CN113434891B

CN113434891B - Data fusion method, device, equipment and system

Info

Publication number: CN113434891B
Application number: CN202110769350.4A
Authority: CN
Inventors: 李武璐; 王雪; 韩东彪
Original assignee: CCB Finetech Co Ltd
Current assignee: CCB Finetech Co Ltd
Priority date: 2021-07-07
Filing date: 2021-07-07
Publication date: 2022-09-02
Anticipated expiration: 2041-07-07
Also published as: CN113434891A

Abstract

The embodiment of the specification provides a data fusion method, a data fusion device, data fusion equipment and a data fusion system, which are applied to the field of information security. The method comprises the following steps: extracting a target feature set; encrypting the target characteristic set by using a target private key to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; repeating the above process until a downstream three-time encryption set is obtained; sending the downstream three-time encryption set to an upstream data end, and receiving the upstream three-time encryption set sent by the downstream data end; merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transition tertiary encryption set, sending the target transition tertiary encryption set to a downstream data end, and receiving an upstream transition tertiary encryption set sent by an upstream data end; and fusing the upstream transition three-time encryption set and the upstream three-time encryption set to obtain a system fusion data set. The method ensures fairness in the data fusion process and effectively protects data privacy.

Description

Data fusion method, device, equipment and system

Technical Field

The embodiment of the specification relates to the technical field of information security, in particular to a data fusion method, device, equipment and system.

Background

Currently, data scale and capacity are one of the main competitive powers of commercial institutions, and each commercial institution has application requirements for expanding own data volume and improving data coverage and comprehensiveness. At present, a more effective way for expanding data volume is to share and merge data among multiple organizations, so as to improve the data reserve volume of the organizations under the condition of mutual benefits and reciprocity.

In the process of data fusion, the privacy and the interests of all parties need to be protected to the greatest extent, and the privacy of the users is not leaked. At present, in a scene of data fusion between two parties, data is encrypted, so that the two parties can not master any newly added original information and corresponding relation between the newly added information and a user while realizing the data fusion, and the privacy and data safety of the data are ensured.

However, when the data fusion process is applied to more than two data fusion scenes, multi-end data fusion is realized in a two-to-two data fusion mode, and such a fusion mode can cause that a mechanism performing data fusion in advance can grasp more data fusion information, thereby causing imbalance of information sharing in the data fusion process. Under the condition that the data volumes mastered by different mechanisms are different, the mechanism with the large data volume can easily push out the data of other mechanisms in the data fusion process, so that the fairness in the data fusion process and the privacy of each party of data are influenced. Therefore, a data fusion method capable of better protecting the privacy of each party data is needed.

Disclosure of Invention

An object of the embodiments of the present specification is to provide a data fusion method, apparatus, device, and system, so as to solve the problem of how to protect data privacy of each party in a data fusion process.

In order to solve the above technical problem, an embodiment of the present specification provides a data fusion method, which is applied to a target data end; the target data end and the corresponding upstream data end and downstream data end form a data fusion system; the method comprises the following steps: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set; sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key; encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set; sending the downstream three-time encryption set to an upstream data end, and receiving an upstream three-time encryption set sent by a downstream data end; merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transitional tertiary encryption set; sending the target transition three-time encryption set to a downstream data end, and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition three-time encryption set comprises a set obtained by combining a target three-time encryption set and a downstream three-time encryption set; and fusing the upstream transition three-time encryption set and the upstream transition three-time encryption set to obtain a system fusion data set.

The embodiment of the present specification further provides a data fusion device, which is arranged at a target data end; the target data end and the corresponding upstream data end and downstream data end form a data fusion system; the device comprises: the target feature set extraction module is used for extracting a target feature set; the target feature set comprises user features mastered by the target data terminal; the target characteristic set encryption module is used for encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; the target primary encryption set sending module is used for sending the target primary encryption set to a downstream data end and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; the upstream primary encryption set encryption module is used for encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set; the upstream secondary encryption set sending module is used for sending the upstream secondary encryption set to a downstream data end and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key; the downstream secondary encryption set encryption module is used for encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set; the downstream third-time encryption set sending module is used for sending the downstream third-time encryption set to an upstream data end and receiving the upstream third-time encryption set sent by the downstream data end; the merging module is used for merging the downstream three-time encryption set and the upstream three-time encryption set into a target transition three-time encryption set; the target transition three-time encryption set sending module is used for sending the target transition three-time encryption set to a downstream data end and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition three-time encryption set comprises a set obtained by combining a target three-time encryption set and a downstream three-time encryption set; and the fusion module is used for fusing the upstream transition three-time encryption set and the upstream three-time encryption set to obtain a system fusion data set.

The embodiment of the specification further provides a target data end which is arranged in the data fusion system; the data fusion system also comprises an upstream data end and a downstream data end which correspond to the target data end; the target data end comprises a memory and a processor; the memory to store computer program instructions; the processor to execute the computer program instructions to implement the steps of: extracting a target feature set; the target feature set comprises user features mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set; sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key; encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set; sending the downstream three-time encryption set to an upstream data end, and receiving an upstream three-time encryption set sent by a downstream data end; merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transitional tertiary encryption set; sending the target transition triple encryption set to a downstream data end, and receiving an upstream transition triple encryption set sent by an upstream data end; the upstream transition triple encryption set comprises a set obtained by combining a target triple encryption set and a downstream triple encryption set; and fusing the upstream transition three-time encryption set and the upstream three-time encryption set to obtain a system fusion data set.

The embodiment of the specification further provides a data fusion system, which comprises three data ends; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data end is used for executing the data fusion method.

In order to solve the above technical problem, an embodiment of the present specification further provides a data fusion method, which is applied to a target data end, where the target data end is disposed in a data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the method comprises the following steps: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set; repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system; sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end; repeatedly executing the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained; merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set; sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end; and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

The embodiment of the present specification further provides a data fusion device, which is arranged at a target data end, and the target data end is arranged in the data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the device comprises: the target feature set extraction module is used for extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; the target characteristic set encryption module is used for encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; the target primary encryption set sending module is used for sending the target primary encryption set to a downstream data end and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; the upstream primary encryption set encryption module is used for encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set; the integrated set encryption module is used for repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system; the comprehensive encryption set sending module is used for sending the set encrypted by all the data ends to an upstream data end and receiving the set encrypted by all the data ends and sent by a downstream data end; the comprehensive encryption set receiving module is used for repeatedly executing the steps of sending the comprehensive encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensive encrypted set sent by the downstream data end until all other comprehensive encrypted sets except the comprehensive encrypted set corresponding to the target feature set are obtained; the merging module is used for merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set; the transition comprehensive encryption set sending module is used for sending the target transition comprehensive encryption set to a downstream data end and receiving an upstream transition comprehensive encryption set sent by an upstream data end; and the fusion module is used for fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encryption set to obtain a system fusion data set.

