Security detection of computing framework

Abstract

Disclosed are a security detection method and apparatus for a computing framework, a medium, and an electronic device. The method comprises: storing in a trusted execution environment corresponding to a computing framework under detection generated first secret state data and second secret state data both corresponding to a testing service of said computing framework; on the basis of the first secret state data and the second secret state data and according to a generated computing code, determining a computing result in the trusted execution environment by means of interaction between a master node and slave nodes, and determining the data volume of the computing result as an initial data volume; deleting the specified number of data from the first secret state data, on the basis of the first secret state data and the second secret state data after deletion and according to the computing code, re-determining the computing result by means of interaction between the master node and the slave nodes, and determining the data volume of the computing result as a first data volume; and on the basis of the difference between the first data volume and the initial data volume, determining a detection result of said computing framework. The risk of privacy data leakage is reduced.

Description

Security detection of computing framework TECHNICAL FIELD

[0001] The present specification relates to the technical field of computers, and particularly relates to a security detection method and device of a computing framework, a medium and an electronic device. BACKGROUND

[0002] With the development of information technology and artificial intelligence, more and more computing frameworks appear, wherein the computing framework can be a homomorphic big data framework for homomorphic computation on data. The homomorphic big data framework mainly consists of a platform party, a data provider party and a data user party. The platform party is used to provide cluster computing capability and data storage service. The data provider party provides business data for homomorphic computation and stores the business data in the platform party. The data user party is used to provide business information required for performing a business, and uses the platform party to analyze and compute the business data provided by the data provider party according to the business information, so as to perform the business. In addition, the data provided by the data provider party can include private data. In order not to leak the data privacy, the data can be stored in a trusted execution environment of the platform party. In the trusted execution environment, the platform party can use the cluster computing capability to analyze and compute the business data to obtain a business result. The trusted execution environment of the platform party includes a master node, a slave node and an authority system. The master node is used to generate a computing task and distribute it to the slave node. The slave node is used to execute the computing task. The authority system is used to forward the business information and the execution result.

[0003] At present, the data user party generally determines the business information first and submits it to the authority system. The business information includes a computing code and information of data required for performing a business, and the data required for performing a business is at least the business data provided by the data provider party. The authority system sends the business information to the data provider party, so that the data provider party evaluates the business information, authorizes the data user party after the evaluation is passed, and returns a notification information to the authority system. After receiving the notification information, the authority system sends the computing code to the master node in the trusted execution environment of the platform party, so that the master node generates a computing task according to the computing code and distributes the computing task to the slave node, so that the slave node executes the computing task and returns the execution result to the master node. The master node sends the execution result to the data user party through the authority system.

[0004] However, when homomorphic computation is performed by using the homomorphic big data framework, if the data user party and the platform party are at risk, the data user party and the platform party can jointly guess the business data provided by the data provider party, resulting in leakage of the privacy of the business data provided by the data provider party. Therefore, how to perform security detection on the homomorphic big data framework to ensure the security of the business data provided by the data provider party is a very important problem.

[0005] Based on this, the present specification provides a security detection method of a computing framework. SUMMARY

[0006] The present specification provides a security detection method, device, medium and electronic equipment of a computing framework to partially solve the above problems existing in the prior art.

[0007] The present specification adopts the following technical solutions.

[0008] The present specification provides a security detection method of a computing framework, comprising: generating first ciphertext data, second ciphertext data and computing code corresponding to a test service of a to-be-detected computing framework, and storing the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the to-be-detected computing framework, the trusted execution environment comprising a master node and a slave node, the plaintext of the first ciphertext data and the plaintext of the second ciphertext data being at least partially the same; in the trusted execution environment, based on the first ciphertext data and the second ciphertext data, according to the computing code, through the interaction of the master node and the slave node, determining a computing result, and determining the data volume of the computing result as an initial data volume; deleting a specified number of data from the first ciphertext data, and continuing to determine the computing result and the data volume of the computing result based on the first ciphertext data after deletion and the second ciphertext data according to the computing code through the interaction of the master node and the slave node, and taking the data volume of the computing result as a first data volume; determining a detection result of the to-be-detected computing framework according to the difference between the first data volume and the initial data volume.

[0009] Optionally, the computing code at least includes the code of a data table connection operation, the computing result is the result obtained after executing the code of the data table connection operation, and the trusted execution environment comprises a plurality of slave nodes. Accordingly, determining the data volume of the computing result can specifically include: obtaining the data volume of the result obtained after each slave node executes the code of the data table connection operation; and taking the sum of the obtained data volumes as the data volume of the computing result.

[0010] Optionally, determining the detection result of the to-be-detected computing framework according to the difference between the first data volume and the initial data volume specifically includes: judging whether the first data volume is less than the initial data volume; if yes, determining that the detection result of the to-be-detected computing framework is that there is a security risk; and if not, determining that the detection result of the to-be-detected computing framework is that there is no security risk.

[0011] Optionally, the determining the detection result of the to-be-detected computing framework as having a security risk specifically comprises: determining to-be-detected data according to the deleted data; and determining the detection result of the to-be-detected computing framework as having a security risk when the to-be-detected data is included in the second ciphertext data.

[0012] Optionally, the computing code at least comprises code of a data table connection operation, and the data table connection operation is an inner connection. Correspondingly, the determining the detection result of the to-be-detected computing framework as having a security risk specifically can comprise: determining an identifier of the deleted data as to-be-detected data; and determining the detection result of the to-be-detected computing framework as having a security risk when the to-be-detected data is included in the second ciphertext data.

[0013] Optionally, the computing code comprises code of a data table connection operation and code of a partition operation, and the partition operation is a data partition operation on the second ciphertext data. Correspondingly, the determining the computing result and the data quantity of the computing result through the interaction between the master node and the slave node specifically can comprise: obtaining sub-results corresponding to each partition by executing the code of the data table connection operation based on the ciphertext data in each partition through the interaction between the master node and the slave node, and determining the data quantity of the sub-results corresponding to each partition; determining a computing result based on the sub-results corresponding to each partition, and determining the data quantity of the computing result based on the data quantity of the sub-results corresponding to each partition. In addition, the determining the detection result of the to-be-detected computing framework as having a security risk specifically can comprise: determining a second data quantity of the sub-results corresponding to each partition according to the initial data quantity, and determining a third data quantity of the sub-results corresponding to each partition according to the first data quantity; determining a partition corresponding to the deleted data from the sub-results corresponding to each partition according to the second data quantity of the sub-results corresponding to each partition and the third data quantity of the sub-results corresponding to each partition; determining attribute information corresponding to the deleted data according to the partition corresponding to the deleted data; determining an identifier of the deleted data, and taking the determined identifier and attribute information as to-be-detected data; and determining the detection result of the to-be-detected computing framework as having a security risk when the to-be-detected data is included in the second ciphertext data.

[0014] Optionally, the determining the detection result of the to-be-detected computing framework as not having a security risk specifically comprises: taking the first ciphertext data after deletion as the first ciphertext data again, continuing to delete a specified number of data from the first ciphertext data, and continuing to determine a computing result based on the first ciphertext data after deletion and the second ciphertext data, and determine a first data quantity of the computing result, until the number of data in the first ciphertext data after deletion reaches a preset threshold, and determining the detection result of the to-be-detected computing framework as not having a security risk.

[0015] The present specification provides a security detection device of a computing framework, comprising: a generation module configured to generate first ciphertext data, second ciphertext data and computing code corresponding to test business of the computing framework to be detected, and store the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the computing framework to be detected, wherein the trusted execution environment comprises a master node and a slave node, and the plaintext of the first ciphertext data and the plaintext of the second ciphertext data are at least partially the same; a computing module configured to, in the trusted execution environment, determine a computing result based on the first ciphertext data and the second ciphertext data according to the computing code through interaction between the master node and the slave node, determine a data volume of the computing result as an initial data volume, delete a specified amount of data from the first ciphertext data, and continue to determine a computing result based on the first ciphertext data after deletion and the second ciphertext data according to the computing code through interaction between the master node and the slave node, and determine a data volume of the computing result as a first data volume; and a detection module configured to determine a detection result of the computing framework to be detected according to a difference between the first data volume and the initial data volume.

[0016] Optionally, the computing code at least comprises code of a data table connection operation, the computing result is a result obtained after executing the code of the data table connection operation, and the trusted execution environment comprises a plurality of slave nodes. Correspondingly, the computing module can be specifically configured to: obtain data volumes of results obtained after each slave node executes the code of the data table connection operation; and take a sum of the obtained data volumes as the data volume of the computing result.

[0017] The detection module can be specifically configured to: determine whether the first data volume is less than the initial data volume; if yes, determine that the detection result of the computing framework to be detected is that there is a security risk; and if not, determine that the detection result of the computing framework to be detected is that there is no security risk.

