CN115062299B - Security detection method and device for data leakage and electronic equipment - Google Patents
Security detection method and device for data leakage and electronic equipment Download PDFInfo
- Publication number
- CN115062299B CN115062299B CN202210881723.1A CN202210881723A CN115062299B CN 115062299 B CN115062299 B CN 115062299B CN 202210881723 A CN202210881723 A CN 202210881723A CN 115062299 B CN115062299 B CN 115062299B
- Authority
- CN
- China
- Prior art keywords
- input
- data set
- input data
- output
- information entropy
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Medical Informatics (AREA)
- Databases & Information Systems (AREA)
- Complex Calculations (AREA)
Abstract
The application discloses a security detection method, a device and electronic equipment for data leakage, which relate to the technical field of multiparty security computation and the technical field of privacy computation and comprise the following steps: the method comprises the steps of acquiring a plurality of input data sets aiming at a ciphertext computing task, computing an input information entropy aiming at each input data set, taking the plurality of input data sets as the input of a plaintext computing program of the ciphertext computing task to obtain an output data set, computing an output information entropy of the output data set, and computing the percentage of the output information entropy in the sum of the plurality of input information entropies to be used as the information transmission rate of the output data set. By adopting the scheme, safety detection is realized for data leakage of the ciphertext calculation task.
Description
Technical Field
The present application relates to the field of multi-party secure computing technologies and private computing technologies, and in particular, to a method and an apparatus for security detection for data leakage, and an electronic device.
Background
The multi-party security computing (MPC) is to solve the problem of cooperative computing between mutually untrusted parties on the premise of ensuring data security. Specifically, assuming that a plurality of participating entities respectively hold private data, each participating party wants to use the data as input to jointly complete the calculation of a certain function, and each participating party is required to not obtain any private information of other participating parties except the calculation result.
In the development and application promotion of private computing technologies such as MPC, attention needs to be paid to the security of computing protocols and the security of computing tasks input into a computing network. The reason is that even if proper security design is performed in the calculation process (such as masking or encrypting the original data by using a random number), so that each participant participating in the calculation cannot obtain the data, if the calculation task itself does not meet certain security requirements, the data leakage is also caused.
Disclosure of Invention
The embodiment of the application provides a security detection method and device for data leakage and electronic equipment, and aims to solve the problem of how to perform security detection on data leakage of a ciphertext computing task in the prior art.
The embodiment of the application provides a security detection method for data leakage, which comprises the following steps:
respectively aiming at each input variable in a plurality of input variables of the ciphertext computing task, acquiring an input data set which accords with the input data specification of the input variable, and obtaining a plurality of input data sets;
for each input data set, calculating information entropy of the input data set based on input data contained in the input data set as input information entropy of the input data set;
converting the ciphertext calculation program for executing the ciphertext calculation task into a plaintext calculation program;
taking the plurality of input data sets as the input of the plaintext calculation program, and operating the plaintext calculation program to obtain an output data set containing output data;
calculating information entropy of the output data set based on output data contained in the output data set as output information entropy;
and calculating the percentage of the output information entropy to the sum of the plurality of input information entropies as the information transmission rate of the output data set.
Further, the obtaining an input data set that meets the input data specification of the input variable includes:
acquiring an input data set which is input and accords with the input data specification of the input variable; or
And acquiring the input data generation rule of the input variable, and generating an input data set conforming to the input data specification of the input variable according to the data generation rule.
Further, before obtaining, for each of the plurality of input variables of the ciphertext computation task, an input data set that conforms to the input data specification of the input variable, the method further includes:
analyzing a plurality of input variables of the ciphertext computing task;
a data specification for each input variable is obtained.
Further, the calculating the information entropy of the input data set based on the input data included in the input data set as the input information entropy of the input data set includes:
when each piece of input data in the input data set is data in an array form, for each position of the array, calculating the information entropy of the element of the position based on the elements of the position of all the input data of the input data set, and obtaining the information entropy for each position as a plurality of input information entropies of the input data set.
Further, the calculating the information entropy of the input data set based on the input data included in the input data set as the input information entropy of the input data set includes:
and when the participant providing the input data set in the ciphertext computing task is the result receiver of the ciphertext computing task, determining that the information entropy of the input data set is 0.
Further, when a plurality of output data sets are obtained, the method further comprises:
calculating joint information entropies of the plurality of output data sets as output joint information entropies based on output data included in the plurality of output data sets;
and calculating the percentage of the output joint information entropy to the sum of the plurality of input information entropies as the joint information transmittance of the plurality of output data sets.