The embodiment of the specification further provides a target data end which is arranged in the data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the target data end comprises a memory and a processor; the memory to store computer program instructions; the processor to execute the computer program instructions to implement the steps of: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set; repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system; sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end; repeatedly executing the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained; merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set; sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end; and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

The embodiment of the present specification further provides a data fusion system, which includes at least four data terminals; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data end is used for executing the data fusion method.

As can be seen from the technical solutions provided in the embodiments of the present specification, in the embodiment of the present specification, when data fusion is performed, after each data end encrypts its own data, the data is transmitted to the next data end to be encrypted again until all data ends encrypt each feature set. At this time, each party can return the comprehensively encrypted data sets in turn until each party can master the encrypted data sets of other parties except the own party. And after the encrypted data sets are merged, sending the merged encrypted data sets to the next data end, so that each data end can perform data fusion according to the merged data sets and the uncombined encrypted data sets mastered by the own side, and thus obtaining a system fusion data set corresponding to the data fusion system. By the method, fairness of data acquisition of each party in the data fusion process is guaranteed, the acquired data of other data ends are encrypted data, and the original data cannot be directly acquired, so that the safety of the data is guaranteed, and safe and effective multi-end data fusion is realized.

Drawings

In order to more clearly illustrate the embodiments of the present specification or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the specification, and other drawings can be obtained by those skilled in the art without creative efforts.

FIG. 1 is a block diagram of a data fusion system according to an embodiment of the present disclosure;

FIG. 2 is a flow chart of a data fusion method according to an embodiment of the present disclosure;

FIG. 3 is a flow chart of a data fusion method according to an embodiment of the present disclosure;

FIG. 4 is a block diagram of a data fusion apparatus according to an embodiment of the present disclosure;

FIG. 5 is a block diagram of a data fusion apparatus according to an embodiment of the present disclosure;

fig. 6 is a block diagram of a target data end according to an embodiment of the present disclosure.

Detailed Description

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only a part of the embodiments of the present disclosure, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present specification without making any creative effort shall fall within the protection scope of the present specification.

In order to better understand the inventive concept of the present application, a data fusion system in an embodiment of the present specification will be first described. As shown in FIG. 1, the data fusion system 100 includes a target data port 110, an upstream data port 120, and a downstream data port 130.

The target data end, the upstream data end and the downstream data end respectively have respective data sets. In the data fusion process, data of each party needs to be fused to obtain integral fusion data. The condition that the coincident data exists between different data ends also needs to be considered that the coincident data is not repeatedly recorded in the data fusion process.

The target data end can process the data, for example, the data can be encrypted by using a secret key, or the data can be calculated by using an elliptic curve function, so that the encryption effect on the data is realized, and the privacy and the safety of the data are ensured.

The upstream data end and the downstream data end are only names set for distinguishing from other data ends, and the target data end, the upstream data end and the downstream data end can be communicated with each other in practical application. The logic executed by the upstream data end and the downstream data end is the same as that of the target data end, that is, the upstream data end can also be used as the target data end, and then the target data end and the downstream data end are respectively the downstream data end and the upstream data end corresponding to the upstream data end.

It should be noted that, in the embodiment of the present specification, the three data ports are described as a target data port, an upstream data port, and a downstream data port, respectively, for convenience of description, steps executed by the respective data ports in the data fusion process are not substantially different, and each of the data ports may be used as the target data port to execute the following data fusion method, without being limited to the setting of names for the respective data ports in fig. 1.

Based on the data fusion system, a data fusion method in the embodiment of the present specification is introduced. The execution subject of the data fusion method is a target data end in the data fusion system, and the target data end comprises but is not limited to a server, an industrial personal computer, a PC and the like. As shown in fig. 2, the data fusion method may include the following specific implementation steps.

S210: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal.

The target feature set may be a set of feature data held by the target data terminal. The target feature set may include feature data grasped by the target data terminal. For example, the feature data may be user identity information, user equipment information, and the like held by the target data terminal. The characteristic data has certain privacy, so that the characteristic data cannot be directly leaked to other data ends in the data fusion process to ensure data security.

To illustrate by using a specific example, assuming that the feature data is the device identifier of the user, the device identifier sets of the target data end, the downstream data segment, and the upstream data end are a ═ respectively ₁ ,…,a _l }、B＝{b ₁ ,…,b _m And C ═ C ₁ ,…,c _n }。

The specific process of obtaining the target feature may be set based on the actual application situation, and is not described herein again.

In order to ensure effective proceeding of the subsequent process, each data terminal may determine its own private key first, so as to perform encryption or calculation by using its own private key in the subsequent step.

In some embodiments, each data terminal may determine an elliptic curve in advance through negotiation

And a random point generating function H _p (. cndot.) and determining an elliptic curve generator

Wherein the operation of the multiple points of the elliptic curve is expressed in the form of power operation. Then, each data terminal can generate its own private key

It may be a set containing more parameters, making it difficult for lawbreakers to deduce their respective private keys in an exhaustive manner. Wherein sk ₁ Is the private key of the target data end, sk ₂ Is the private key of the downstream data side, sk ₃ Is a private key of an upstream data end, and each party calculates own public key

And discloses.

Preferably, the private key of each data end can be only applied to the data fusion process, and when the next data fusion task is executed, a new private key can be generated, so as to further ensure the security of the data fusion process.

In some embodiments, in order to ensure that the data involved in the data fusion process is not leaked to other mechanisms except the data terminal, each data terminal may further process the grasped feature set to ensure the security of the original data.

Therefore, each data terminal can negotiate and construct a shared key in advance, after each data terminal obtains the shared key, a target feature set can be calculated based on the shared key to obtain a target privacy set, and calculation is performed based on the target privacy set in the subsequent process, so that even if lawless persons steal data in the transmission process, the original data cannot be directly obtained.

In some specific examples, the shared key may be derived based on key synthesis of the parties, e.g., may be computed

And takes K as the shared key. In practical application, the keys of the parties can be synthesized in other manners, and are not limited toThis example is not described in detail herein.

Thereafter, the parties may process the feature set based on the shared secret key and an elliptic curve computation function that is used to output random elliptic curve points.

In some embodiments, in order to further ensure the security of data, after each party obtains the privacy sets respectively, the privacy sets may be further subjected to disorder processing; the out-of-order processing is used for changing the arrangement order of the target features in the privacy set, so that the difficulty of cracking data is further increased.

In particular, the privacy set of the target data side computational party can be

Privacy collection of calculation local of downstream data terminal

Privacy collection of calculation local of upstream data terminal

Wherein

And

is the processing result after the disorder confusion is carried out on the basis of the original sets of the parties.

S220: and encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set.

The target data end can encrypt the target characteristic set by using a target private key of the target data end to obtain a target primary encryption set. Correspondingly, the upstream data end and the downstream data end can respectively encrypt respective feature sets by using respective private keys to obtain corresponding primary encryption sets.