[0018] The detection module can be specifically configured to: determine to-be-detected data according to the deleted data; and when the to-be-detected data is included in the second ciphertext data, determine that the detection result of the computing framework to be detected is that there is a security risk.

[0019] The computing code can at least comprise code of a data table connection operation, and the data table connection operation can be an inner connection. Correspondingly, the detection module can be specifically configured to: determine an identifier of the deleted data as to-be-detected identifier; and when the to-be-detected identifier is included in the second ciphertext data, determine that the detection result of the computing framework to be detected is that there is a security risk.

[0020] The computing code can include code of a data table connection operation and code of a partition operation, and the partition operation can be a data partition operation on the second ciphertext data. Accordingly, the computing module can be specifically configured to: based on the ciphertext data in each partition, execute the code of the data table connection operation through interaction between the master node and the slave node, obtain a sub-result corresponding to each partition, and determine a data amount of the sub-result corresponding to each partition; determine a computing result according to the sub-result corresponding to each partition, and determine a data amount of the computing result according to the data amount of the sub-result corresponding to each partition. In addition, the detection module can be specifically configured to: determine a second data amount of the sub-result corresponding to each partition according to the initial data amount, and determine a third data amount of the sub-result corresponding to each partition according to the first data amount; determine a partition corresponding to deleted data from each partition according to the second data amount of the sub-result corresponding to each partition and the third data amount of the sub-result corresponding to each partition; determine attribute information corresponding to the deleted data according to the partition corresponding to the deleted data; determine an identifier of the deleted data, and take the determined identifier and attribute information as to-be-detected data; and when the to-be-detected data is included in the second ciphertext data, determine that the detection result of the to-be-detected computing framework is that there is a security risk.

[0021] The detection module can be specifically configured to: take the deleted first ciphertext data as first ciphertext data again, continue to delete a specified amount of data from the first ciphertext data, and continue to determine a computing result based on the deleted first ciphertext data and the second ciphertext data, and determine a first data amount of the computing result, until the number of data in the deleted first ciphertext data reaches a preset threshold, and determine that the detection result of the to-be-detected computing framework is that there is no security risk.

[0022] The present specification provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the security detection method of the computing framework.

[0023] The present specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the security detection method of the computing framework when executing the program.

[0024] The above at least one technical solution adopted by the present specification can achieve the following beneficial effects.

[0025] The security detection method of the computing framework provided in the specification stores the generated first ciphertext data and second ciphertext data corresponding to the test service of the to-be-detected computing framework in the trusted execution environment corresponding to the to-be-detected computing framework, and in the trusted execution environment, determines the calculation result based on the first ciphertext data and the second ciphertext data according to the generated computing code through the interaction of the master node and the slave node, and determines the data volume of the calculation result as the initial data volume. A specified number of data is deleted from the first ciphertext data, and based on the first ciphertext data and the second ciphertext data after the deletion, the calculation result is determined again according to the computing code through the interaction of the master node and the slave node, and the data volume of the calculation result is determined as the first data volume. According to the difference between the first number and the initial data volume, the detection result of the to-be-detected computing framework is determined.

[0026] As can be seen from the above method, in the security detection of the computing framework, the first ciphertext data, the second ciphertext data and the computing code corresponding to the test service of the to-be-detected computing framework are generated, and the first ciphertext data and the second ciphertext data are stored in the trusted execution environment corresponding to the to-be-detected computing framework. In the trusted execution environment, the calculation result is determined based on the first ciphertext data and the second ciphertext data according to the computing code through the interaction of the master node and the slave node, and the data volume of the calculation result is determined as the initial data volume. A specified number of data is deleted from the first ciphertext data, and based on the first ciphertext data and the second ciphertext data after the deletion, the calculation result is determined again according to the computing code through the interaction of the master node and the slave node, and the data volume of the calculation result is determined as the first data volume. According to the difference between the first number and the initial data volume, the detection result of the to-be-detected computing framework is determined. The security of the to-be-detected computing framework is detected by simulating the deletion of the first ciphertext data by the data user and simulating the acquisition of the data volume of the calculation result based on the first ciphertext data and the second ciphertext data after the deletion by the platform, to observe the difference between the first data volume and the initial data volume, thereby improving the security of the to-be-detected computing framework and reducing the risk of privacy data leakage. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings described herein are used to provide further understanding of the specification, and form a part of the specification. The illustrative embodiments of the specification and their descriptions serve to explain the specification, and do not constitute an improper limitation on the specification.

[0028] FIG. 1 is a flowchart of a security detection method of a computing framework provided in the specification.

[0029] FIG. 2 is a schematic diagram of a ciphertext computation provided in the specification.

[0030] FIG. 3 is a schematic diagram of a to-be-detected computing framework provided in the specification.

[0031] FIG. 4 is a schematic diagram of a process for performing a computing task, according to an embodiment of the present disclosure.

[0032] FIG. 5 is a schematic diagram of a process for task execution, according to an embodiment of the present disclosure.

[0033] FIG. 6 is a schematic diagram of a security detection device of a computing framework, according to an embodiment of the present disclosure.

[0034] FIG. 7 is a schematic diagram of an electronic device corresponding to FIG. 1, according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] For the purpose of making the purpose, technical scheme and advantages of the present disclosure clearer, the technical scheme of the present disclosure will be described clearly and completely in the following with reference to the embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present disclosure, but not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present disclosure.

[0036] The embodiments of the present disclosure provide a security detection method, device, medium and electronic device of a computing framework, which will be described in detail below with reference to the drawings.

[0037] FIG. 1 is a schematic diagram of a flow of a security detection method of a computing framework, according to an embodiment of the present disclosure, which specifically includes the following steps.

[0038] S100: generating first ciphertext data, second ciphertext data and computing code corresponding to a test service of a to-be-detected computing framework, and storing the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the to-be-detected computing framework; the trusted execution environment includes a master node and a slave node; the plaintext of the first ciphertext data and the plaintext of the second ciphertext data are at least partially the same.

[0039] In the ciphertext computing using the ciphertext big data framework, as shown in FIG. 2, which is a schematic diagram of ciphertext computing provided in the specification, the data user first determines the business information and submits it to the authority system. The business information includes the computing code and the information of the data required for executing the business, which can include the business data provided by the data provider and the business data provided by the data user. For example, the business data provided by the data provider is Table A, which includes the transaction data of each user, including the attributes of user identification, user name and transaction amount. The business data provided by the data user is Table B, which includes the basic information of each user, including the attributes of user identification, user name and user address. The computing code is generated by the data user, for example, the computing code can be to connect Table A and Table B with the condition that the user identification of Table A is equal to the user identification of Table B, to obtain the connection result, and to determine the average value of the attribute value corresponding to the transaction amount in the connection result.

[0040] Then, the authority system sends the business information to the data provider to enable the data provider to evaluate the business information. After the evaluation is passed, the data provider authorizes the data user and returns the notification information to the authority system. Generally, when the data provider determines that the execution result obtained after executing the computing code is not its own business data, that is, the execution result obtained after executing the computing code does not contain its own business data, the data provider generally authorizes the data user to use its own business data. For example, assuming that the computing code is to connect Table A and Table B with the condition that the user identification of Table A is equal to the user identification of Table B, to obtain the connection result, and to determine the average value of the transaction amount in the connection result, the execution result obtained after executing the computing code is the average value, not the specific data in Table A, so the data provider authorizes the data user to use its own Table A.

[0041] Then, the authority system sends the computing code to the master node in the trusted execution environment of the platform party after receiving the notification information, so that the master node generates a computing task according to the computing code and distributes the computing task to the slave node, so that the slave node executes the computing task and returns the execution result to the master node. The master node sends the execution result to the data user through the authority system, so that the data user determines the execution result corresponding to the computing code.

[0042] However, when the ciphertext computing is performed using the ciphertext big data framework, when the data user and the platform party are at risk, the data user and the platform party can jointly speculate the data provided by the data provider by observing the communication data volume between the master node and the slave node, thereby causing the privacy leakage of the data provided by the data provider, and causing the security risk of the ciphertext big data framework.

[0043] Based on this, in the present specification, the device for security detection of the computing framework can generate the first ciphertext data, the second ciphertext data and the computing code corresponding to the test business of the computing framework to be detected, and store the first ciphertext data and the second ciphertext data in the trusted execution environment corresponding to the computing framework to be detected. Wherein, the device for security detection of the computing framework can be a server of a third-party detection agency, or a system or platform of a third-party detection agency, or a device such as a mobile phone, a personal computer (PC) and the like capable of executing the scheme of the present specification. For the convenience of description, the following will be described taking the third-party detection agency as the execution subject.

