use. Any query must reference the published unified standard; custom standards are not permitted.

[0031] As an implementation approach, the authorization rule configuration process employs a hybrid access control model that combines Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC). The data provider first creates different roles in the system, such as "Risk Management Specialist," "Anti-Money Laundering Analyst," and "Regulatory Auditor," and assigns basic access permissions to each role. Then, based on the data's security level, the query initiator's credit rating, the query's time range, and the query's frequency, more granular access control conditions are set. For example, conditions such as "Only query initiators with a credit rating of A can query data with a security level of three" or "The same query initiator can only query a certain type of statistical indicator a maximum of 10 times per month" can be set.

[0032] S102. The query request generation and submission steps are detailed. In this embodiment, the business requirement parsing process is jointly completed by the business personnel and technical personnel of the query initiator. The business personnel first propose specific business requirements, clarifying the business problems to be solved and the required statistical results. The technical personnel translate the business requirements into technical language and map them to the published unified statistical standard. If the business requirements cannot be mapped to the existing standard, the technical personnel need to submit an application for the formulation of a new standard to the standard formulation working group, and proceed with subsequent operations after the new standard is published.

[0033] Optionally, the query plan development process can be assisted by visualization tools. The query initiator can use the system's visual query interface to drag and drop to select the required statistical indicators, grouping dimensions, time ranges, and product subset conditions. The system will automatically generate a standardized query plan. The visualization tool can automatically check the legality and compliance of the query plan and alert the query initiator to potential problems, such as overly granular grouping dimensions or time ranges exceeding authorized limits.

[0034] Specifically, during the privacy budget application process, the query initiator needs to calculate the required differential privacy budget amount for this query based on the complexity of the query plan and the required accuracy of the results, according to the differential privacy budget allocation rules in the system's global parameters. The formula for calculating the differential privacy budget amount is: ε_total=ε_base+Σ(ε_dimension)+ε_precision; Here, ε_base is the base budget, which is related to the type of statistical metric in the query; ε_dimension is the budget corresponding to each grouping dimension; and ε_precision is the budget corresponding to the required result precision. The higher the required result precision, the larger the required ε_precision.

[0035] For example, for a query that includes one statistical indicator and two grouping dimensions, and requires two decimal places for the result, assuming ε_base=0.1, ε_dimension=0.05 for each grouping dimension, and ε_precision=0.05, the total budget required for this query is 0.1+0.05×2+0.05=0.25.

[0036] In some embodiments, the system can automatically calculate the required privacy budget based on the query plan and prompt the query initiator that if the budget is insufficient, the budget requirement can be reduced by adjusting the query plan (such as reducing the grouping dimensions or lowering the result accuracy requirements), or by applying to the data provider for an increased budget.

[0037] Furthermore, the query request signing process employs a digital signature algorithm specified in the system's global parameters. The query initiator first concatenates the query plan and privacy budget request into a single string, then digitally signs this string using its private key to generate a signature value. Finally, the query plan, privacy budget request, and signature value are packaged into a query request file. Any tampering with the query plan or privacy budget request will result in signature verification failure, thus ensuring the integrity and non-repudiation of the query request.

[0038] As one implementation method, the query request submission process adopts an asynchronous submission approach. The query initiator submits the query request to the message queue of the trusted third-party auditing platform, which processes the requests according to their priority and submission time. The query initiator can check the processing progress of the request in real time through the query status interface provided by the system.

[0039] S103. The query request review and authorization steps are detailed. In this embodiment, the query request integrity verification process is automatically completed by a trusted third-party auditing platform. The trusted third-party auditing platform first extracts the query plan, privacy budget application, and signature value from the query request file, and then uses the query initiator's public key to verify the signature value. If the verification passes, it indicates that the query request has not been tampered with during transmission and was indeed submitted by the query initiator; if the verification fails, the query request is rejected, and an error message "signature verification failed" is returned to the query initiator.

[0040] Optionally, the compliance review process combines automated and manual review. Routine query requests that conform to preset rules are reviewed automatically by the system; complex query requests involving sensitive data are reviewed manually by personnel from a trusted third-party auditing platform. The review content includes: Whether the query type is legal and complies with national laws, regulations, and regulatory requirements; Whether the statistical indicators fall within the scope of permitted queries, and whether they involve national financial security or commercial secrets; Does the grouping dimension involve excessive refinement, and could it lead to the reverse inference of individual information? Is the time range reasonable? Does it exceed the query time range allowed by the data provider? Does the product subset condition contain discriminatory content, or does it violate the principle of fair competition? Does the required accuracy meet privacy protection requirements, or is it too high, leading to increased risk of reverse engineering?

[0041] Specifically, during the authorization verification process, the trusted third-party auditing platform needs to verify, one by one, whether the query initiator has the permission to access the relevant data from each data provider. The verification content includes: Check whether the initiator's role allows access to the specified statistical metrics; Check if the initiator allows the use of the specified grouping dimension; Check if the initiator allows queries to be performed within the specified time range; Does the query frequency initiated by the query provider exceed the limit set by the data provider? Does the query initiator exceed the data volume limit set by the data provider in a single query? Check whether the initiator's cumulative differential privacy budget exceeds the limit set by the data provider.