Specifically, based on the example in step S210, the target data side may calculate for i ═ 1, …, l

Obtaining a privacy set A of a first round of a target data terminal ₁ ＝{a′ ₁ …, a' l }, and then set a privacy as ₁ Sending to a downstream data end; for j-1, …, m, downstream data-side calculation

Obtaining a privacy set B of a first round of a downstream data end ₁ ＝{b′ ₁ ,…,b′ _m Then assemble the privacy into a set B ₁ Sending to an upstream data end; for k-1, …, n, upstream data-side calculation

Obtaining a privacy set C of a first round of an upstream data end ₁ ＝{c′ ₁ ,…,c′ _n Will then set privacy as C ₁ And sending the data to a target data end.

For convenience of subsequent data positioning, after the target primary encrypted set is obtained, the data in the set is not subjected to disorder processing, and the arrangement order of the data in the set is maintained.

S230: sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; and the upstream primary encryption set is obtained by encrypting the upstream feature set by using an upstream private key through an upstream data end.

And then, the target data end can send the target primary encryption set to the downstream data end, correspondingly, the downstream data end can send the downstream primary encryption set to the upstream data end, and the upstream data end can send the upstream primary encryption set to the target data end, so that the first interaction process is realized in a circular sending mode.

S240: and encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set.

After the upstream primary encrypted set is received at the target data end, the upstream primary encrypted set can be encrypted by using the target private key to obtain an upstream secondary encrypted set. Correspondingly, the upstream data end and the downstream data end may also encrypt the primary encryption set received in step S230 by using their respective private keys to obtain corresponding secondary encryption sets.

Specifically, based on the example in step S220, the target data end receives the privacy set C for the previous round ₁ ＝{c′1,…,c′ _n Is calculated for all elements

Get the privacy set C ₂ ＝{c″ ₁ ,…,c″ _n Will then set privacy as C ₂ Sending the data to a downstream data end; privacy set A received by the downstream data end for the previous round ₁ ＝{a′ ₁ ,…,a′ _l Is calculated for all elements

Get privacy set A ₂ ＝{a″ ₁ ,…,a″ _l } then set privacy A ₂ Sending the data to an upstream data end; privacy set B received by upstream data end for previous round ₁ ＝{b′ ₁ ,…,b′ _m Is calculated for all elements

Get privacy set B ₂ ＝{b″ ₁ ,…,b″ _m Then assemble the privacy into a set B ₂ And sending the data to a target data end.

For convenience of positioning subsequent data, after the secondary encryption, the data in the set is not subjected to disorder processing, but the arrangement order of the data in the set is maintained.

S250: sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by using a downstream private key through the downstream data end to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by using an upstream private key through the upstream data end.

After each data end is encrypted for the second time, the encrypted set can be sent to the corresponding next data end. And the target data end sends the upstream secondary encryption set to the downstream data end, the downstream data end sends the target secondary encryption set to the upstream data end, and the upstream data end sends the downstream secondary encryption set to the target data end. The second round of interaction is achieved by the same cyclic sending sequence.

S260: and encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set.

After the target data end receives the downstream secondary encryption set, the downstream secondary encryption set can be encrypted by using the target private key to obtain a downstream tertiary encryption set. Correspondingly, the upstream data end and the downstream data end may also encrypt the secondary encryption set received in step S250 by using their respective private keys to obtain corresponding tertiary encryption sets.

Specifically, the target data end receives the privacy set B for the previous round ₂ ＝{b″ ₁ ,…,b″ _m Is calculated for all elements

Get privacy set B ₃ ＝{b″′ ₁ ,…,b″′ _m Then assemble the privacy into a set B ₃ Sending the data to an upstream data end; privacy set received by downstream data end for previous roundC ₂ ＝{c″ ₁ ,…,c″ _n Is calculated for all elements

Get the privacy set C ₃ ＝{c″′ ₁ ,…,c″′ _n } then set the privacy into a set C ₃ Sending the data to a target data end; the upstream data end receives the privacy set A for the previous round ₂ ＝{a″ ₁ ,…,a″ _l Is calculated for all elements

Get privacy set A ₃ ＝{a″′ ₁ ，…，a″′ _l Will then set privacy as ₃ And sending the data to a downstream data end.

In order to facilitate the positioning of subsequent data, after the data in the set is encrypted for three times, the data in the set is not subjected to disorder processing, and the arrangement order of the data in the set is maintained.

S270: and sending the downstream three-time encryption set to an upstream data end, and receiving the upstream three-time encryption set sent by the downstream data end.

After each data end realizes triple encryption aiming at the feature set, each data end can send a triple encryption set in a direction opposite to the previous interaction mode, specifically, a target data end can send a downstream triple encryption set to an upstream data end, the downstream data end can send the upstream triple encryption set to the target data end, and the upstream data end can send the target triple encryption set to the downstream data end.

S280: and merging the downstream cubic encryption set and the upstream cubic encryption set into a target transitional cubic encryption set.

For the target data end, after receiving the upstream triple encryption set, the upstream triple encryption set and the downstream triple encryption set are simultaneously grasped, and in this case, the downstream triple encryption set and the upstream triple encryption set may be merged into the target transitional triple encryption set.

Correspondingly, the downstream data end can merge the upstream triple encryption set and the target triple encryption set into a downstream transitional triple encryption set, and the upstream data end can merge the downstream triple encryption set and the target triple encryption set into an upstream transitional triple encryption set.

Preferably, after each data terminal acquires the respective transitional third-order encryption set, the transitional third-order encryption sets may be subjected to out-of-order processing to change the arrangement order among the features. And when the transitional triple encryption set is sent to other data terminals subsequently, the fact that the actual feature content in the fused set is deduced by the other data terminals based on the feature arrangement sequence in the original feature set can be avoided, so that the safety and the privacy of the data are ensured.

In some embodiments, while finding the union of the two sets, the intersection of the two grasped cubic encryption sets may also be found, and for the target data end, the overlapping portion between the downstream cubic encryption set and the upstream cubic encryption set may be determined as the target transition intersection set. Accordingly, the upstream data end and the downstream data end may also determine corresponding upstream transition intersection sets and downstream transition intersection sets.

Preferably, after each data terminal acquires the corresponding intersection transition set, the respective intersection transition set may be further subjected to disorder processing to change the arrangement order of the target features therein. Subsequently, when the intersecting transition set is connected to other data terminals, the actual feature content in the intersecting transition set can be prevented from being deduced by the other data terminals based on the feature arrangement sequence in the original feature set, so that the security and privacy of data are ensured.