[0044] In the present specification, the third-party detection agency is an agency for security detection of the computing framework to be detected, and the computing framework to be detected includes a ciphertext big data framework of a data provider, a data user and a platform party, and the platform party includes a trusted execution environment, the trusted execution environment includes a master node and a slave node, and can also include an authority system, as shown in FIG. 3, which is a schematic diagram of a computing framework to be detected provided in the present specification. The test business is a security detection of the computing framework to be detected. In order to perform the test business, that is, to perform the security detection of the computing framework to be detected, the third-party detection agency simulates the execution environment of the computing framework to be detected in advance, that is, the third-party detection agency can generate the first ciphertext data, the second ciphertext data and the computing code corresponding to the test business of the computing framework to be detected, at the same time, a trusted execution environment is constructed in advance and serves as the trusted execution environment corresponding to the computing framework to be detected, that is, the trusted execution environment of the platform party in the computing framework to be detected. And the trusted execution environment includes a master node and a slave node.

[0045] The calculation code is the simulation code generated by the third-party testing agency simulating the data user. This calculation code includes at least data table join operation code, and this data table join operation must include at least an inner join; other joins are also possible, but this specification does not specify a particular limitation. In addition to data table join operation code, this calculation code may also include arithmetic operation code, which can be addition, multiplication, or division operation code. This calculation code can be an SQL statement. The calculation code can be based on the condition that the attribute value corresponding to the unique identifier of the first encrypted data is equal to the attribute value corresponding to the unique identifier of the second encrypted data, or any other join condition, to perform an inner join on the first and second encrypted data to obtain an intermediate result. Then, the average value of the attribute values ​​corresponding to the target attribute in the intermediate result is determined, or other operations are performed on the intermediate result; this specification does not specify a particular limitation. The target attribute can be an attribute corresponding to the first encrypted data or an attribute corresponding to the second encrypted data; this specification does not specify a particular limitation. It should be noted that the data user knows the attributes corresponding to the data provider's business data, but does not know the specific attribute values ​​of the data provider's business data.

[0046] In this specification, both the first and second encrypted data refer to simulated encrypted data generated by the data provider and data user, respectively, by a third-party testing organization. The first encrypted data can be either the encrypted data of the data user or the encrypted data of the data provider, and the second encrypted data can be either the encrypted data of the data provider or the encrypted data of the data user. For ease of explanation, the first encrypted data in this specification refers to the encrypted data of the data user, that is, the simulated encrypted data generated by the third-party testing organization simulating the data user, and the second encrypted data refers to the encrypted data of the data provider, that is, the simulated encrypted data generated by the third-party testing organization simulating the data provider.

[0047] Furthermore, the first encrypted data is obtained by encrypting the first data by a third-party testing organization, and the second encrypted data is obtained by encrypting the second data by the same third-party testing organization. In other words, the first data is the plaintext of the first encrypted data, and the second data is the plaintext of the second encrypted data. Both the first and second data are generated by the third-party testing organization simulating the data user and data provider, respectively. The first data can be the business data of the data user, while the second data can be the business data of the data provider. That is, the first data is simulated business data generated by the third-party testing organization simulating the data user, and the second data is simulated business data generated by the third-party testing organization simulating the data provider.

[0048] The encryption strategies for the first data and the second data can be the same or different, but generally the encryption strategies for the first data and the second data are different, because the first data and the second data are respectively generated by the third-party detection institution as data of different parties. Specifically, the encryption strategy used to encrypt the first data to obtain the first ciphertext data and the encryption strategy used to encrypt the second data to obtain the second ciphertext data are not limited in the specification. The encryption strategy can be symmetric encryption, asymmetric encryption, or any other existing encryption strategy. In addition, the plaintext of the first ciphertext data and the plaintext of the second ciphertext data are at least partially the same, that is, the first data and the second data are at least partially the same.

[0049] The business data is in the form of a data table, and the business data includes a plurality of data, each data includes attribute values corresponding to a plurality of attributes, and the attributes at least include a unique identifier, that is, each data has a corresponding unique identifier. The business data can be randomly generated by the third-party detection institution based on the stored historical data. Specifically, the third-party detection institution can use any existing generation algorithm to generate business data based on the pre-stored historical data, or use a pre-trained generation model to generate business data based on the pre-stored historical data. Specifically, taking historical transaction data as an example, the third-party detection institution can generate simulated transaction data (i.e., business data) based on the pre-stored historical transaction data. The simulated transaction data can include attribute values of attributes such as identification, name, region, and transaction amount. Based on this, the attributes corresponding to the first data and the attributes corresponding to the second data can be completely the same or partially the same, and the specification does not make a specific limitation. The attributes corresponding to the first data and the attributes corresponding to the second data both at least include a unique identifier. For attribute values, the unique identifier attribute values included in the first data and the unique identifier attribute values included in the second data are at least partially the same.

[0050] For example, the first data includes two data [1, Zhang San, Xi'an, 100] and [2, Li Si, Xi'an, 100], and the second data includes three data [1, Zhang San, male], [2, Li Si, female] and [3, Wang Wu, male], and the attributes corresponding to the first data are unique identifier, name, region and transaction amount, and the attributes corresponding to the second data are unique identifier, name and gender, and the attributes corresponding to the first data and the attributes corresponding to the second data are partially the same. In addition, the unique identifier attribute values included in the first data and the unique identifier attribute values included in the second data are at least partially the same, that is, the first data includes "1, Zhang San" and "2, Li Si", and the second data includes "1, Zhang San" and "2, Li Si".

[0051] S102: In the trusted execution environment, based on the first ciphertext data and the second ciphertext data, the interaction between the master node and the slave node is determined according to the calculation code, the calculation result is determined, and the data amount of the calculation result is determined as an initial data amount.

[0052] In this specification, generally, the data provider generally only limits the calculation logic (that is, the execution order of various types of operation codes) and the range of using its own business data when authorized, that is, when the calculation code is evaluated, but generally does not limit the business data of the data user. Therefore, after the data user is authorized, the data user can transform its own business data and execute the same calculation code multiple times, and observe the size of the calculation result returned by the slave node to the master node when the data table connection operation in the calculation code is executed each time, so as to infer the intersection data between the data provider and the data user, and further infer the business data of the data provider, resulting in data privacy leakage, which causes the secure risk of the ciphertext big data framework.

[0053] Therefore, the third-party detection institution can simulate a joint attack of the data user and the platform to detect the security of the to-be-detected calculation framework. It should be noted that the data provider has authorized the data user in this specification. Specifically, the third-party detection institution determines the calculation result and the data amount of the calculation result as an initial data amount in a trusted execution environment based on the first ciphertext data and the second ciphertext data according to the calculation code through the interaction between the master node and the slave node. The trusted execution environment is pre-constructed for the third-party detection institution and is in the third-party detection institution, and the trusted execution environment includes the master node and the slave node, and the master node and the slave node are also pre-deployed in the trusted execution environment by the third-party detection institution. The calculation result is the result obtained after the code of the data table connection operation is executed. The data amount is the size of the calculation result. Since the calculation result is calculated by the slave node based on the first ciphertext data and the second ciphertext data according to the calculation code, and is sent to the master node by the slave node, the data amount of the calculation result is also the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node. The above initial data amount is the data amount corresponding to the calculation result obtained based on the first ciphertext data and the second ciphertext data.

[0054] In the present specification, when the third-party detection institution determines the calculation result based on the first secret state data and the second secret state data according to the calculation code through the interaction between the master node and the slave node, the third-party detection institution generates a calculation task based on the calculation code through the master node and sends it to the slave node. Then, the slave node determines the calculation result based on the first secret state data and the second secret state data by executing the received calculation task, and sends it to the master node. The calculation task is a task generated based on the calculation code. Specifically, the calculation code can be parsed to obtain a parsing result, and the calculation task can be generated according to the parsing result. The parsing result can be the code of various operations contained in the calculation code, such as connection operation, operation and acquisition operation. The calculation task is the task corresponding to the calculation code, and the execution result of the calculation task is the result obtained after executing the calculation code, and the calculation result is the result obtained after executing the code of the data table connection operation in the calculation code. That is, if the calculation code only includes the code of the data table connection operation, the calculation result is the result obtained after executing the calculation task. If the calculation code includes not only the code of the data table connection operation but also the operation code, the calculation result is the result obtained after executing the code of the data table connection operation in the calculation code. At this time, the slave node executes the code of the data table connection operation in the calculation task to obtain the calculation result and sends it to the master node. Subsequently, the slave node determines the final result based on the calculation result according to the other code after the code of the data table connection operation in the calculation task and sends it to the master node. For the sake of convenience, the process of determining the final result based on the calculation result is not described again.