[0042] For example, if the query initiator's cumulative differential privacy budget has 0.3 remaining, while the budget requested for this query is 0.4, the authorization verification will fail, the trusted third-party auditing platform will reject the query request, and inform the query initiator that "the cumulative budget is insufficient".

[0043] In some embodiments, a trusted third-party auditing platform can establish an independent differential privacy budget ledger for each data provider, recording in detail the budget usage of each query initiator, including budget allocation time, budget amount, query identifier, and budget usage time. The budget ledger is stored using tamper-proof blockchain technology to ensure the authenticity and integrity of budget usage records.

[0044] Furthermore, during the query authorization generation process, the trusted third-party auditing platform generates a formal query authorization file for all approved query requests. The query authorization file uses a standardized JSON format and includes the following fields: Basic information, including query identifier, query initiator identifier, authorization generation time, authorization validity period, and query execution time limit; The authorized content includes a list of authorized data providers, a list of authorized statistical indicators, a list of authorized grouping dimensions, an authorized time range, and conditions for authorized product subsets. Privacy budget information, including the allocated differential privacy budget amount, privacy budget identifier, and budget usage rules; Digital signature: A digital signature of the entire query authorization document by a trusted third-party auditing platform.

[0045] As one implementation method, the query authorization distribution process employs encrypted distribution. A trusted third-party auditing platform encrypts the query authorization file using each participant's public key, and then sends it to the query initiator and all authorized data providers. Only the participant holding the corresponding private key can decrypt the query authorization file, ensuring the confidentiality of the authorization information.

[0046] S104. Data Slicing and Commitment Generation Steps are Detailed: In this embodiment, the query authorization verification process is automatically completed by each data provider. After receiving the encrypted query authorization file, the data provider first decrypts the file using its own private key, and then verifies the digital signature of the file using the public key of the trusted third-party auditing platform. If the verification passes, it further verifies whether the query authorization is valid, whether the query initiator has permission to access the organization's data, and whether the content of the query authorization is consistent with the authorization rules configured by the organization. If any verification fails, the query request is rejected, and the anomaly is reported to the trusted third-party auditing platform.

[0047] Optionally, the data slicing extraction process employs an incremental extraction method. For datasets with high update frequency, the data provider can pre-build a data index to quickly locate and extract data slices that meet the criteria based on the time range and product subset conditions in the query authorization, thereby improving the efficiency of data extraction. Data slices only contain the fields explicitly specified in the query authorization and do not include any additional field information, strictly adhering to the principle of data minimization.

[0048] Specifically, the data slicing extraction process must be strictly performed in accordance with the definitions in the unified standard. For example, for the statistical indicator of "delinquency rate", the unified standard defines it as "the proportion of loan balances overdue for more than 90 days to the total loan balance". Therefore, when extracting data slices, the data provider must only include loan records overdue for more than 90 days, and preprocess the data according to the outlier handling and missing value handling methods in the standard.

[0049] For example, the unified standard stipulates that the outlier handling method is "removing outlier data with loan amounts exceeding 10 million yuan" and the missing value handling method is "deleting records containing missing values". Therefore, after extracting the data slice, the data provider needs to first delete all records with loan amounts exceeding 10 million yuan, and then delete all records containing missing values ​​to obtain the final data slice.

[0050] In some embodiments, the data provider can establish a local data preprocessing engine to automatically complete preprocessing operations such as data cleaning, transformation, and loading, ensuring the quality and consistency of data slices. The processing rules of the data preprocessing engine are configured strictly according to the definitions in the unified standard, and the rules of the data preprocessing engine will be updated accordingly when the standard changes.

[0051] Furthermore, the data slice hash calculation process employs a hash algorithm specified in the system's global parameters. The data provider converts the data slice into a binary stream, then uses the hash algorithm to calculate a unique data slice hash value. The data slice hash value is a digital fingerprint of the data slice's content; any modification to the data slice's content will cause the hash value to change.

[0052] As an implementation method, the data slice commitment generation process employs the Pedersen commitment scheme. The Pedersen commitment scheme is a perfectly hidden cryptographic commitment scheme that can prove the authenticity and integrity of the commitment content without revealing its contents. The data provider first generates a random number as the commitment key, and then uses the commitment key and the data slice hash value to calculate and generate the data slice commitment. After the commitment is generated, the data provider needs to properly safeguard the commitment key for subsequent commitment verification.

[0053] S105. The steps for secure multi-party statistical calculation are refined. In this embodiment, the task decomposition process is automatically completed by the query initiator based on the statistical analysis type in the query plan. Different task decomposition methods are used for different statistical analysis types: Group statistics and stratified proportions are broken down into four basic sub-tasks: local counting, local summation, global summation, and global division. Threshold warning is broken down into two basic sub-tasks: local comparison and global comparison. Ranking can be broken down into two basic subtasks: local sorting and global sorting. The calculation of regression coefficients is broken down into five basic sub-tasks: local covariance calculation, local variance calculation, global covariance calculation, global variance calculation, and global division. Correlation analysis is broken down into five basic sub-tasks: local covariance calculation, local standard deviation calculation, global covariance calculation, global standard deviation calculation, and global division.