In particular, based on the foregoing example, for the target data end, the privacy set C was received in the third round ₃ ＝{c″′ ₁ ,…,c″′ _n And privacy set B calculated by oneself ₃ ＝{b″′ ₁ ，…,b″′ _m Together, calculate the intersection B of the two ₃ ∩C ₃ And union set B ₃ ∪C ₃ Then B is ₃ ∩C ₃ To carry outRandomizing the disorder to obtain a set X _BC A 1 to B ₃ ∪C ₃ Randomizing the scrambling to obtain a set Y _BC (ii) a For the downstream data end, the privacy set A is received in the third round ₃ ＝{a″′ ₁ ,…,a″′ _l H, privacy set C calculated by itself ₃ ＝{c″′ ₁ ,…,c″′ _n Together, calculate the intersection A of the two ₃ ∩C ₃ And union A ₃ ∪C ₃ Then A is added ₃ ∩C ₃ Randomizing the order to obtain a set X _AC A is ₃ ∪C ₃ Randomizing the disorder to obtain a set Y _AC (ii) a For the upstream data side, the privacy set B was received in the third round ₃ ＝{b″′ ₁ ,…,b″′ _m H, and a privacy set A calculated by itself ₃ ＝{a″′ ₁ ,…,a″′ _l Together, calculate the intersection A of the two ₃ ∩B ₃ And union A ₃ ∪B ₃ Then A is added ₃ ∩B ₃ Randomizing the order to obtain a set X _AB A is prepared by ₃ ∪B ₃ Randomizing the scrambling to obtain a set Y _AB . In addition, each party can also record the size of each set, i.e. | X _BC |＝α _BC ,|X _AC |＝α _AC ,|X _AB |＝α _AB And | Y _BC |＝β _BC ,|Y _AC |＝β _AC ，|Y _AB |＝β _AB Representing the number of features in each set.

S290: sending the target transition three-time encryption set to a downstream data end, and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition cubic encryption set comprises a set obtained by combining a target cubic encryption set and a downstream cubic encryption set.

The target data end can send the target transition triple encryption set to the downstream data end, correspondingly, the downstream data end can send the downstream transition triple encryption set to the upstream data end, and the upstream data end can send the upstream transition triple encryption set to the target data end.

S2100: and fusing the upstream transition three-time encryption set and the upstream transition three-time encryption set to obtain a system fusion data set.

After the target data end receives the upstream transit triple encryption set, the upstream transit triple encryption set is a downstream triple encryption set and a target triple encryption set, and the target data end also grasps the upstream triple encryption set, so that the upstream transit triple encryption set and the upstream triple encryption set can be fused to obtain a system fusion data set. The system fusion data set is an encrypted data set obtained by fusing data held by three data ends.

Correspondingly, the upstream data end can fuse the downstream transition triple encryption set with the downstream triple encryption set to obtain a system fusion data set, and the downstream data end can fuse the target transition triple encryption set with the target triple encryption set to obtain a system fusion data set.

Specifically, based on the above example, the target data side will aggregate Y _BC Sending the privacy information to a downstream data end, wherein the downstream data end acquires a privacy set A according to the privacy set A ₃ ＝{a″′ ₁ ,…,a″′ _l }, calculating A ₃ ∪Y _BC ＝A ₃ ∪B ₃ ∪C ₃ (ii) a The downstream data end will set Y _AC Sending the information to an upstream data end, wherein the upstream data end acquires a privacy set B according to the privacy set B ₃ ＝{b″′ ₁ ,…,b″′ _m }, calculate B ₃ ∪Y _AC ＝A ₃ ∪B ₃ ∪C ₃ (ii) a The upstream data end will set Y _AB Sending the information to a target data end, wherein the target data end acquires a privacy set C according to the information ₃ ＝{c″′ ₁ ,…,c″′ _n }, calculating C ₃ ∪Y _AB ＝A ₃ ∪B ₃ ∪C ₃ (ii) a At this time, all parties can acquire privacy union Y _ABC ＝A ₃ ∪B ₃ ∪C ₃ 。

Optionally, based on the implementation in step S280, each party may also send the transition intersection set to a corresponding data end, for example, the target data end sends the target transition intersection set to the downstream data end, the upstream data end sends the upstream transition intersection set to the target data end, and the downstream data end sends the target transition intersection set to the upstream data end. And each data terminal acquires a system intersection set of the system according to the transition intersection set mastered by each party and the corresponding three-level encryption set.

Specifically, the target data end may also convert X _BC Sent to the downstream data end which can calculate A ₃ ∩X _BC ＝A ₃ ∩B ₃ ∩C ₃ The downstream data end can also convert X _AC Sent to the upstream data end, and the upstream data end can calculate B ₃ ∩X _AC ＝A ₃ ∩B ₃ ∩C ₃ The upstream data end can also convert X _AB Sending to the target data end, which can calculate C ₃ ∩X _AB ＝A ₃ ∩B ₃ ∩C ₃ 。

In the fusion process, each data end does not acquire original feature data of other data ends all the time, and cannot acquire an encryption feature set independently containing own features, so that data of other data ends cannot be directly acquired, and corresponding information cannot be obtained by conjecturing according to the acquired feature set.

In some embodiments, respective set sizes may also be calculated for the system fused data set and the system intersected set, e.g., Y _ABC |＝β _ABC ，|X _ABC |＝α _ABC To calculate the contribution of the data in the subsequent steps.

In some embodiments, after the system fused data set is determined, in order to determine the position of the data of each data terminal in the fused set, each data terminal may randomly generate a key to encrypt the three-time encryption set and the system fused set which are mastered by each data terminal, and then send the key to the corresponding data terminal, so that the data terminal can determine the position of the corresponding original feature in the system fused set based on the arrangement order of the elements in the three-time encryption set, thereby performing the subsequent steps by using the position.

The target data end is used as an execution main body to be specifically explained, aiming at the target data end, a target positioning key can be respectively utilized to encrypt a downstream three-time encryption set and a system fusion data set to obtain a target encryption downstream three-time encryption set and a target encryption system fusion data set, then the target encryption downstream three-time encryption set and the target encryption system fusion data set are sent to the downstream data end, and determining the distribution position of the characteristics in the upstream encryption target triple encryption set in the upstream encryption system fusion data set according to the received upstream encryption target triple encryption set and the upstream encryption system fusion data set sent by the upstream data terminal, and finally determining the distribution position of the target characteristics in the target characteristic set in the system fusion data set according to the corresponding relation between the upstream encryption target triple encryption set and the target characteristic set and combining the distribution positions.

For other data terminals, the data can be recurred to other data terminals based on the operation flow, so that the data positioning of the data terminal can be realized in a corresponding mode.

Based on the above example, the target data end generates randomly

For privacy set B ₃ All elements B in ₃ ＝{b″′ ₁ ,…,b″′ _m }, calculating

To obtain B ₄ ＝{b″′ ₁ ,…,b″′ _m }. then, the target data end pair Y _ABC All elements y in _i Calculating

Get a set

Then B is mixed ₄ And Y ₁ Sending to downstream data end based on random confusion

To B ₄ Identifying elements, namely judging that the original set B is { B ═ B ₁ ,…,b _m } and B ₄ ＝{b″′ ₁ ,…,b″′ _m The element correspondence between them, then locate its own set of elements B ₄ ＝{b″′ ₁ ，…,b″′ _m In the set Y ₁ The position of (1); downstream data side random generation

For privacy set C ₃ All elements C in ₃ ＝{c″′ ₁ ,…,c″′ _n }, calculating

To obtain C ₄ ＝{c″″ ₁ ,…,c″″ _n }. then, the downstream data pair Y _ABC All elements y in _i Calculating

Get a set

Then C is mixed ₄ And Y ₂ Sending to the upstream data end, the upstream data end confuses according to random