The embodiment of the present application further provides a security detection device for data leakage, including:
the data acquisition module is used for respectively acquiring an input data set which accords with the input data specification of the input variable aiming at each input variable in a plurality of input variables of the ciphertext calculation task to obtain a plurality of input data sets;
the information entropy calculation module is used for calculating the information entropy of each input data set based on the input data contained in the input data set as the input information entropy of the input data set;
the task conversion module is used for converting a ciphertext calculation program for executing the ciphertext calculation task into a plaintext calculation program;
the task operation module is used for taking the plurality of input data sets as the input of the plaintext calculation program, operating the plaintext calculation program and obtaining an output data set containing output data;
the information entropy calculation module is further configured to calculate an information entropy of the output data set based on output data included in the output data set, and the information entropy is used as an output information entropy;
and the transparent transmission rate calculation module is used for calculating the percentage of the output information entropy in the sum of the plurality of input information entropies to serve as the information transparent transmission rate of the output data set.
Further, the data acquisition module is specifically configured to acquire an input data set that is input and meets the input data specification of the input variable; or alternatively
And acquiring the input data generation rule of the input variable, and generating an input data set which conforms to the input data specification of the input variable according to the data generation rule.
Further, the data obtaining module is further configured to analyze the multiple input variables of the ciphertext computation task before obtaining, for each of the multiple input variables of the ciphertext computation task, an input data set that meets the input data specification of the input variable; and obtains a data specification for each input variable.
Further, the information entropy calculation module is specifically configured to, when each piece of input data in the input data set is data in an array form, for each position of the array, calculate the information entropy of the element at the position based on the elements at the position of all pieces of input data of the input data set, and obtain the information entropy for each position as a plurality of input information entropies of the input data set.
Further, the information entropy calculation module is specifically configured to determine that the information entropy of the input data set is 0 when, in the ciphertext calculation task, the participant providing the input data set is a result recipient of the ciphertext calculation task.
Further, the information entropy calculation module is further configured to, when multiple output data sets are obtained, calculate joint information entropies of the multiple output data sets based on output data included in the multiple output data sets, as output joint information entropies;
the transparent transmission rate calculation module is further configured to calculate a percentage of the output joint information entropy to a sum of the plurality of input information entropies, and the percentage is used as the joint information transparent transmission rate of the plurality of output data sets.
Embodiments of the present application further provide an electronic device, including a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being caused by the machine-executable instructions to: implementing any of the above security detection methods.
An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the computer program implements any one of the above security detection methods.
Embodiments of the present application further provide a computer program product containing instructions, which when run on a computer, cause the computer to perform any one of the above-mentioned security detection methods.
The beneficial effect of this application includes:
in the method provided by the embodiment of the application, a plurality of input data sets are obtained for a ciphertext calculation task, an input information entropy is calculated for each input data set, then the plurality of input data sets are used as the input of a plaintext calculation program of the ciphertext calculation task to obtain an output data set, the output information entropy of the output data set is calculated, and then the percentage of the output information entropy in the sum of the plurality of input information entropies is calculated and is used as the information transmission rate of the output data set. The information transparent transmission rate of the output data set can represent the possibility of reversely deducing the input data based on the output data, namely can represent the security of data leakage, and therefore security detection for data leakage of a ciphertext computing task is achieved.
Additional features and advantages of the present application will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by the practice of the present application. The objectives and other advantages of the application may be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.
Drawings
The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the principles of the application. In the drawings:
fig. 1 is a flowchart of a security detection method for data leakage according to an embodiment of the present application;
FIG. 2 is a flow chart of a security detection method for data leakage according to another embodiment of the present application;
FIG. 3 is a flowchart of a security detection method for data leakage according to another embodiment of the present application;
fig. 4 is a schematic structural diagram of a security detection apparatus for data leakage according to an embodiment of the present application;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.
Detailed Description
In order to provide an implementation scheme for security detection of data leakage of a ciphertext computing task, embodiments of the present application provide a method, an apparatus, and an electronic device for security detection of data leakage, and a preferred embodiment of the present application is described below with reference to the drawings of the specification, it should be understood that the preferred embodiment described herein is only for illustrating and explaining the present application, and is not used to limit the present application. And the embodiments and features of the embodiments in the present application may be combined with each other without conflict.
An embodiment of the present application provides a security detection method for data leakage, as shown in fig. 1, including:
and step 16, calculating the percentage of the output information entropy in the sum of the multiple input information entropies, and taking the percentage as the information transmission rate of the output data set.
By adopting the security detection method provided by the embodiment of the application, a plurality of input data sets are obtained for a ciphertext calculation task, an input information entropy is calculated for each input data set, then the plurality of input data sets are used as the input of a plaintext calculation program of the ciphertext calculation task to obtain an output data set, the output information entropy of the output data set is calculated, and then the percentage of the output information entropy in the sum of the plurality of input information entropies is calculated and is used as the information transmission rate of the output data set. The information transparent transmission rate of the output data set can represent the possibility of reversely deducing the input data based on the output data, namely can represent the security of data leakage, and discloses the transmission rate of a ciphertext computing task to the original input data, so that the security detection of the data leakage of the ciphertext computing task is realized.