[0054] Optionally, the computational task decomposition process can employ optimization algorithms to rationally allocate computational tasks based on the computing power and network bandwidth of each data provider, thereby improving overall computational efficiency. For example, subtasks with larger computational loads can be assigned to data providers with stronger computing power, while subtasks with larger data transmission loads can be assigned to data providers with higher network bandwidth.

[0055] Specifically, the secret sharing generation process adopts the Shamir threshold secret sharing scheme. The Shamir threshold secret sharing scheme divides a secret into n secret shares. Any k or more secret shares can recover the original secret, while any fewer than k secret shares cannot obtain any information about the original secret. In this embodiment, the value of k is generally set to n / 2+1 to ensure that the system has a certain fault tolerance, so that even if a few participants malfunction or engage in malicious behavior, the calculation can still be completed normally.

[0056] For example, in a scenario with three data providers, the value of k is set to 2. Each data provider divides its own data slice into three secret shares, sending one to each of the other two data providers and the query initiator, while retaining one secret share for itself. In this way, any two participants can work together to recover the calculation result, while no single participant can obtain any of the original data information.

[0057] In some embodiments, the secret sharing generation process can employ an additive secret sharing scheme. The additive secret sharing scheme divides a secret x into n secret shares x1, x2, ..., xn, satisfying x = x1 + x2 + ... + xn. The additive secret sharing scheme has high computational efficiency and is suitable for statistical analysis tasks involving numerous addition and multiplication operations.

[0058] Furthermore, during the execution of distributed sub-computation, all operations are performed in a secret-shared state. Each participant uses its own secret share and the secret shares sent by other participants to perform the corresponding basic operations. For addition, each participant only needs to add its own secret shares; for multiplication, the participants need to interact and exchange secret shares of the intermediate calculation results.

[0059] As an implementation method, the intermediate result verification process employs zero-knowledge proof technology. Each participant, after completing a sub-computation task, generates a zero-knowledge proof demonstrating that its computational process was correct and that the secret share was not tampered with. Other participants verify the zero-knowledge proofs; if the verification passes, the intermediate result is accepted; if the verification fails, the computation process is terminated, and the anomaly is reported to a trusted third-party auditing platform. Zero-knowledge proof technology can prove the correctness of the computation process without disclosing any secret information, effectively preventing cheating by malicious participants.

[0060] like Figure 3 As shown, the steps of S106, differential privacy noise addition and mask generation, are detailed. In this embodiment, the noise parameter calculation process selects a suitable differential privacy mechanism based on the statistical analysis type: For linear statistics such as counting, summation, and mean, the Laplace mechanism is used. The noise of the Laplace mechanism follows a Laplace distribution, and its probability density function is: f(x|μ,b)=(1 / (2b))*exp(-|x-μ| / b); Where μ is the location parameter, which is generally set to 0; b is the scale parameter, calculated by the formula b=Δf / ε, where Δf is the global sensitivity of the statistic, and ε is the allocated differential privacy budget amount.

[0061] For non-linear statistics such as median, quantiles, and rank, an exponential mechanism is employed. This mechanism ensures differential privacy by assigning a score to each possible output and then randomly selecting the output based on the exponential distribution of those scores.

[0062] For the calculation of regression coefficients, a gradient-based differential privacy mechanism is employed. During the calculation process, an appropriate amount of noise is added to the gradient to ensure that the final regression coefficients meet the requirements of differential privacy.

[0063] Optionally, the noise parameter calculation process can employ an adaptive differential privacy mechanism. Based on the data distribution characteristics and query sensitivity, the noise scaling parameter is adaptively adjusted to minimize the impact of noise on the accuracy of the results while ensuring differential privacy requirements. For example, for statistics with relatively concentrated data distribution, the noise scaling parameter can be appropriately reduced; for statistics with relatively dispersed data distribution, the noise scaling parameter can be appropriately increased.

[0064] Specifically, the output mask seed generation process employs a cryptographically secure pseudo-random number generator (CSPRNG). The output mask seed is typically 128 or 256 bits long to ensure sufficient randomness and unpredictability. The output mask seed is used to generate subsequent output masks, controlling the granularity of result disclosure.

[0065] For example, the rule for generating the output mask for grouped statistical results is as follows: Initialize the pseudo-random number generator using the output mask seed; For each group, calculate the sample size for that group; If the sample size is less than the minimum group sample size threshold set by the system, the results of that group will be merged into the adjacent group or marked as "insufficient data". If the sample size is greater than or equal to the threshold, the result of that group is retained, but the result is rounded to the specified number of decimal places.