[0055] Based on this, when determining the data amount of the calculation result, the third-party detection institution can obtain the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node. Specifically, the third-party detection institution can obtain the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node through packet capture. Of course, the third-party detection institution can also obtain the interaction log between the master and slave nodes, and determine the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node according to the interaction log.

[0056] In the present specification, the trusted execution environment includes a plurality of slave nodes, each of which includes at least part of the second ciphertext data, that is, the second ciphertext data is stored by the slave nodes collectively, so that the master node can generate a plurality of computing tasks according to the computing code and send each computing task to each slave node, so that each slave node executes the received computing task to improve the execution speed of the computing task, and there are tasks that can be executed in parallel in each computing task, so the master node can distribute each computing task to each slave node according to the execution order of each computing task. Based on this, when the third-party detection agency determines the computing result based on the first ciphertext data and the second ciphertext data according to the computing code through the interaction between the master node and the slave nodes, the third-party detection agency generates each computing task based on the computing code through the master node, and determines the execution order of each computing task, and then sends each computing task to each slave node according to the execution order. Then, each slave node executes the received computing task based on the first ciphertext data and the second ciphertext data to determine the execution result and sends it to the master node, so that the master node determines each computing result according to each execution result.

[0057] Among them, each slave node receives at least one computing task, and there are computing tasks that can be executed in parallel in each computing task. The computing task is a task generated based on the computing code, and the computing result is the result obtained after executing the code for performing the data table join operation in the computing code. That is, if the computing code only includes the code for performing the data table join operation, the computing task is to execute the code for performing the data table join operation, and the execution result of the computing task is the computing result. If the computing code includes not only the code for performing the data table join operation but also the operation code, the computing task includes two types of tasks, i.e., the code for performing the data table join operation and the operation code, and the execution result obtained after executing the computing task of the code for performing the data table join operation is the computing result. Therefore, each slave node will obtain an execution result after executing the received computing task, but only when the computing task is the code for performing the data table join operation, the execution result of the computing task will be the computing result, and when the computing task is not the code for performing the data table join operation, the execution result of the computing task is not the computing result. Therefore, when each computing result is determined according to each execution result, the execution result obtained after executing the computing task of the code for performing the data table join operation is the computing result.

[0058] In the above process, when each computing task is sent to each slave node according to the execution order, for each computing task, the slave node corresponding to the computing task is determined according to the execution order, and the computing task is sent to the determined slave node, so that the slave node executes the computing task and determines the execution result. In the process of determining the slave node corresponding to the computing task, a slave node can be randomly selected from the slave nodes, and the selected slave node is the slave node corresponding to the computing task. Alternatively, the slave node corresponding to the computing task can be determined from the slave nodes according to the resources required for executing the computing task and the remaining resources of the slave nodes. Of course, the slave node corresponding to the computing task can also be determined according to the ciphertext data required by the computing task, and the slave node storing the ciphertext data is used as the slave node corresponding to the computing task. The specific means for determining the slave node corresponding to the computing task is not limited in the present specification.

[0059] For example, as shown in FIG. 4, which is a schematic diagram of a process of executing a computing task provided in the present specification, the process shown in FIG. 3 takes one master node and three slave nodes as an example, and assumes that there are three computing tasks. The master node can determine the slave node corresponding to each computing task according to the execution order (i.e., computing task 1, computing task 2, and computing task 3). For example, for computing task 1, the master node determines that the slave node corresponding to the computing task 1 is the slave node 1, and sends the computing task 1 to the slave node 1. Similarly, the computing task 2 is sent to the slave node 2, and the computing task 3 is sent to the slave node 3. Subsequently, each slave node (i.e., slave nodes 1-3) executes the received computing task based on the first ciphertext data and the second ciphertext data to determine the execution result and sends the execution result to the master node, so that the master node determines the computing result according to the execution results (i.e., execution results 1-3).

[0060] Based on this, when determining the data amount of the computing result, the data amount of the result obtained by each slave node executing the code of the data table connection operation can be obtained, and the sum of the obtained data amounts is used as the data amount of the computing result. Since the computing code can include not only the code of the data table connection operation but also the operation code, and the computing task includes two types of tasks, i.e., the task of executing the code of the data table connection operation and the task of executing the operation code, the obtained data amount is the data amount of the execution result obtained by each slave node executing the code of the data table connection operation, and the sum of the obtained data amounts is the data amount of the computing result, that is, the data amount of the computing result is the sum of the data amounts of the results obtained by each slave node executing the code of the data table connection operation.

[0061] In addition, in step S102, the computing result is obtained based on the first ciphertext data and the second ciphertext data, and the data amount of the computing result is the initial data amount. The process of determining the computing result and the data amount of the computing result is as described above, and will not be described here.

[0062] S104: delete a specified number of data from the first ciphertext data, and continue to determine the calculation result and the data amount of the calculation result again based on the first ciphertext data after deletion and the second ciphertext data, the calculation code, the interaction between the master node and the slave node, and take the data amount as the first data amount.

[0063] In the present specification, the third-party detection institution can simulate a joint attack of the data user and the platform, reduce the business data of the data user by simulation, and observe the size of the calculation result returned by the slave node to the master node when performing the data table connection operation in the calculation code based on the reduced business data, so as to detect the security of the calculation framework. Specifically, the third-party detection institution can delete a specified number of data from the first ciphertext data, and continue to determine the calculation result and the data amount of the calculation result again based on the first ciphertext data after deletion and the second ciphertext data, the calculation code, the interaction between the master node and the slave node, and take the data amount as the first data amount.

[0064] The specified number is a pre-set number, which can be 1 or other numerical values, and the present specification does not make specific limitations. The third-party detection institution can randomly delete a specified number of data from the first ciphertext data, or delete a specified number of data from the first ciphertext data according to a specified order, which is a pre-set order and can be an order from small to large according to the unique identifier, and the present specification does not make specific limitations. The calculation result is obtained based on the first ciphertext data after deletion and the second ciphertext data, and is also the result obtained after executing the code of the data table connection operation. The first data amount is the data amount corresponding to the calculation result obtained based on the first ciphertext data after deletion and the second ciphertext data.

[0065] In the present specification, the process of re-determining the calculation result based on the first ciphertext data and the second ciphertext data after deletion, according to the calculation code, through the interaction between the master node and the slave node is similar to the process of determining the calculation result based on the first ciphertext data and the second ciphertext data, according to the calculation code, through the interaction between the master node and the slave node in step S102, except that the ciphertext data used to determine the calculation result is different. The calculation result in step S102 is obtained based on the first ciphertext data and the second ciphertext data, while the calculation result in step S104 is obtained based on the first ciphertext data and the second ciphertext data after deletion. Specifically, the third-party detection agency generates a calculation task based on the calculation code through the master node and sends it to the slave node. Then, the slave node executes the received calculation task based on the first ciphertext data and the second ciphertext data after deletion, determines the calculation result, and sends it to the master node. The calculation task is a task generated based on the calculation code. The calculation task is a task corresponding to the calculation code, and the execution result of the calculation task is the result obtained after executing the calculation code. The calculation result is the result obtained after executing the code for data table connection operation in the calculation code. In addition, when determining the data amount of the calculation result, the third-party detection agency can obtain the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node. The specific process is similar to the process of determining the data amount of the calculation result in step S102, which will not be described here.

[0066] In the present specification, the process of re-determining the calculation result based on the first ciphertext data and the second ciphertext data after deletion, according to the calculation code, through the interaction between the master node and the slave node is similar to the process of determining the calculation result based on the first ciphertext data and the second ciphertext data, according to the calculation code, through the interaction between the master node and the slave node in step S102, except that the ciphertext data used to determine the calculation result is different. The calculation result in step S102 is obtained based on the first ciphertext data and the second ciphertext data, while the calculation result in step S104 is obtained based on the first ciphertext data and the second ciphertext data after deletion. Specifically, the third-party detection agency generates a calculation task based on the calculation code through the master node and sends it to the slave node. Then, the slave node executes the received calculation task based on the first ciphertext data and the second ciphertext data after deletion, determines the calculation result, and sends it to the master node. The calculation task is a task generated based on the calculation code. The calculation task is a task corresponding to the calculation code, and the execution result of the calculation task is the result obtained after executing the calculation code. The calculation result is the result obtained after executing the code for data table connection operation in the calculation code. In addition, when determining the data amount of the calculation result, the third-party detection agency can obtain the data amount of the communication between the slave node and the master node when the slave node sends the calculation result to the master node. The specific process is similar to the process of determining the data amount of the calculation result in step S102, which will not be described here.

[0067] S106: determining the detection result of the to-be-detected computing framework according to the difference between the first data amount and the initial data amount.