To C ₄ Identifying elements, namely judging that the original set C is { C ═ C ₁ ,…,c _n And C ₄ ＝{c″″ ₁ ,…,c″″ _n The element correspondence between them, then locate its own set of elements C ₄ ＝{c″″ ₁ ,…,c″″ _n In the set Y ₂ The position in (1); upstream data side random generation

For privacy set A ₃ All elements A in (1) ₃ ＝{a″′ ₁ ,…,a″′ _l }, calculating

To obtain A ₄ ＝{a″″ ₁ ,…,a″″ _n }. then, the upstream pair of data ends Y _ABC All elements y in _i Calculating

Get a set

Then A is mixed ₄ And Y ₃ Sending to the target data end, and the target data end confuses according to the random

To A ₄ Identifying elements, namely judging that the original set A is { a ═ a ₁ ,…,a _l } and A ₄ ＝{a″″ ₁ ，…,a″″ _n The element correspondence between them, then locate its own set element A ₄ ＝{a″″ ₁ ,…,a″″ _n In the set Y ₃ And (5) completing the privacy set fusion of three parties by each party.

In the above example, Y is ₁ ，Y ₂ ，Y ₃ Is only used for parties to locate the position (Y) of their own elements in the privacy fusion and set ₁ ，Y ₂ ，Y ₃ And Y _ABC Same order of corresponding elements) the final fused set is still Y _ABC 。

By the method, each data end can position the position of the data in the set, and when the data in the system fusion data set is used in the subsequent data utilization process, whether own data is called can be judged according to the position of the used data in the system fusion data set, so that the steps of data charging and data expansion are carried out, and then the operation steps such as benefit distribution and the like can be carried out according to the contribution degrees of different data ends.

In practical application, a situation that data fusion is performed by more than three parties can also occur, namely, the data fusion system comprises at least four data terminals. In this case, when data fusion is performed, the specific steps performed may be different from the data fusion method corresponding to fig. 2.

Aiming at the scene, a data fusion method is introduced, wherein an execution main body of the method is a target data end, and the target data end is arranged in a data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system. For example, assuming that A, B, C, D, E are included in the data fusion system, a ring transmission sequence of a-B-C-D-E-a may be set, and each data end takes two data ends with which data transmission is performed as an upstream data end and a downstream data end. For the structural schematic diagram of the data fusion system, adjustment and expansion may be performed with reference to the structural diagram in fig. 1, which is not described herein again.

As shown in fig. 3, the data fusion method may include the following implementation steps.

S310: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal.

For the introduction of this step, reference may be made to the description in step S210, and details are not repeated here.

S320: and encrypting the target characteristic set by using a target private key of the target data end to obtain a target primary encryption set.

For the introduction of this step, reference may be made to the description in step S220, and details are not repeated here.

S330: sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; and the upstream primary encryption set is obtained by encrypting the upstream feature set by using an upstream private key through an upstream data end.

For the introduction of this step, reference may be made to the description in step S230, which is not described herein again.

S340: and encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set.

For the introduction of this step, reference may be made to the description in step S240, which is not described herein again.

S350: and repeating the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system.

In this embodiment, the system includes more than three data terminals, and in order to ensure that the data obtained at each terminal is encrypted by the private key of each terminal, thereby implementing subsequent data fusion, the steps of sending the encrypted set to the downstream data terminal, receiving the encrypted set sent by the upstream data terminal, and sending the encrypted set to the upstream data terminal need to be repeatedly performed, so that each data terminal encrypts each feature set, and further, the subsequent steps can be performed.

For example, if there are n data terminals in the system, the above steps need to be repeatedly executed n-2 times, so that each feature set is encrypted n-2 times, so as to ensure the data uniformity in the subsequent union set calculation.

S360: and sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end.

For the convenience of the subsequent description, a set encrypted via each data terminal is referred to as a comprehensive encryption set. Each data terminal may pass the respective integrated encryption set to the respective upstream data terminal in reverse order to the previous transmission set.

Assuming that there are A, B, C, D, E five data terminals in the system, data transmission is performed in the order of a to B, B to C, C to D, D to E, E to a in steps S330, S340, S350, and data transmission is performed in the order of a to E, E to D, D to C, C to B, B to a in this step and in step S370 described below.

S370: and repeating the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all the comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained.

And repeating the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving the new comprehensively encrypted set sent by the downstream data end until all the other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained, and then all the data ends grasp all the comprehensively encrypted sets except the comprehensively encrypted set corresponding to the feature set of each data end.

Specifically, assuming that there are n data terminals in the system, each data terminal repeatedly executes the step in S370 n-2 times, and each data terminal can grasp n-1 comprehensive encryption sets to execute the subsequent steps.

S380: and merging all the acquired comprehensively encrypted sets into a target transitional comprehensive encryption set.

At this time, each data terminal may obtain a union set of all the comprehensive encryption sets obtained by itself, so as to obtain a target transitional comprehensive encryption set. For example, if there are A, B, C, D, E data ends in the system, the data end a can grasp four comprehensive encryption sets, B ', C', D ', E', where B ', C', D ', E' respectively represent the comprehensive encryption set corresponding to the data end B, C, D, E.

In some embodiments, each data end may also find the corresponding intersection according to the obtained comprehensive encryption set. Specifically, the target data end is used as an execution main body, the overlapped parts among all the obtained comprehensively encrypted sets can be determined to be used as a target transition intersection set, the target transition intersection set is sent to the downstream data end, and an upstream transition intersection set sent by the upstream data end is received; and then determining a superposed part between the upstream transition intersection set and a comprehensive encrypted set corresponding to the feature set of the upstream data end as a system intersection set.

For a specific process of obtaining the system intersection set, reference may be made to descriptions in steps S280, S290, and S2100, which are not described herein again.

S390: and sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end.

After the corresponding transition comprehensive encryption sets are obtained by the data terminals, the respective transition comprehensive encryption sets can be transmitted based on the original data transmission sequence. Specifically, the target data end is used as an execution subject, and the target transition comprehensive encryption set may be sent to a downstream data end. Other data terminals may perform corresponding data transmission processes according to the sequence, which is not described herein again.

S3100: and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

After receiving the corresponding transition comprehensive encryption set, each data terminal can fuse the two sets based on the comprehensive encryption set corresponding to the transition comprehensive encryption set grasped by the data terminal, so as to obtain a final system fusion data set.

Specifically, the target data end is used as an execution subject, and a system fusion data set is obtained by fusing a comprehensive encrypted set corresponding to a feature set of an upstream data end with the upstream transition comprehensive encrypted set. Other data terminals may also implement data fusion in a corresponding manner, which is not described herein again.