[0066] In some embodiments, the minimum group sample size threshold can be adjusted based on the data security level and business needs. A higher threshold can be set for data with a higher security level, and a lower threshold can be set for data with a lower security level. Generally, the minimum group sample size threshold is set between 10 and 100.

[0067] Furthermore, the noise ledger generation process uses a standardized JSON format, which includes the following fields: Basic information, including query identifier, privacy budget identifier, noise addition time, and query initiator identifier; Noise parameter information, including noise type, noise distribution parameters, global sensitivity, and differential privacy budget; Noise sequence information, including the complete noise sequence, the noise sequence generation algorithm, and the random number seed; Output mask information, including the mask seed, mask generation rules, and mask application results; Digital signature, query the initiator's digital signature for the entire noise ledger.

[0068] As one implementation method, the noisy ledger submission process employs encrypted submission. The query initiator encrypts the noisy ledger using the public key of a trusted third-party auditing platform and then submits it to the platform. The platform decrypts the noisy ledger and verifies it to confirm compliance with differential privacy requirements and the allocated budget. Upon successful verification, the noisy ledger is recorded in an immutable audit log.

[0069] S107. The statistical result data package assembly step is refined. In this embodiment, the interpretability information extraction process extracts standardized information from the query plan and query authorization, including: Statistical indicator information, including the name, scope identifier, version number, definition, and calculation method of the statistical indicator; Grouping dimension information, including the name, meaning, value range, and grouping criteria of the grouping dimension; Time range information, including the start time, end time, and time granularity of the statistics; Product subset information, including the name, description, and filtering criteria of the product subset; Information on participants, including a list of data providers involved in the calculation and the contribution percentage of each data provider.

[0070] Optionally, interpretability information can be presented visually. The statistical results data package can include visual charts of interpretability information, such as grouped bar charts, time series charts, and pie charts, enabling business and compliance personnel to more intuitively understand the composition and sources of the statistical results.

[0071] Specifically, the proof information collection process gathers all cryptographic proof information for this query, including: Each data provider submits its data slice commitments and data slice hash values; Authorization documents and digital signatures for querying trusted third-party auditing platforms; Query the noise ledger file and digital signature of the initiator; The intermediate results from each participant validate the zero-knowledge proof.

[0072] For example, the access path commitment generation process uses SM3 hash chain technology. The steps for generating the access path commitment are as follows: Calculate the hash value H1 of the query plan; Calculate the hash value H2 of the query authorization file; Calculate the hash value H3 of all data slice commitments; Calculate the hash value H4 of the computational task decomposition process; Calculate the hash value H5 of all intermediate results; Calculate the hash value H6 of the final result aggregation process; Generate a hash chain H=SM3(H1||H2||H3||H4||H5||H6) as an access path commitment.

[0073] In some embodiments, access path commitments can be generated using Merkle tree technology. Merkle trees can more efficiently verify any step in the access path, improving verification efficiency.

[0074] Furthermore, the output mask application process strictly follows the rules in the system's global parameters. Different mask application rules are used for different types of statistical results: Grouped statistical results, controlling the minimum group size and the accuracy of the results; The ranking results control the display range of the rankings, showing only the top N or bottom N, without displaying the specific ranking values; The threshold warning result only shows whether the threshold has been exceeded, without displaying the specific value; The regression coefficient results control the precision of the coefficients by rounding them to the specified number of decimal places.

[0075] As one implementation method, the statistical results data packet is encapsulated in JSON format and contains the following top-level fields: "result_value" is the final statistical result after noise addition and output masking. "caliber_version" represents all caliber identifiers and version numbers used in this query; "interpretation_info" is standardized interpretability information. "slice_proofs" represents the data slice commitments and hash values ​​from each data provider. "access_path_commitment" is the access path commitment for this query. "mask_seed" outputs the mask seed; "noise_ledger", the noise ledger file; "signature" queries the digital signature of the initiator for the entire data packet.

[0076] S108. The steps for verifying and publishing statistical results are detailed. In this embodiment, the data packet integrity verification process is automatically completed by each participating party. After receiving the statistical result data packet, each participating party first extracts the digital signature of the data packet, and then verifies the signature using the public key of the query initiator. If the verification passes, it indicates that the data packet has not been tampered with during transmission and was indeed generated by the query initiator; if the verification fails, the data packet is rejected, and the anomaly is reported to the trusted third-party auditing platform.

[0077] Optionally, the interpretability information verification process is automated by each data provider. Each data provider compares the interpretability information in the data packet with the query authorization file it received, verifying whether the statistical indicators, grouping dimensions, time ranges, and product subset conditions are consistent. If inconsistencies are found, the data packet is rejected, and the anomaly is reported to a trusted third-party auditing platform.

[0078] Specifically, during the slice verification process, each data provider first verifies whether its submitted data slice commitment matches the commitment in the data packet, confirming that its data slice has been correctly used for this computation. Then, it verifies whether the commitments of other data providers are genuine and valid, and whether any commitments have been forged. The verification method is as follows: the commitment is verified using the data provider's public key. If the verification passes, the commitment is genuine and valid; otherwise, the commitment is invalid.