[0068] In the present specification, the third detection mechanism can determine the detection result of the to-be-detected computing framework according to the difference between the first data amount and the initial data amount. The detection result can include one of existence of a security risk and non-existence of a security risk. When there is a difference between the first data amount and the initial data amount or the difference is large, it indicates that the data amount of the computing result is changed by deleting the first ciphertext data of the data user, and the deleted data is the intersection data of the first ciphertext data and the second ciphertext data, thereby indicating that the to-be-detected computing framework exists a security risk, and the detection result of the to-be-detected computing framework is existence of a security risk. However, when there is no difference between the first data amount and the initial data amount or the difference is small, it indicates that the data amount of the computing result is not changed or is not changed much by deleting the first ciphertext data of the data user, and the deleted data is not the intersection data of the first ciphertext data and the second ciphertext data, thereby indicating that the to-be-detected computing framework does not exist a security risk, and the detection result of the to-be-detected computing framework is non-existence of a security risk.

[0069] Specifically, the third-party detection mechanism can determine the difference between the initial data amount and the first data amount, and when the difference is greater than a target threshold, determine that the detection result of the to-be-detected computing framework is existence of a security risk. When the difference is less than the target threshold, determine that the detection result of the to-be-detected computing framework is non-existence of a security risk. The target threshold is a pre-set value, which can be 0 or other values, and the present specification does not make specific limitations.

[0070] In addition, the third-party detection mechanism can also determine whether the first data amount is less than the initial data amount. If yes, determine that the detection result of the to-be-detected computing framework is existence of a security risk. If no, determine that the detection result of the to-be-detected computing framework is non-existence of a security risk.

[0071] As can be seen from the above method, when performing security detection on the computing framework, the third-party detection institution can generate the first ciphertext data, the second ciphertext data and the computing code corresponding to the test service of the to-be-detected computing framework, store the first ciphertext data and the second ciphertext data in the trusted execution environment corresponding to the to-be-detected computing framework, and in the trusted execution environment, determine the computing result and the data amount of the computing result as the initial data amount based on the first ciphertext data and the second ciphertext data according to the computing code through the interaction between the master node and the slave node. A specified amount of data is deleted from the first ciphertext data, and the computing result is determined again based on the first ciphertext data and the second ciphertext data after the deletion and the computing code through the interaction between the master node and the slave node, and the data amount of the computing result is determined as the first data amount. The detection result of the to-be-detected computing framework is determined according to the difference between the first amount and the initial data amount. The security of the to-be-detected computing framework is improved by simulating the deletion of the first ciphertext data by the data user and simulating the platform party to obtain the data amount of the computing result based on the first ciphertext data and the second ciphertext data after the deletion, so as to observe the difference between the first data amount and the initial data amount, thereby reducing the risk of privacy data leakage.

[0072] In the present specification, the detection result can also be the risk level of the to-be-detected computing framework. The greater the difference between the first data amount and the initial data amount, the higher the risk of the to-be-detected computing framework, and the higher the risk level of the to-be-detected computing framework. Conversely, the smaller the difference between the first data amount and the initial data amount, the lower the risk of the to-be-detected computing framework, and the lower the risk level of the to-be-detected computing framework. Based on this, in step S106, the third-party detection institution can determine the difference between the initial data amount and the first data amount, determine the risk level corresponding to the difference according to the preset risk level rule, and determine the determined risk level as the detection result of the to-be-detected computing framework. The risk level rule is preset, and the risk level rule specifies the risk level corresponding to each difference value range, for example, the difference value range of 0-2 corresponds to the risk level of level one, and the difference value range of 3-5 corresponds to the risk level of level two.

[0073] In the present specification, in order to determine that the deleted data is the data of the data provider, so as to determine that the to-be-detected computing framework indeed has a security risk, when it is determined in the above step S106 that the detection result of the to-be-detected computing framework is that there is a security risk, the third-party detection institution can determine the to-be-detected data according to the deleted data. When the to-be-detected data is included in the second ciphertext data, it is determined that the detection result of the to-be-detected computing framework is that there is a security risk. The deleted data is the specified number of data deleted from the first ciphertext data in the above step S104. The third-party detection institution can directly take the deleted data as the to-be-detected data, can also take the plaintext corresponding to the deleted data as the to-be-detected data, or can take the unique identifier of the corresponding attribute value in the plaintext corresponding to the deleted data as the to-be-detected data. For the convenience of description, in the present specification, when the deleted data corresponds to the plaintext as the to-be-detected data, and when the to-be-detected data is included in the plaintext of the second ciphertext data, that is, the to-be-detected data is included in the plaintext of the second ciphertext data, it is indicated that the to-be-detected data is the plaintext corresponding to the intersection data of the first ciphertext data and the second ciphertext data, and then the detection result of the to-be-detected computing framework is that there is a security risk. In addition, when the to-be-detected data is not included in the second ciphertext data, it is indicated that the to-be-detected data is not the plaintext corresponding to the intersection data of the first ciphertext data and the second ciphertext data, and then the detection result of the to-be-detected computing framework is that there is no security risk.

[0074] In addition, the computing code at least includes the code of the data table connection operation, and the data table connection operation is an inner connection. When it is determined in the above step S106 that the detection result of the to-be-detected computing framework is that there is a security risk, the third-party detection institution can directly determine the detection result of the to-be-detected computing framework according to the identifier of the deleted data. Specifically, the third-party detection institution can determine the identifier of the deleted data and take it as the to-be-detected identifier. When the to-be-detected identifier is included in the second ciphertext data, it is determined that the detection result of the to-be-detected computing framework is that there is a security risk. The to-be-detected identifier is the unique identifier corresponding to the deleted data, and the to-be-detected identifier can be the plaintext of the unique identifier corresponding to the deleted data. When the to-be-detected identifier is included in the plaintext of the second ciphertext data, that is, the to-be-detected identifier is included in the plaintext of the second ciphertext data, it is indicated that the deleted data is the plaintext corresponding to the intersection data of the first ciphertext data and the second ciphertext data, and then the detection result of the to-be-detected computing framework is that there is a security risk. In addition, when the to-be-detected identifier is not included in the second ciphertext data, it is indicated that the deleted data is not the plaintext corresponding to the intersection data of the first ciphertext data and the second ciphertext data, and then the detection result of the to-be-detected computing framework is that there is no security risk.

[0075] In the present specification, in addition to the code of the data table connection operation, the calculation code can also include code of a partition operation. The calculation code can be an inner join operation on the first confidential data and the second confidential data with the condition that the attribute value of the unique identifier of the first confidential data is equal to the attribute value of the unique identifier of the second confidential data, or other arbitrary connection conditions, to obtain an intermediate result. Then, the intermediate result is partitioned according to the attribute value of the first attribute, that is, the data with the same attribute value of the first attribute in the intermediate result is divided into a partition. For example, the intermediate result includes three data “[1, Zhang San, Xi'an, 100, male], [2, Li Si, Xi'an, 100, female], [3, Wang Wu, Beijing, 200, male]”, and the first attribute is the region. Then, [1, Zhang San, Xi'an, 100, male] and [2, Li Si, Xi'an, 100, female] are a partition, that is, the first partition, and the data in the first partition correspond to the region “Xi'an”. [3, Wang Wu, Beijing, 200, male] is a partition, that is, the second partition, and the data in the second partition correspond to the region “Beijing”. Then, the average value of the attribute values of the other attributes except the first attribute in the data in each partition is calculated, or other operations are performed on the data in each partition, which are not limited in the present specification. The first attribute is the attribute corresponding to the second confidential data and is not the attribute corresponding to the first confidential data. For this calculation code, the data provider can authorize the data user to execute the calculation code using the business data of the data provider, although the first attribute can be exposed in this calculation code, but the specific attribute value corresponding to the first attribute is not exposed.

[0076] However, if the calculation code is transformed to first partition the second confidential data according to the attribute value of the first attribute, and then perform an inner join operation on the first confidential data and the second confidential data in each partition with the condition that the attribute value of the unique identifier of the first confidential data is equal to the attribute value of the unique identifier of the second confidential data in each partition, or other arbitrary connection conditions, to obtain an intermediate result. Then, the average value of the attribute values of the other attributes except the first attribute in the intermediate result corresponding to each partition is calculated, or other operations are performed on the data in each partition (i.e., the intermediate result), which are not limited in the present specification. The average value obtained by executing the transformed calculation code is actually the same as the average value obtained by executing the calculation code before the transformation. The data provider believes that the business data has not been leaked, so the data provider generally authorizes the data user to execute the transformed calculation code using the business data of the data provider.

[0077] However, if the computing code is transformed computing code, the data user and the platform jointly delete the first ciphertext data, observe the change of the data amount corresponding to the data in each partition, and determine that the data to be deleted belongs to the partition whose data amount changes, so as to infer the corresponding attribute information of the deleted data, that is, the attribute values of the first attribute corresponding to the deleted data are equal, and further infer the specific attribute values of the first attribute corresponding to the deleted data according to the attribute values of other attributes of the deleted data, thereby causing the business data of the data provider to be leaked and causing the secure big data framework to have a security risk.