Accordingly, each data segment can also determine the position of its own feature in the system fused data set at this time. Specifically, the target data end is used as an execution subject, and the implemented steps may be encrypting the comprehensively encrypted set and the system fusion data set corresponding to the feature set of the downstream data end by using the target positioning key, respectively, to obtain a target encrypted downstream comprehensive encrypted set and a target encrypted system fusion data set; then the target encryption downstream comprehensive encryption set and the target encryption system fusion data set are sent to a downstream data end, and an upstream encryption target comprehensive encryption set and an upstream encryption system fusion data set sent by an upstream data end are received; then determining the distribution positions of the features in the upstream encryption target comprehensive encryption set in the upstream encryption system fusion data set; and finally, determining the distribution position of the target feature in the target feature set in the system fusion data set by combining the distribution position according to the corresponding relation between the upstream encrypted target comprehensive encryption set and the target feature set.

For a specific implementation process, reference may be made to the description in step S2100, which is not described herein again.

Based on the above description of the embodiment and the scenario example, it can be seen that, in the data fusion, after each data end encrypts its own data, it is transmitted to the next data end to encrypt again until all data ends encrypt each feature set. At this time, each party can return the comprehensively encrypted data sets in turn until each party can master the encrypted data sets of other parties except the own party. After being merged, the encrypted data sets are sent to the next data end, so that each data end can perform data fusion according to the merged data set and the uncombined encrypted data set mastered by the own side, and a system fusion data set corresponding to the data fusion system is obtained. By the method, fairness of data acquisition of each party in the data fusion process is guaranteed, the acquired data of other data ends are encrypted data, and the original data cannot be directly acquired, so that the safety of the data is guaranteed, and safe and effective multi-end data fusion is realized.

A data fusion apparatus according to an embodiment of the present description is introduced based on the data fusion method corresponding to fig. 2. The data fusion device is arranged at the target data end. As shown in fig. 4, the task processing device includes the following modules.

A target feature set extraction module 410, configured to extract a target feature set; the target feature set comprises user features mastered by the target data terminal.

And the target feature set encryption module 420 is configured to encrypt the target feature set by using a target private key of a target data end to obtain a target primary encryption set.

A target primary encryption set sending module 430, configured to send the target primary encryption set to a downstream data end, and receive an upstream primary encryption set sent by an upstream data end; and the upstream primary encryption set is obtained by encrypting the upstream feature set through an upstream data end by using an upstream private key.

An upstream primary encryption set encryption module 440, configured to encrypt the upstream primary encryption set with the target private key to obtain an upstream secondary encryption set.

An upstream secondary encryption set sending module 450, configured to send the upstream secondary encryption set to a downstream data end, and receive a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by using a downstream private key through the downstream data end to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by using an upstream private key through the upstream data end.

And a downstream secondary encryption set encryption module 460, configured to encrypt the downstream secondary encryption set with the target private key to obtain a downstream tertiary encryption set.

The downstream triple encryption set sending module 470 is configured to send the downstream triple encryption set to the upstream data end, and receive the upstream triple encryption set sent by the downstream data end.

And a merging module 480, configured to merge the downstream triple encryption set and the upstream triple encryption set into a target transitional triple encryption set.

A target transition third-order encryption set sending module 490, configured to send the target transition third-order encryption set to a downstream data end, and receive an upstream transition third-order encryption set sent by an upstream data end; the upstream transit cubic encryption set comprises a set obtained by combining a target cubic encryption set and a downstream cubic encryption set.

A fusing module 4100, configured to fuse the upstream transition three-time encryption set and the upstream three-time encryption set to obtain a system fusion data set.

A data fusion apparatus according to an embodiment of the present description is introduced based on the data fusion method corresponding to fig. 3. The data fusion device is arranged at the target data end. As shown in fig. 5, the task processing device includes the following modules.

A target feature set extraction module 510, configured to extract a target feature set; the target feature set comprises feature data mastered by the target data terminal.

And a target feature set encryption module 520, configured to encrypt the target feature set with a target private key of the target data end to obtain a target primary encryption set.

A target primary encryption set sending module 530, configured to send the target primary encryption set to a downstream data end, and accept an upstream primary encryption set sent by an upstream data end; and the upstream primary encryption set is obtained by encrypting the upstream feature set by using an upstream private key through an upstream data end.

And an upstream primary encryption set encryption module 540, configured to encrypt the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set.

And the set comprehensive encryption module 550 is configured to repeatedly perform the steps of sending the encrypted set to the downstream data end, receiving the encrypted set sent by the upstream data end, and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system.

And a comprehensive encryption set sending module 560, configured to send the set encrypted by all the data ends to an upstream data end, and receive the set encrypted by all the data ends sent by a downstream data end.

The comprehensive encryption set receiving module 570 is configured to repeatedly perform the steps of sending the comprehensive encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensive encrypted set sent by the downstream data end until all other comprehensive encrypted sets except the comprehensive encrypted set corresponding to the target feature set are obtained.

A merging module 580, configured to merge all the obtained sets after comprehensive encryption into a target transitional comprehensive encryption set.

The transition comprehensive encryption set sending module 590 is configured to send the target transition comprehensive encryption set to a downstream data end, and receive an upstream transition comprehensive encryption set sent by an upstream data end.

The fusion module 5100 is configured to fuse the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fusion data set.

Based on the data fusion method corresponding to fig. 2, an embodiment of the present specification provides a target data end. The target data end is arranged in the data fusion system corresponding to fig. 1. As shown in fig. 6, the target data terminal may include a memory and a processor.

In this embodiment, the memory may be implemented in any suitable manner. For example, the memory may be a read-only memory, a mechanical hard disk, a solid state disk, a U disk, or the like. The memory may be used to store computer program instructions.

In this embodiment, the processor may be implemented in any suitable manner. For example, the processor may take the form of, for example, a microprocessor or processor and a computer-readable medium that stores computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller, an embedded microcontroller, and so forth. The processor may execute the computer program instructions to perform the steps of: extracting a target feature set; the target feature set comprises user features mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set; sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key; encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set; sending the downstream three-time encryption set to an upstream data end, and receiving an upstream three-time encryption set sent by a downstream data end; merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transitional tertiary encryption set; sending the target transition three-time encryption set to a downstream data end, and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition triple encryption set comprises a set obtained by combining a target triple encryption set and a downstream triple encryption set; and fusing the upstream transition three-time encryption set and the upstream transition three-time encryption set to obtain a system fusion data set.

Based on the data fusion method corresponding to fig. 3, an embodiment of the present specification provides a target data end. The target data end is arranged in the data fusion system in the embodiment corresponding to fig. 3. As shown in fig. 6, the target data terminal may include a memory and a processor.

In this embodiment, the processor may be implemented in any suitable manner. For example, the processor may take the form of, for example, a microprocessor or processor and a computer-readable medium that stores computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller and embedded microcontroller, and so forth. The processor may execute the computer program instructions to perform the steps of: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set; repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system; sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end; repeatedly executing the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained; merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set; sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end; and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

The embodiment of the specification further provides a data fusion system, which comprises three data ends; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data terminal is used for executing the data fusion method corresponding to fig. 2.

The embodiment of the present specification further provides a data fusion system, which includes at least four data terminals; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data end is used for executing the data fusion method corresponding to fig. 3.

It should be noted that the data fusion method, apparatus, device, and system in the embodiments of the present description may be applied to the technical field of information security, and may also be applied to other technical fields except the technical field of information security, which is not limited to this.