[0079] For example, the access path verification process is performed by recalculating the access path hash chain. Each participant recalculates the hash values ​​of the query plan, query authorization file, data slicing commitment, computation task decomposition process, intermediate results, and final result aggregation process based on the access path commitment in the data packet, and then generates a new hash chain. If the new hash chain matches the access path commitment in the data packet, the verification passes; otherwise, the verification fails.

[0080] In some embodiments, the differential privacy compliance verification process is automatically completed by a trusted third-party auditing platform. The trusted third-party auditing platform recalculates the noise parameters and noise sequence based on the records in the noise ledger, verifying their consistency with the records in the noise ledger. Simultaneously, it verifies whether the added noise meets the requirements of ε-differential privacy and whether it exceeds the allocated budget. If the verification passes, the differential privacy noise addition process is considered compliant; otherwise, it is considered non-compliant.

[0081] Furthermore, during the results release process, the trusted third-party auditing platform adds its own audit signature to the statistical results data packet to confirm the authenticity, completeness, and compliance of the data packet. Then, the audit-signed data packet is released to the query initiator. Simultaneously, the hash value of the data packet is recorded in an immutable audit log for subsequent auditing. The query initiator can only use data packets signed by the trusted third-party auditing platform and must not use unsigned data packets.

[0082] S109. Result Reproduction and Audit Step Detailing: In this embodiment, the audit request initiation process involves the auditor submitting a formal audit request to the trusted third-party audit platform. The audit request file includes the following: Basic information of the auditor, including the auditor's name, address, contact information, and legal representative's identification; Audit request information, including query identifier, audit purpose, audit scope, and audit time requirements; Identity verification materials, the auditor's business license, audit qualification certificate, and power of attorney.

[0083] Optionally, the audit materials acquisition process can be conducted online. The trusted third-party audit platform grants the auditor temporary access to audit materials, allowing the auditor to obtain all relevant audit materials online through the system's provided audit interface. These materials include query plans, query authorization documents, data slice commitments, noise ledgers, statistical result data packages, and audit logs.

[0084] Specifically, during the isolation environment setup process, the auditor needs to build a reproduction environment that is completely identical to the original computing environment, including: Hardware environment, including server model, CPU model, memory size, and storage capacity; Software environment, including operating system version, database version, middleware version, and application version; System parameters, including global system parameters, cryptographic algorithm parameters, and differential privacy parameters; The network environment is completely physically isolated from the production environment and is not connected to any external network.

[0085] For example, during the data slice verification process, if the auditor needs to further verify the content of the data slice, they can request each data provider to re-extract the corresponding data slice in an isolated environment. In the isolated environment, the data provider re-extracts the data slice from its own original database according to the conditions in the query authorization, then calculates the hash value of the data slice and compares it with the hash value of the original data slice. If they match, it proves that the content of the data slice has not been tampered with; otherwise, it proves that the content of the data slice has been tampered with.

[0086] In some embodiments, during the computation reproduction process, the auditor may require each data provider to provide its corresponding secret share in an isolated environment to participate in the computation. Each data provider, in the isolated environment, regenerates its secret share for the data slice according to the original secret sharing scheme, and then participates in the computation. The reproduction process strictly follows the original computation task decomposition and execution order to ensure consistency in the computation process.

[0087] Furthermore, during the noise addition and reproduction process, the auditors, based on the records in the noise ledger, used the same noise parameters and random number generator to generate a noise sequence identical to the original calculation. Simultaneously, using the same output mask seed, they generated an output mask identical to the original calculation. Then, the noise sequence was added to the initial statistical results obtained from the reproduction, and the output mask was applied to obtain the reproduced statistical results.

[0088] As an implementation method, the audit report generation process uses a standardized format, including the following: Basic audit information, including audit report number, audit date, auditor's name, auditee's name, and query identifier; Audit scope and purpose: Clearly define the scope of this audit and the objectives to be achieved; Provide information about the reproduction environment, including a detailed description of the hardware, software, system parameters, and network environment. The reproduction process is described in detail, including the specific steps for data slice verification, calculation process reproduction, and noise addition reproduction. The results comparison involves comparing the reproduced results with the original results bit by bit, and explaining the comparison results. The audit conclusion should clearly state whether the original calculation process was authentic and compliant, and whether the results were reproducible; The auditor's signature, the auditor's representative's signature, and the auditor's official seal are affixed.