[0078] Therefore, the computing code includes code of a data table connection operation and code of a partition operation, the partition operation is a data partition operation on the second ciphertext data. Moreover, the computing logic of the computing code is to execute the code of the partition operation first and then execute the code of the data table connection operation, that is, when the computing code is executed, the code of the partition operation is executed first and then the code of the data table connection operation is executed. Therefore, since the process of determining the computing result and the data amount of the computing result through the interaction between the master node and the slave node in the above step S102 is similar to the process of re-determining the computing result and re-determining the data amount of the computing result through the interaction between the master node and the slave node in the above step S104, only the computing result in the above step S102 is obtained based on the first ciphertext data and the second ciphertext data, and the computing result in the above step S104 is obtained based on the deleted first ciphertext data and the second ciphertext data. Therefore, when the computing result and the data amount of the computing result are determined through the interaction between the master node and the slave node, or when the computing result and the data amount of the computing result are re-determined through the interaction between the master node and the slave node, the third-party detection agency can execute the code of the data table connection operation based on the ciphertext data in each partition through the interaction between the master node and the slave node, obtain the sub-result corresponding to each partition, and determine the data amount of the sub-result corresponding to each partition. The computing result is determined according to the sub-result corresponding to each partition, and the data amount of the computing result is determined according to the data amount of the sub-result corresponding to each partition.

[0079] The computing result includes a plurality of sub-results, and the sum of the data amounts of the sub-results is the data amount of the computing result. When the computing result is obtained based on the first ciphertext data and the second ciphertext data, the sum of the data amounts of the sub-results included in the computing result is the initial data amount. However, when the computing result is obtained based on the deleted first ciphertext data and the second ciphertext data, the sum of the data amounts of the sub-results included in the computing result is the first data amount. The ciphertext data in each partition is obtained by performing a data partition operation on the second ciphertext data. The attribute values of the first attribute of the ciphertext data in each partition are equal.

[0080] When the code for performing the data table join operation based on the ciphertext data in each partition is executed by the master node and the slave node to obtain the sub-results corresponding to each partition, the third-party detection institution generates a calculation task based on the calculation code and sends it to the slave node through the master node. Then, the slave node executes the received calculation task based on the first ciphertext data and the second ciphertext data, determines the sub-results corresponding to each partition obtained after the code for performing the data table join operation based on the ciphertext data in each partition is executed, and returns them to the master node. Subsequently, the master node directly takes the sub-results corresponding to each partition as the calculation results. In addition, the process of determining the data amount of the sub-results corresponding to each partition is similar to the process of determining the data amount of the calculation results, and thus will not be described here. Subsequently, the data amount of the sub-results corresponding to each partition is directly taken as the data amount of the calculation results.

[0081] Based on this, when it is determined in the step S106 that the detection result of the to-be-detected calculation framework is that there is a security risk, the third-party detection institution can determine the second data amount of the sub-results corresponding to each partition according to the initial data amount, and determine the third data amount of the sub-results corresponding to each partition according to the first data amount. Then, according to the second data amount of the sub-results corresponding to each partition and the third data amount of the sub-results corresponding to each partition, the partition corresponding to the deleted data is determined from each partition. Subsequently, according to the partition corresponding to the deleted data, the attribute information corresponding to the deleted data is determined. The identification of the deleted data is determined, and the determined identification and attribute information are taken as the to-be-detected data. When the to-be-detected data is included in the second ciphertext data, it is determined that the detection result of the to-be-detected calculation framework is that there is a security risk.

[0082] The initial data amount is composed of the data amounts corresponding to each sub-result included in the calculation result, and the calculation result is obtained based on the first ciphertext data and the second ciphertext data, i.e., the initial data amount is composed of the second data amount of the sub-results corresponding to each partition. The first data amount is composed of the data amounts corresponding to each sub-result included in the calculation result (i.e., the third data amount), and the calculation result is obtained based on the first ciphertext data and the second ciphertext data after deletion, i.e., the first data amount is composed of the third data amount of the sub-results corresponding to each partition.

[0083] When the second data amount of the sub-results corresponding to each partition and the third data amount of the sub-results corresponding to each partition are used to determine the partition corresponding to the deleted data from each partition, for each partition, when the third data amount of the sub-result corresponding to the partition is less than the second data amount of the sub-result corresponding to the partition, the partition is determined to be the partition corresponding to the deleted data.

[0084] When the deleted data is one, the attribute information can be the partition corresponding to the deleted data. When the deleted data is multiple, the attribute information includes the deleted data with equal attribute values of the first attribute, that is, which deleted data belongs to the same partition, and the attribute values of the first attribute of the deleted data are equal. Of course, the third-party detection agency can also determine the data with the same partition from the deleted data, and determine the attribute value corresponding to the first attribute based on the determined data, that is, the attribute value of the first attribute corresponding to the data with the same partition. The prediction algorithm is pre-set. For example, the deleted data is “[1, Zhang San, loves to eat noodles, 100] and [3, Wang Wu, loves to eat noodles, 200]”, and the two data belong to the same partition. Assuming that the first attribute is the region, the third detection agency can determine the attribute value corresponding to the first attribute based on “[1, Zhang San, loves to eat noodles, 100] and [3, Wang Wu, loves to eat noodles, 200]”, that is, Xi'an.

[0085] The process of determining that the detection result of the to-be-detected computing framework is a security risk when the second ciphertext data includes the to-be-detected data is similar to the process of determining that the detection result of the to-be-detected computing framework is a security risk when the second ciphertext data includes the to-be-detected identifier in step S106, and the process of determining that the detection result of the to-be-detected computing framework is a security risk when the second ciphertext data includes the to-be-detected data. Therefore, it will not be repeated here.

[0086] In the present specification, when it is determined in step S106 that the detection result of the to-be-detected computing framework is not a security risk, the third-party detection agency can also continue to delete a specified number of data from the first ciphertext data as the first ciphertext data after deletion, and continue to determine the computing result based on the first ciphertext data after deletion and the second ciphertext data, and determine the first data amount of the computing result, until the number of data in the first ciphertext data after deletion reaches a preset threshold, and it is determined that the detection result of the to-be-detected computing framework is not a security risk. The preset threshold is a pre-set threshold, which can be 0, and can also be other numerical values, and the present specification does not make specific limitations. When the number of data in the first ciphertext data after deletion reaches the preset threshold, it means that no matter how to change the first ciphertext data, the data amount of the computing result will not change, and the to-be-detected computing framework will not leak the plaintext of the second ciphertext data. Therefore, the detection result of the to-be-detected computing framework is not a security risk.

[0087] In addition, in order to better ensure that the to-be-detected computing framework does not have security risks, the third-party detection institution can take the first data amount before each deletion as the initial data amount after the next deletion. Specifically, the third-party detection institution can also take the first ciphertext data after deletion as the first ciphertext data again, take the first data amount as the initial data amount, continue to delete a specified amount of data from the first ciphertext data, and continue to determine the computing result based on the first ciphertext data after deletion and the second ciphertext data, and determine the first data amount of the computing result, until the number of data in the first ciphertext data after deletion reaches the preset threshold, and determine that the detection result of the to-be-detected computing framework is that there is no security risk.

[0088] In the present specification, the above-mentioned trusted execution environment includes a plurality of slave nodes, the computing code includes the code of the data table connection operation and the code of the partition operation, and the partition operation is a data partition operation on the second ciphertext data. Moreover, the computing logic of the computing code is to execute the code of the partition operation first, and then execute the code of the data table connection operation. When the above-mentioned interaction between the master node and the slave nodes, based on the ciphertext data in each partition, executes the code of the data table connection operation to obtain the sub-result corresponding to each partition, the third-party detection institution generates each computing task based on the computing code through the master node, determines the execution order of each computing task, and then sends each computing task to each slave node according to the execution order. Then, through each slave node, based on the first ciphertext data and the second ciphertext data, the received computing task is executed, and the sub-result corresponding to each partition obtained after the code of the data table connection operation is executed based on the ciphertext data in each partition is determined and sent to the master node. Subsequently, the master node directly takes the sub-result corresponding to each partition returned by each slave node as each computing result.

[0089] Among them, the computing task includes the code of the data table connection operation and the code of the partition operation, and the second ciphertext data is stored in each slave node, that is, each slave node stores part of the second ciphertext data. Each slave node can determine the sub-result corresponding to a plurality of partitions, and each slave node receives at least one computing task. The ciphertext data in each partition of each slave node is the data partition operation performed by each slave node on the second ciphertext data stored by itself.