In the 90 s of the 20 th century, improvements in a technology could clearly distinguish between improvements in hardware (e.g., improvements in circuit structures such as diodes, transistors, switches, etc.) and improvements in software (improvements in process flow). However, as technology advances, many of today's process flow improvements have been seen as direct improvements in hardware circuit architecture. Designers almost always obtain the corresponding hardware circuit structure by programming an improved method flow into the hardware circuit. Thus, it cannot be said that an improvement in the process flow cannot be realized by hardware physical modules. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is an integrated circuit whose Logic functions are determined by a user programming the Device. A digital system is "integrated" on a PLD by the designer's own programming without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Furthermore, nowadays, instead of manually making an Integrated Circuit chip, such Programming is often implemented by "logic compiler" software, which is similar to a software compiler used in program development and writing, but the original code before compiling is also written by a specific Programming Language, which is called Hardware Description Language (HDL), and HDL is not only one but many, such as abel (advanced Boolean Expression Language), ahdl (alternate Hardware Description Language), traffic, pl (core universal Programming Language), HDCal (jhdware Description Language), lang, Lola, HDL, laspam, hardward Description Language (vhr Description Language), vhal (Hardware Description Language), and vhigh-Language, which are currently used in most common. It will also be apparent to those skilled in the art that hardware circuitry that implements the logical method flows can be readily obtained by merely slightly programming the method flows into an integrated circuit using the hardware description languages described above.

The systems, devices, modules or units illustrated in the above embodiments may be implemented by a computer chip or an entity, or by a product with certain functions. One typical implementation device is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

From the above description of the embodiments, it is clear to those skilled in the art that the present specification can be implemented by software plus the necessary first hardware platform. Based on such understanding, the technical solutions of the present specification may be essentially or partly implemented in the form of software products, which may be stored in a storage medium, such as ROM/RAM, magnetic disk, optical disk, etc., and include several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in the embodiments or some parts of the embodiments of the present specification.

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

The description is operational with numerous first or special purpose computing system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

This description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

While the specification has been described with examples, those skilled in the art will appreciate that there are numerous variations and permutations of the specification that do not depart from the spirit of the specification, and it is intended that the appended claims include such variations and modifications that do not depart from the spirit of the specification.

Claims

1. A data fusion method is characterized in that the method is applied to a target data end; the target data end and the corresponding upstream data end and downstream data end form a data fusion system; the method comprises the following steps:

extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal;

encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set;

sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key;

encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set;

sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key;

encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set;

sending the downstream three-time encryption set to an upstream data end, and receiving an upstream three-time encryption set sent by a downstream data end;

merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transitional tertiary encryption set;

sending the target transition three-time encryption set to a downstream data end, and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition triple encryption set comprises a set obtained by combining a target triple encryption set and a downstream triple encryption set;

and fusing the upstream transition three-time encryption set and the upstream transition three-time encryption set to obtain a system fusion data set.

2. The method of claim 1, wherein before encrypting the target feature set with a target private key of a target data end to obtain a target primary encrypted set, the method further comprises:

combining the upstream data end and the downstream data end to construct a shared key;

calculating a target feature set based on the shared secret key to obtain a target privacy set;

correspondingly, the encrypting the target feature set by using the target private key of the target data end to obtain a target primary encryption set includes:

and encrypting the target privacy set by using a target private key of a target data end to obtain a target primary encryption set.

3. The method of claim 2, wherein encrypting a target feature set based on the shared key pair results in a target privacy set, comprising:

determining an elliptic curve calculation function by combining the upstream data end and the downstream data end; the elliptic curve calculation function is used for outputting random elliptic curve points;

and calculating the target feature set by using an elliptic curve calculation function based on the shared secret key to obtain a target privacy set.

4. The method of claim 2, wherein prior to computing the target feature set based on the shared key to obtain the target privacy set, further comprising:

carrying out disorder processing on the target privacy set; the out-of-order processing is used for changing the arrangement order of target features in the target privacy set.

5. The method of claim 1, wherein prior to sending the target transcryption cubic encryption set to a downstream data end, further comprising:

carrying out disorder processing on the target transition triple encryption set; the out-of-order processing is used for changing the arrangement order of target features in the target transition cubic encryption set.

6. The method according to claim 1, wherein after sending the downstream triple encryption set to an upstream data end and receiving the upstream triple encryption set sent by the downstream data end, the method further comprises:

determining a superposed part between the downstream cubic encryption set and the upstream cubic encryption set as a target transition intersection set;

sending the target transition intersection set to a downstream data end, and receiving an upstream transition intersection set sent by an upstream data end;

and determining a coincident part between the upstream transition intersection set and the upstream cubic encryption set as a system intersection set.

7. The method of claim 6, wherein before sending the target transition intersection set to a downstream data side and receiving an upstream transition intersection set sent by an upstream data side, further comprising:

carrying out disorder processing on the target transition intersection set; the out-of-order processing is used for changing the arrangement order of the target features in the target transition intersection set.

8. The method of claim 1, wherein after fusing the upstream transitional triple encryption set with the upstream triple encryption set to obtain a system fused data set, further comprising:

encrypting the downstream three-time encryption set and the system fusion data set by using the target positioning key respectively to obtain a target encryption downstream three-time encryption set and a target encryption system fusion data set;

sending the target encryption downstream third-time encryption set and the target encryption system fusion data set to a downstream data end, and receiving an upstream encryption target third-time encryption set and an upstream encryption system fusion data set sent by an upstream data end;

determining the distribution positions of the features in the upstream encryption target cubic encryption set in the upstream encryption system fusion data set;

and determining the distribution position of the target feature in the target feature set in the system fusion data set by combining the distribution position according to the corresponding relation between the upstream encrypted target cubic encryption set and the target feature set.

9. A data fusion device is characterized by being arranged at a target data end; the target data end and the corresponding upstream data end and downstream data end form a data fusion system; the device comprises:

the target feature set extraction module is used for extracting a target feature set; the target feature set comprises user features mastered by the target data terminal;

the target characteristic set encryption module is used for encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set;

the target primary encryption set sending module is used for sending the target primary encryption set to a downstream data end and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key;

the upstream primary encryption set encryption module is used for encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set;

the upstream secondary encryption set sending module is used for sending the upstream secondary encryption set to a downstream data end and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key;

the downstream secondary encryption set encryption module is used for encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set;

the downstream third-time encryption set sending module is used for sending the downstream third-time encryption set to an upstream data end and receiving an upstream third-time encryption set sent by a downstream data end;

the merging module is used for merging the downstream three-time encryption set and the upstream three-time encryption set into a target transition three-time encryption set;

the target transition three-time encryption set sending module is used for sending the target transition three-time encryption set to a downstream data end and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition triple encryption set comprises a set obtained by combining a target triple encryption set and a downstream triple encryption set;

and the fusion module is used for fusing the upstream transition three-time encryption set and the upstream three-time encryption set to obtain a system fusion data set.