[0089] Example 1: Cross-bank Personal Credit Risk Grouping Statistical Analysis. In this example, the query initiator is the Risk Management Department of a state-owned commercial bank, which needs to statistically analyze the delinquency rates of personal credit customers of different age groups and income levels from May 1, 2023 to April 30, 2024, to assess the bank's overall credit risk and formulate risk control strategies. The data providers are three other national joint-stock commercial banks, each holding its own personal credit customer data. The trusted third-party auditing platform is the Financial Technology Certification Center of the People's Bank of China. The specific implementation steps of this example are as follows: Pre-authorization and basic information synchronization: all participating parties complete system initialization, identity authentication, data metadata registration, standardization of personal loan delinquency rate statistics, and authorization rule configuration. The standardized definition of delinquency rate is the proportion of loan balances overdue for more than 90 days to the total loan balance. Age groups are categorized as 18-30, 31-45, 46-60, and over 60 years old; income groups are categorized as below 50,000 yuan, 50,000-100,000 yuan, 100,000-200,000 yuan, and above 200,000 yuan.

[0090] The query request is generated and submitted. The query initiator parses the business requirements, formulates a query plan, applies for a differential privacy budget of 0.2, digitally signs the query plan and budget application, and submits the query request to a trusted third-party auditing platform.

[0091] The query request review and authorization process involves a trusted third-party auditing platform that verifies the integrity of the query request, reviews its compliance, verifies the access permissions of the query initiator, allocates a differential privacy budget of 0.2, generates a query authorization file, and distributes it to all participating parties.

[0092] Data slicing and commitment generation: Each data provider verifies the query authorization document, extracts personal credit data slices from May 1, 2023 to April 30, 2024, calculates the data slice hash value, generates data slice commitments, and submits the commitment information to a trusted third-party auditing platform.

[0093] Secure multi-party statistical computation involves the query initiator breaking down the overdue rate grouping and statistical task into four sub-tasks: local counting, local summation, global summation, and global division. Each data provider divides its data slices into secret shares according to the Shamir (3,2) secret sharing scheme and distributes them. Each participating party executes the sub-computation tasks in a distributed manner, verifying the correctness of intermediate results through zero-knowledge proofs. The query initiator aggregates all computational result shares to obtain the initial overdue rate statistics.

[0094] Differential privacy noise addition and mask generation: The query initiator, based on a differential privacy budget of 0.2, uses a Laplace mechanism to calculate a noise scale parameter of 5. A 128-bit output mask seed is generated, and a Laplace noise sequence is generated and added to the initial delinquency rate statistics. A noise ledger is generated and submitted to a trusted third-party auditing platform.

[0095] The statistical results data packet is assembled, interpretability information is extracted from the initiator, supporting information is collected, an access path commitment is generated, and the overdue rate result is rounded to two decimal places using an output mask. Groups with a sample size of less than 100 are marked as "insufficient data". The statistical results data packet is assembled according to a standardized format and digitally signed.

[0096] The statistical results are verified and published. Each participating party verifies the integrity, interpretability, slice proof, and access path of the data packet. A trusted third-party auditing platform verifies the compliance of the added differential privacy noise. After all verifications are passed, the trusted third-party auditing platform adds an audit signature and publishes the data packet to the query initiator.

[0097] Results Reproduction and Audit: In June 2024, the State Financial Supervision and Administration Bureau conducted a regulatory audit of the credit risk statistics work of the state-owned commercial bank. The audit team set up an isolated reproduction environment to verify the authenticity of the data slices, reproduce the secure multi-party statistical calculation process and noise addition process, and compared the reproduced results with the original results to ensure complete consistency. An audit report was generated to confirm the authenticity and compliance of the calculation process.

[0098] Example 2: Cross-Institutional Anti-Money Laundering Transaction Threshold Early Warning Analysis. In this example, the query initiator is an anti-money laundering monitoring center that needs to monitor large and suspicious transactions across banks. An early warning signal is issued when a customer's cumulative daily transaction amount exceeds 500,000 yuan. The data providers are five commercial banks, each holding their own customer transaction data. The trusted third-party auditing platform is the Anti-Money Laundering Bureau of the People's Bank of China. The specific implementation steps of this example are as follows: Pre-authorization and basic information synchronization: all participating parties complete system initialization, identity authentication, transaction data metadata registration, unification of anti-money laundering transaction statistical standards, and authorization rule configuration. The unified standard defines large-value transactions as those with a cumulative daily transaction amount exceeding 500,000 yuan, and suspicious transactions as those meeting the suspicious transaction characteristics stipulated by the People's Bank of China.

[0099] The query request is generated and submitted. The query initiator parses the business requirements, formulates a query plan, applies for a differential privacy budget of 0.15, digitally signs the query plan and budget application, and submits the query request to a trusted third-party auditing platform.

[0100] The query request review and authorization process involves a trusted third-party auditing platform that verifies the integrity of the query request, reviews its compliance, verifies the access permissions of the query initiator, allocates a differential privacy budget of 0.15, generates a query authorization document, and distributes it to all participating parties.

[0101] Data slicing and commitment generation: Each data provider verifies the query authorization document, extracts the customer transaction data slices for the day, calculates the data slice hash value, generates data slice commitments, and submits the commitment information to a trusted third-party auditing platform.

[0102] Secure multi-party statistical calculations are performed. The query initiator decomposes the large transaction threshold early warning task into two sub-tasks: local comparison and global comparison. Each data provider divides the transaction data into secret shares according to an additive secret sharing scheme and distributes them. Each participating party performs comparison operations in a distributed manner, verifying the correctness of intermediate results through zero-knowledge proofs. The query initiator aggregates all calculation result shares to obtain the initial early warning result.