[0090] In addition, the process of determining the data amount of the sub-result corresponding to each partition is similar to the process of determining the data amount of the computing result in the above-mentioned step S102, and will not be described here. Subsequently, the data amount of the sub-result corresponding to each partition is directly taken as the data amount of the computing result.

[0091] In the present specification, the third-party detection institution can generate a detection report according to the detection result of the to-be-detected computing framework, and display the detection report. The detection report at least includes the detection result, and can further include information of a manufacturer of the to-be-detected computing framework, the information of the manufacturer including name, address, and the like. It should be noted that the to-be-detected computing framework in the present specification can be produced by the manufacturer and submitted to the third-party detection institution for security detection. Of course, the manufacturer can also be the third-party detection institution.

[0092] In the present specification, in order to determine the security of the to-be-detected computing framework, the third-party detection institution can perform security detection on the computing framework according to the preset period and by using the process shown in FIG. 1.

[0093] In the present specification, the above-mentioned permission system can also verify the data provider and the data user, so as to ensure that the data user has the permission to use the data of the data provider, and ensure that the data provider has the permission to allow others to use the business data. Therefore, after receiving the notification information, the permission system can verify the data user and the data provider respectively, and send the computing code to the master node in the trusted execution environment of the platform party after the verification is passed. It should be noted that in the present specification, the data provider and the data user are both verified by default, so when performing security detection by using the process shown in FIG. 1, the process of simulating the verification of the data provider and the data user is not needed.

[0094] In the present specification, the slave node can include a plurality of computing processes, each computing process executes a computing task, when the slave node receives a plurality of computing tasks, each computing task can be assigned to a computing process, and each computing process executes the assigned computing task. Specifically, as shown in FIG. 5, FIG. 5 is a process diagram of task execution provided in the present specification, the process shown in FIG. 5 takes two slave nodes (i.e., slave nodes 1-2) and one master node as an example, assuming that there are three computing tasks, i.e., computing tasks 1-3, the slave node 1 includes two computing processes, i.e., computing processes 1-2, and the slave node 2 includes one computing process, i.e., computing process 3. For each computing task, it is assumed that for the computing task 1, the slave node corresponding to the computing task 1, i.e., the slave node 1, is determined, and the computing task 1 is sent to the slave node 1. Similarly, the computing task 2 is sent to the slave node 1, and the computing task 3 is sent to the slave node 3. At this time, the slave node 1 receives two computing tasks, i.e., the computing tasks 1-2, so the slave node 1 can assign the computing task 1 to the computing process 1 for execution, and assign the computing task 2 to the computing process 2 for execution. The slave node 2 can directly assign the computing task 3 to the computing process 3 for execution. After subsequent execution is completed, the slave node 1 returns the execution result 1 corresponding to the computing task 1 and the execution result 2 corresponding to the computing task 2 to the master node, and the slave node 2 returns the execution result 3 corresponding to the computing task 3 to the master node.

[0095] In the present specification, in order to better perform security detection on the to-be-detected computing framework, the specified data quantity can be set to 1. In addition, the first ciphertext data can include more data than the second ciphertext data, that is, the quantity of the first data is more than the quantity of the second data, so that when the data quantity of the observation computing result is changed by deleting the first ciphertext data, more intersection data can be inferred.

[0096] Based on the same idea, the present specification also provides a corresponding security detection device for the computing framework, as shown in FIG. 6.

[0097] FIG. 6 is a schematic diagram of a security detection device for a computing framework provided in the present specification, which specifically includes a generation module 200 configured to generate first ciphertext data, second ciphertext data and computing code corresponding to a test service of a to-be-detected computing framework, and store the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the to-be-detected computing framework; the trusted execution environment includes a master node and a slave node; the plaintext of the first ciphertext data and the plaintext of the second ciphertext data are at least partially the same; a computing module 202 is configured to, in the trusted execution environment, based on the first ciphertext data and the second ciphertext data, according to the computing code, through the interaction between the master node and the slave node, determine a computing result, and determine the data quantity of the computing result as an initial data quantity; delete a specified quantity of data from the first ciphertext data, and continue to determine the computing result and the data quantity of the computing result based on the first ciphertext data after deletion and the second ciphertext data, according to the computing code, through the interaction between the master node and the slave node, and take the data quantity of the computing result as a first data quantity; and a detection module 204 is configured to determine a detection result of the to-be-detected computing framework according to the difference between the first data quantity and the initial data quantity.

[0098] Optionally, the computing code at least includes a code of a data table connection operation, and the computing result is a result obtained after the code of the data table connection operation is executed; the trusted execution environment includes a plurality of slave nodes; and the computing module 202 is specifically configured to obtain the data quantity of the result obtained after each slave node executes the code of the data table connection operation; and take the sum of the obtained data quantities as the data quantity of the computing result.

[0099] Optionally, the detection module 204 is specifically configured to determine whether the first data quantity is less than the initial data quantity; if yes, determine that the detection result of the to-be-detected computing framework is that there is a security risk; and if not, determine that the detection result of the to-be-detected computing framework is that there is no security risk.

[0100] Optionally, the detection module 204 is specifically configured to determine the to-be-detected data according to the deleted data; and determine that the detection result of the to-be-detected computing framework is that there is a security risk when the to-be-detected data is included in the second ciphertext data.

[0101] Optionally, the computing code at least includes code of a data table connection operation, and the data table connection operation is an inner connection; and the detection module 204 is specifically configured to determine the identifier of the deleted data as a to-be-detected identifier; and determine that the detection result of the to-be-detected computing framework is that there is a security risk when the to-be-detected identifier is included in the second ciphertext data.

[0102] Optionally, the computing code includes code of a data table connection operation and code of a partition operation, and the partition operation is a data partition operation on the second ciphertext data; the computing module 202 is specifically configured to obtain sub-results corresponding to each partition and determine data amounts of the sub-results corresponding to each partition by executing the code of the data table connection operation based on the ciphertext data in each partition through interaction between the master node and the slave node; determine a computing result according to the sub-results corresponding to each partition and determine a data amount of the computing result according to the data amounts of the sub-results corresponding to each partition; and the detection module 204 is specifically configured to determine second data amounts of the sub-results corresponding to each partition according to the initial data amount, determine third data amounts of the sub-results corresponding to each partition according to the first data amount, determine a partition corresponding to the deleted data from the partitions according to the second data amounts of the sub-results corresponding to each partition and the third data amounts of the sub-results corresponding to each partition, determine attribute information corresponding to the deleted data according to the partition corresponding to the deleted data, determine an identifier of the deleted data, and determine the to-be-detected data as the determined identifier and attribute information; and determine that the detection result of the to-be-detected computing framework is that there is a security risk when the to-be-detected data is included in the second ciphertext data.

[0103] Optionally, the detection module 204 is specifically configured to continue to delete a specified number of data from the first ciphertext data as the first ciphertext data after deletion, continue to determine a computing result based on the first ciphertext data after deletion and the second ciphertext data, and determine a first data amount of the computing result, until the number of data in the first ciphertext data after deletion reaches a preset threshold, and determine that the detection result of the to-be-detected computing framework is that there is no security risk.

[0104] The specification also provides a computer readable storage medium storing a computer program, and the computer program can be used to execute the security detection method of the computing framework shown in FIG. 1.

[0105] The specification also provides a schematic diagram of the electronic device shown in FIG. 7. As described in FIG. 7, FIG. 7 is a schematic diagram of the electronic device corresponding to FIG. 1 provided in the specification, which includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory at the hardware level, and can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the security detection method of the computing framework shown in FIG. 1 described above. Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or a logic device.

[0106] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0107] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0108] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0109] For the sake of description, the above apparatuses are described in various units by functions respectively. Of course, the functions of each unit can be implemented in the same or multiple software and / or hardware in implementing the present specification.

[0110] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0111] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0112] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0114] In one typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory. The memory can include non-persistent memory, random access memory (RAM), and / or non-volatile memory such as read-only memory (ROM) or flash memory, among others, in a computer readable medium. Memory is an example of computer readable media. Computer readable media includes permanent and non-permanent, movable and non-movable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory computer readable media, such as modulated data signals and carrier waves.

[0115] It should also be noted that the terms "comprising," "including," and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the identified element.

[0116] Those skilled in the art will appreciate that embodiments of the present specification can be devised for use with various computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers and the like. Embodiments of the present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote memory storage devices.

[0117] The specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of the program code means for executing steps of the methods disclosed herein. The particular sequence of steps and methods described in this specification is not the only sequence or method that can be implemented. As would be understood by those skilled in the art, the steps and methods described in this specification can be performed in a different order, and / or can be performed concurrently. As would also be understood by those skilled in the art, certain steps and methods that are trivial or obvious can be omitted from the specification. For purposes of discussion, the specifications is divided into major sections where the headings can not be present in the actual claims. The descriptions are presented in the order of importance, where the most important aspects are presented first, and less important aspects are presented later. The descriptions are not intended to be limiting.