10. A target data end, which is arranged in a data fusion system; the data fusion system also comprises an upstream data end and a downstream data end which correspond to the target data end; the target data end comprises a memory and a processor;

the memory to store computer program instructions;

the processor to execute the computer program instructions to implement the steps of: extracting a target feature set; the target feature set comprises user features mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using the target private key to obtain an upstream secondary encryption set; sending the upstream secondary encryption set to a downstream data end, and receiving a downstream secondary encryption set sent by the upstream data end; the downstream secondary encryption set is obtained by encrypting the downstream feature set by a downstream data end by using a downstream private key to obtain a downstream primary encryption set, and then encrypting the downstream primary encryption set by an upstream data end by using an upstream private key; encrypting the downstream secondary encryption set by using the target private key to obtain a downstream tertiary encryption set; sending the downstream three-time encryption set to an upstream data end, and receiving an upstream three-time encryption set sent by a downstream data end; merging the downstream tertiary encryption set and the upstream tertiary encryption set into a target transitional tertiary encryption set; sending the target transition three-time encryption set to a downstream data end, and receiving an upstream transition three-time encryption set sent by an upstream data end; the upstream transition triple encryption set comprises a set obtained by combining a target triple encryption set and a downstream triple encryption set; and fusing the upstream transition three-time encryption set and the upstream transition three-time encryption set to obtain a system fusion data set.

11. A data fusion system comprises three data terminals; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data terminal is used for executing the method of any one of claims 1-8.

12. A data fusion method is characterized by being applied to a target data end, wherein the target data end is arranged in a data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the method comprises the following steps:

encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set;

repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system;

sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end;

repeatedly executing the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained;

merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set;

sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end;

and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

13. The method as claimed in claim 12, wherein before encrypting the target feature set with the target private key of the target data end to obtain the target primary encrypted set, the method further comprises:

establishing a shared key by combining other data ends;

calculating a target feature set based on the shared key to obtain a target privacy set;

14. The method of claim 13, wherein encrypting a target feature set based on the shared key pair results in a target privacy set, comprising:

determining an elliptic curve calculation function by combining the data ends; the elliptic curve calculation function is used for outputting random elliptic curve points;

15. The method of claim 13, wherein prior to computing the target feature set based on the shared key to obtain the target privacy set, further comprising:

carrying out disorder processing on the target feature set; the out-of-order processing is used for changing the arrangement order of the target features in the target feature set.

16. The method of claim 12, wherein prior to sending the target transitional comprehensive encryption set to a downstream data end, further comprising:

17. The method according to claim 12, wherein the repeatedly performing the steps of sending the synthetically encrypted set sent by the downstream data end to the upstream data end and receiving a new synthetically encrypted set sent by the downstream data end until all other synthetically encrypted sets except the synthetically encrypted set corresponding to the target feature set are obtained further comprises:

determining the overlapped parts among all the acquired comprehensively encrypted sets as target transition intersection sets;

and determining a superposed part between the upstream transition intersection set and the comprehensively encrypted set corresponding to the feature set of the upstream data end as a system intersection set.

18. The method of claim 17, wherein before sending the target transition intersection set to a downstream data side and receiving an upstream transition intersection set sent by an upstream data side, further comprising:

19. The method according to claim 12, wherein after fusing the integrated encrypted set corresponding to the feature set of the upstream data end with the upstream transitional integrated encrypted set to obtain the system fused data set, further comprising:

respectively encrypting the comprehensively encrypted set and the system fusion data set corresponding to the feature set of the downstream data end by using the target positioning key to obtain a target encrypted downstream comprehensive encrypted set and a target encrypted system fusion data set;

sending the target encryption downstream comprehensive encryption set and the target encryption system fusion data set to a downstream data end, and receiving an upstream encryption target comprehensive encryption set and an upstream encryption system fusion data set sent by an upstream data end;

determining the distribution positions of the features in the upstream encryption target comprehensive encryption set in the upstream encryption system fusion data set;

and determining the distribution position of the target feature in the target feature set in the system fusion data set by combining the distribution position according to the corresponding relation between the upstream encryption target comprehensive encryption set and the target feature set.

20. A data fusion device is characterized by being arranged at a target data end, wherein the target data end is arranged in a data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the device comprises:

the target feature set extraction module is used for extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal;

the upstream primary encryption set encryption module is used for encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set;

the integrated set encryption module is used for repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system;

the comprehensive encryption set sending module is used for sending the set encrypted by all the data ends to an upstream data end and receiving the set encrypted by all the data ends and sent by a downstream data end;

the comprehensive encryption set receiving module is used for repeatedly executing the steps of sending the comprehensive encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensive encrypted set sent by the downstream data end until all other comprehensive encrypted sets except the comprehensive encrypted set corresponding to the target feature set are obtained;

the merging module is used for merging all the acquired comprehensively encrypted sets into a target transition comprehensive encryption set;

the transition comprehensive encryption set sending module is used for sending the target transition comprehensive encryption set to a downstream data end and receiving an upstream transition comprehensive encryption set sent by an upstream data end;

and the fusion module is used for fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encryption set to obtain a system fusion data set.

21. A target data end arranged in a data fusion system; the data fusion system comprises at least four data terminals; each data end is respectively corresponding to an upstream data end and a downstream data end based on the data transmission sequence in the data fusion system; the target data end comprises a memory and a processor;

the memory to store computer program instructions;

the processor to execute the computer program instructions to implement the steps of: extracting a target feature set; the target feature set comprises feature data mastered by the target data terminal; encrypting the target characteristic set by using a target private key of a target data end to obtain a target primary encryption set; sending the target primary encryption set to a downstream data end, and receiving an upstream primary encryption set sent by an upstream data end; the upstream primary encryption set is obtained by encrypting an upstream feature set through an upstream data end by using an upstream private key; encrypting the upstream primary encryption set by using a target private key to obtain an upstream secondary encryption set; repeatedly executing the steps of sending the encrypted set to a downstream data end, receiving the encrypted set sent by the upstream data end and sending the encrypted set to the upstream data end until the encrypted set is encrypted by all data ends in the data fusion system; sending the set encrypted by all the data ends to an upstream data end, and receiving the set encrypted by all the data ends sent by a downstream data end; repeatedly executing the steps of sending the comprehensively encrypted set sent by the downstream data end to the upstream data end and receiving a new comprehensively encrypted set sent by the downstream data end until all other comprehensively encrypted sets except the comprehensively encrypted set corresponding to the target feature set are obtained; merging all the obtained comprehensively encrypted sets into a target transition comprehensive encryption set; sending the target transition comprehensive encryption set to a downstream data end, and receiving an upstream transition comprehensive encryption set sent by an upstream data end; and fusing the comprehensively encrypted set corresponding to the feature set of the upstream data end with the upstream transition comprehensive encrypted set to obtain a system fused data set.

22. A data fusion system comprises at least four data terminals; the data ends form an upstream data end and a downstream data end corresponding to each data end based on a data transmission relation; the data terminal is used for executing the method according to any one of claims 12-19.