[0103] Differential privacy noise addition and mask generation: The query initiator calculates noise parameters using an exponential mechanism based on a differential privacy budget of 0.15. A 128-bit output mask seed is generated, and a noise sequence is generated and added to the initial warning result. A noise ledger is generated and submitted to a trusted third-party auditing platform.

[0104] The statistical result data packet is assembled, interpretability information is extracted from the initiator, supporting information is collected, an access path commitment is generated, and the application output mask only shows whether the threshold is exceeded, without displaying the specific transaction amount. The statistical result data packet is assembled according to a standardized format and digitally signed.

[0105] The statistical results are verified and published. Each participating party verifies the integrity, interpretability, slice proof, and access path of the data packet. A trusted third-party auditing platform verifies the compliance of the added differential privacy noise. After all verifications are passed, the trusted third-party auditing platform adds an audit signature and publishes the data packet to the query initiator.

[0106] Results Reproduction and Audit: In July 2024, the People's Bank of China conducted a regulatory audit of the monitoring work of the Anti-Money Laundering Monitoring Center. The auditors built an isolated reproduction environment to verify the authenticity of the data slices, reproduced the secure multi-party statistical calculation process and the noise addition process, and compared the reproduced results with the original results to ensure complete consistency. An audit report was generated to confirm the authenticity and compliance of the calculation process.

[0107] To verify the technical effectiveness of this invention, we conducted comparative experiments, comparing the method of this invention with traditional secure multi-party computation methods, differential privacy methods, and federated learning methods. The experimental results are as follows:

[0108] Experimental results show that the method of the present invention is superior to traditional methods in terms of interpretability, reverse risk control, result reproducibility, result accuracy, and audit convenience. It can simultaneously meet the triple requirements of financial cross-domain analysis for interpretable output, controllable reverse risk, and reproducible auditable results.

[0109] This invention also provides a cross-domain financial data fusion and analysis device based on anonymous querying and secure multi-party statistics. This device corresponds one-to-one with the above-described method embodiments and is used to execute the steps in the above-described method embodiments. The device includes the following functional modules: The pre-authorization and basic information synchronization module is used to perform the pre-authorization and basic information synchronization steps, specifically to generate and synchronize system global parameters; perform participant identity authentication and issue digital certificates; manage the registration and updating of data element information; organize the formulation and maintenance of unified statistical standards; and configure and manage data access authorization rules.

[0110] The query request generation and submission module is used to execute the query request generation and submission steps. Specifically, it is used to parse business requirements and map them to a unified statistical caliber; formulate a standardized query plan; calculate the required differential privacy budget amount; digitally sign the query plan and budget application; and submit the query request to a trusted third-party auditing platform.

[0111] The query request review and authorization module is used to perform query request review and authorization steps, specifically to verify the digital signature of the query request; review the compliance of the query plan; verify the access rights of the query initiator; review and allocate the differential privacy budget; generate and distribute the query authorization file; and record the query review process to the audit log.

[0112] The data slicing and commitment generation module is used to perform the data slicing and commitment generation steps, specifically to verify the authenticity and legality of the query authorization document; extract data slices that meet the conditions based on the query authorization; calculate the hash value of the data slice; generate data slice commitments based on the hash values; and submit the commitment information to a trusted third-party auditing platform.

[0113] The secure multi-party statistical computation module is used to perform secure multi-party statistical computation steps. Specifically, it decomposes the overall computation task into basic sub-computation tasks; generates and distributes secret shares of local data slices; executes each sub-computation task in a distributed manner; verifies the correctness of intermediate results through zero-knowledge proofs; and aggregates the computation result shares of all participants to obtain the initial statistical results.

[0114] The differential privacy noise addition and mask generation module is used to perform the differential privacy noise addition and mask generation steps. Specifically, it is used to select an appropriate differential privacy mechanism according to the statistical analysis type; calculate noise parameters; generate a cryptographically secure output mask seed; generate a noise sequence and add it to the initial statistical results; generate a complete noise ledger; and submit the noise ledger to a trusted third-party auditing platform.

[0115] The statistical result data packet assembly module is used to perform the statistical result data packet assembly steps, specifically: extracting standardized interpretability information; collecting all cryptographic proof information; generating a complete access path commitment; applying an output mask to control the granularity of result disclosure; assembling the statistical result data packet according to a standardized format; and digitally signing the entire data packet.

[0116] The statistical results verification and publishing module is used to perform statistical results verification and publishing steps. Specifically, it is used to verify the digital signature of the data packet; verify the consistency between interpretability information and query authorization; verify the authenticity of the data slice commitment; verify the integrity and compliance of the access path; verify the compliance of differential privacy noise addition; add audit signature and publish the data packet; and record the data packet publishing process to the audit log.