[0118] Each of the embodiments described in this specification has different features, and each of the embodiments presents only those aspects of the application relevant to the particular embodiment. No embodiment necessarily presents the entire scope of the application. Various embodiments can offer several advantages over conventional solutions. However, none of the embodiments need necessarily offer advantages, and some embodiments can offer no advantages over conventional solutions.

[0119] The embodiments described above are merely examples of the present specification and should not be used to limit the present specification. The present specification can have various changes and modifications for those skilled in the art. Any modifications, equivalent replacements, improvements, etc. within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A security detection method of a computing framework, comprising: generating first ciphertext data, second ciphertext data and computing code corresponding to test business of a computing framework to be detected, and storing the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the computing framework to be detected; the trusted execution environment comprising a master node and a slave node; the plaintext of the first ciphertext data and the plaintext of the second ciphertext data being at least partially the same; in the trusted execution environment, determining a computing result based on the first ciphertext data and the second ciphertext data, according to the computing code, through interaction of the master node and the slave node, and determining a data volume of the computing result as an initial data volume; deleting a specified amount of data from the first ciphertext data, and continuing to determine a computing result based on the first ciphertext data after deletion and the second ciphertext data, according to the computing code, through interaction of the master node and the slave node, and re-determining a data volume of the computing result as a first data volume; determining a detection result of the computing framework to be detected according to a difference between the first data volume and the initial data volume.

2. The method of claim 1, wherein the computing code includes at least code for a data table join operation, and the computed result is a result obtained after executing the code for the data table join operation. the trusted execution environment comprises a plurality of slave nodes; determining the data volume of the computing result, specifically comprising: obtaining data volumes of results obtained after each slave node executes the code of the data table connection operation; summing up the obtained data volumes as the data volume of the computing result.

3. The method of claim 1, wherein determining the detection result of the computing framework to be detected according to the difference between the first data volume and the initial data volume specifically comprises: judging whether the first data volume is less than the initial data volume; if yes, determining that the detection result of the computing framework to be detected is that there is a security risk; if no, determining that the detection result of the computing framework to be detected is that there is no security risk.

4. The method of claim 3, wherein determining that the detection result of the computing framework to be detected is that there is a security risk specifically comprises: determining to-be-detected data according to the deleted data; when the to-be-detected data is included in the second ciphertext data, determining that the detection result of the computing framework to be detected is that there is a security risk.

5. The method of claim 3, wherein the computing code at least comprises code of a data table connection operation, and the data table connection operation is an inner connection; determining that the detection result of the computing framework to be detected is that there is a security risk specifically comprises: determining an identification of the deleted data as to-be-detected identification; when the to-be-detected identification is included in the second ciphertext data, determining that the detection result of the computing framework to be detected is that there is a security risk.

6. The method of claim 3, wherein the computing code comprises code of a data table connection operation and code of a partition operation, and the partition operation is a data partition operation on the second ciphertext data; determining a computing result based on the first ciphertext data and the second ciphertext data, according to the computing code, through interaction of the master node and the slave node, and determining a data volume of the computing result specifically comprises: code for performing the data table join operation based on the ciphertext data in each partition through interaction of the master node and the slave node, obtaining a sub-result corresponding to the each partition, and determining a data amount of the sub-result corresponding to the each partition; determining a calculation result according to the sub-result corresponding to the each partition, and determining a data amount of the calculation result according to the data amount of the sub-result corresponding to the each partition; determining that the detection result of the to-be-detected computing framework is that there is a security risk, specifically comprising: determining a second data amount of the sub-result corresponding to the each partition according to the initial data amount, and determining a third data amount of the sub-result corresponding to the each partition according to the first data amount; determining a partition corresponding to deleted data from the each partition according to the second data amount of the sub-result corresponding to the each partition and the third data amount of the sub-result corresponding to the each partition; determining attribute information corresponding to the deleted data according to the partition corresponding to the deleted data; determining an identifier of the deleted data, and taking the determined identifier and attribute information as to-be-detected data; when the to-be-detected data is included in the second ciphertext data, determining that the detection result of the to-be-detected computing framework is that there is a security risk.

7. The method of claim 3, determining that the detection result of the to-be-detected computing framework is that there is no security risk, specifically comprising: taking the deleted first ciphertext data as first ciphertext data again, continuing to delete a specified number of data from the first ciphertext data, and continuing to determine a calculation result based on the deleted first ciphertext data and the second ciphertext data, and determine a first data amount of the calculation result, until the number of data in the deleted first ciphertext data reaches a preset threshold, determining that the detection result of the to-be-detected computing framework is that there is no security risk.

8. A security detection device of a computing framework, comprising: a generation module configured to generate first ciphertext data, second ciphertext data corresponding to a test service of a to-be-detected computing framework, and a calculation code, and store the first ciphertext data and the second ciphertext data in a trusted execution environment corresponding to the to-be-detected computing framework; the trusted execution environment comprises a master node and a slave node; a plaintext of the first ciphertext data and a plaintext of the second ciphertext data are at least partially the same; a calculation module configured to, in the trusted execution environment, based on the first ciphertext data and the second ciphertext data, according to the calculation code, through interaction of the master node and the slave node, determine a calculation result, and determine a data amount of the calculation result as an initial data amount; delete a specified number of data from the first ciphertext data, and continue to determine a calculation result based on the deleted first ciphertext data and the second ciphertext data according to the calculation code, through interaction of the master node and the slave node, and re-determine a data amount of the calculation result as a first data amount; a detection module configured to determine a detection result of the to-be-detected computing framework according to a difference between the first data amount and the initial data amount. 9.The apparatus of claim 8, wherein the computing code comprises at least code of a data table join operation, and the computing result is a result obtained after execution of the code of the data table join operation; and the trusted execution environment comprises a plurality of slave nodes. The computing module is specifically configured to obtain data amounts of results obtained after execution of the code of the data table join operation by each slave node, and take a sum of the obtained data amounts as a data amount of the computing result. 10.The apparatus of claim 8, wherein the detecting module is specifically configured to determine whether the first data amount is less than the initial data amount, and if yes, determine that the detection result of the to-be-detected computing framework is that there is a security risk, and if not, determine that the detection result of the to-be-detected computing framework is that there is no security risk. 11.The apparatus of claim 10, wherein the detecting module is specifically configured to determine to-be-detected data according to the deleted data, and determine that the detection result of the to-be-detected computing framework is that there is a security risk when the to-be-detected data is included in the second ciphertext data. 12.The apparatus of claim 10, wherein the computing code comprises at least code of a data table join operation, and the data table join operation is an inner join. The detecting module is specifically configured to determine an identifier of the deleted data as to-be-detected data, and determine that the detection result of the to-be-detected computing framework is that there is a security risk when the to-be-detected data is included in the second ciphertext data. 13.The apparatus of claim 10, wherein the computing code comprises code of a data table join operation and code of a partition operation, and the partition operation is a data partition operation on the second ciphertext data. The computing module is specifically configured to execute the code of the data table join operation based on ciphertext data in each partition through interaction between the master node and the slave nodes, obtain a sub-result corresponding to each partition, and determine a data amount of the sub-result corresponding to each partition, determine a computing result according to the sub-result corresponding to each partition, and determine a data amount of the computing result according to the data amount of the sub-result corresponding to each partition. The detecting module is specifically configured to determine a second data amount of the sub-result corresponding to each partition according to the initial data amount, and determine a third data amount of the sub-result corresponding to each partition according to the first data amount. According to the second data amount of the sub-result corresponding to each partition and the third data amount of the sub-result corresponding to each partition, a partition corresponding to deleted data is determined from the partitions. According to the partition corresponding to the deleted data, attribute information corresponding to the deleted data is determined. An identifier of the deleted data is determined, and the determined identifier and attribute information are taken as to-be-detected data. When the to-be-detected data is included in the second ciphertext data, it is determined that the detection result of the to-be-detected computing framework is that there is a security risk.

14. The apparatus of claim 10, wherein the detection module is specifically configured to continue to delete a specified number of data from the first ciphertext data as the first ciphertext data after the deletion, and continue to determine a calculation result based on the first ciphertext data after the deletion and the second ciphertext data, and determine a first data amount of the calculation result, until the number of data in the first ciphertext data after the deletion reaches a preset threshold, and determine that the detection result of the to-be-detected calculation framework is that there is no security risk.

15. A computer readable storage medium, the storage medium storing a computer program, the computer program being executed by a processor to implement the method of any one of claims 1-7.

16. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any one of claims 1-7 when executing the program.

Images