[0117] The Result Reproduction and Audit module is used to perform result reproduction and audit steps, specifically to verify the identity and permissions of the auditor. Obtain all relevant audit materials; build an isolated reproduction environment completely identical to the original environment; verify the authenticity and integrity of the data slices; reproduce the secure multi-party statistical calculation process; reproduce the differential privacy noise addition and masking application process; compare the reproduction results with the original results; generate a formal audit report.

[0118] The present invention also provides an electronic device, including at least one processor and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the at least one processor to perform the cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistical analysis as described in any of the above embodiments.

[0119] Specifically, the electronic device may further include an input interface, an output interface, and a communication unit. The input interface is used to receive user-inputted business requirements and query parameters; the output interface is used to output statistical result data packets and audit reports; and the communication unit is used to conduct encrypted communication with other electronic devices, transmitting query requests, query authorizations, data slice commitments, and statistical result data packet information.

[0120] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor can be a microprocessor or any conventional processor.

[0121] The memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart memory card (SMC), secure digital card (SD) card, flash memory card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0122] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics as described in any of the above embodiments.

[0123] The computer-readable storage medium can be any physical device or apparatus capable of storing computer programs, such as electronic storage media, magnetic storage media, and optical storage media. Specifically, the computer-readable storage medium includes, but is not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), digital versatile optical disc (DVD), Blu-ray disc, flash memory cards, USB flash drives, and portable hard drives.

[0124] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics, characterized in that: Includes the following steps: Pre-authorization and basic information synchronization complete system initialization, participant identity authentication, data metadata registration, statistical standardization, and data access authorization rule configuration; The query initiator generates and submits a digitally signed query request, which includes a query plan and a differential privacy budget request. A trusted third-party auditing platform reviews the compliance and access permissions of query requests, allocates differential privacy budgets, and generates query authorizations. Each data provider extracts data slices based on the query authorization, generates a data slice commitment, and submits it to a trusted third-party auditing platform; The query initiator and the data provider use a secure multi-party computation technique based on secret sharing to complete joint statistical computation in a secret state to obtain the initial result; The query initiator adds differential privacy noise based on the allocated budget, generates an output mask seed and noise ledger, and submits it for auditing. The query initiator assembles and signs a statistical results data packet containing statistical results, caliber version, interpretable information, slice proof, access path commitment, mask seed, and noise ledger; The authenticity and compliance of the data packet are verified by multiple parties, and it is released after being audited by a trusted third-party auditing platform. The auditors used the data packet information to reproduce the calculation process in an isolated environment and generated an audit report.

2. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics as described in claim 1, characterized in that, In the pre-authorization and basic information synchronization steps, the statistical standards are managed using versioning, all historical versions are permanently retained, and all queries must reference the published unified standards.

3. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics as described in claim 1, characterized in that, In the query request review and authorization process, the differential privacy budget adopts centralized ledger management to record the budget usage of each query initiator, and the query request is rejected when the cumulative budget exceeds the limit.

4. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics as described in claim 1, characterized in that, In the data slicing and commitment generation steps, the data slices only contain the fields specified by the query authorization, strictly adhering to the principle of data minimization, and the data slice commitments are generated based on a cryptographic commitment scheme.

5. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics according to claim 1, characterized in that, In the secure multi-party statistical computation step, after each sub-computation task is completed, the participating parties generate zero-knowledge proofs to verify the correctness of the computation process. If the verification fails, the computation is terminated.

6. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics according to claim 1, characterized in that, In the step of adding differential privacy noise, the corresponding differential privacy mechanism is selected according to the type of statistical analysis. The Laplace mechanism is used for linear statistics, and the exponential mechanism is used for nonlinear statistics.

7. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics as described in claim 1, characterized in that, In the assembly step of the statistical result data packet, the access path commitment is generated using hash chain technology to record the complete execution path from query initiation to result generation.

8. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics according to claim 1, characterized in that, The verification steps for the statistical results include verifying data packet integrity, consistency of interpretable information, authenticity of slice proof, compliance of access path, and compliance of differential privacy.

9. The cross-domain financial data fusion analysis method based on anonymous query and secure multi-party statistics according to claim 1, characterized in that, In the result reproduction and auditing process, the reproduction environment is completely consistent with the original environment. The consistency between the reproduction result and the original result is compared by recalculation.

10. A cross-domain financial data fusion and analysis device based on anonymous query and secure multi-party statistics, characterized in that, include: The pre-authorization module is used to perform the pre-authorization and basic information synchronization steps; The query generation module is used to execute the steps of generating and submitting query requests; The review and authorization module is used to perform the review and authorization steps for query requests; The data slicing module is used to perform the data slicing and commitment generation steps; The secure computation module is used to perform secure multi-party statistical computation steps; The noise addition module is used to perform the differential privacy noise addition and mask generation steps; The data packet assembly module is used to perform the statistical result data packet assembly step; The verification and publication module is used to perform the verification and publication steps for statistical results; The audit reproduction module is used to reproduce the results and perform the audit steps.

Images