The method and apparatus provided herein are described in detail below with reference to the accompanying drawings using specific embodiments.
An embodiment of the present application provides a security detection method for data leakage, which, as shown in fig. 2, may include the following steps:
and step 21, analyzing a plurality of input variables of the ciphertext calculation task aiming at the ciphertext calculation task to be detected.
For a general ciphertext computation task, three parts are generally included: input, computation, and output, for example, python program code example one shown below:
inportprivpy as pp
alice = pp.ss(“alice_data”)
bob = pp.ss(“bob_data”)
res = alice> bob
pp.reveal(res,“result”)
in the Python program code example one, alice and bob are input variables, "res = alice > bob" is the calculation part, and res is the output.
In this step, a plurality of input variables of the ciphertext computing task may be analyzed by reading the configuration of the computing task or analyzing the program code of the ciphertext computing task.
And step 22, acquiring the data specification of each input variable aiming at the analyzed plurality of input variables.
In this step, the user may be prompted to input the data specification of each input variable in the multiple input variables, for example, integer, floating point, and character string, for the analyzed multiple input variables, and if the input variables are array variables, shape data such as the number of rows and columns of the array needs to be provided.
In this step, the data specification of each input variable may also be obtained by reading the configuration of the calculation task.
And 23, respectively aiming at each input variable in the plurality of input variables of the ciphertext calculation task, acquiring an input data set which accords with the input data specification of the input variable to obtain a plurality of input data sets.
In this step, for each input variable, the user may be prompted to select a data set generation manner, which includes: a direct data uploading mode and a specified data generation rule mode.
By adopting a direct data uploading mode, a data input interface can be provided for a user, so that the user can upload an input data set, namely, the input data set which is input and meets the input data specification of the input variable is obtained.
By adopting a mode of specifying a data generation rule, a user can be prompted to input the data generation rule, the input data generation rule of the input variable is obtained, and an input data set which meets the input data specification of the input variable is generated according to the data generation rule.
For example, for integer data, a user needs to specify a value range of the data, for example, in the Python program code example one, the value range of alice is 1 to 100;
for floating point data, a user needs to specify the effective precision of the data besides specifying a value range, for example, 2-bit numbers are reserved after decimal points;
for character string type data, three generation methods are supported: (1) Generating a virtual identity card number within a certain range according to rules; (2) Generating time and date within a certain period of time according to rules, such as year-month-day or year-month-day-minute-second; (3) Randomly generating fixed-length character strings, wherein characters in the character strings are all taken from all or part of character sets in 0-9, a-Z and A-Z, and the number of the generated character strings is specified.
For the data generation methods of the three data specifications, the default generation probability of the single data is uniform distribution, and the user may also specify other supported probability distribution methods.
And 24, calculating the information entropy of the input data set based on the input data contained in the input data set as the input information entropy of the input data set.
In the embodiment of the present application, for an input data set, the following formula may be adopted to calculate the entropy of the input information of the input data set:
wherein, the first and the second end of the pipe are connected with each other,
for the input entropy of the input data set X, m is the entropy of the independent data (i.e., each data after de-duplication) in the input data setThe number of the first and second components is,
the number of times the ith data in the m independent data appears in the input data set is shown, and N is the number of input data included in the input data set.
For example, in the Python program code example one, alice is an integer subject to uniform distribution between 1 and 100, and p of each value is 1/100, so the information entropy of alice can be calculated as:
in the embodiment of the present application, for the calculation of the input information entropy of the input data set, some specific calculation manners may also be adopted, for example, when in the ciphertext calculation task, a participant providing the input data set is also a result recipient of the ciphertext calculation task, it may be determined that the information entropy of the input data set is 0.
For another example, when each piece of input data in the input data set is data in an array form, for each position of the array, based on elements of the position of all input data of the input data set, the information entropy of the elements of the position is calculated, and the information entropy for each position is obtained as a plurality of input information entropies of the input data set. The information entropy for each position can be calculated by the above formula.
And step 25, converting the ciphertext calculation program for executing the ciphertext calculation task into a plaintext calculation program.
In the embodiment of the present application, a method of analyzing a ciphertext calculation program and converting the ciphertext calculation program into a plaintext calculation program may be adopted, that is, a ciphertext calculation task is converted into a plaintext calculation task.
For example, in the Python program code example one, the calculation part "res = alice > bob" is consistent with the plaintext calculation program, so that it can be directly used as the plaintext calculation program; for other APIs unique to the ciphertext calculation program, it may be converted into APIs corresponding to plaintext, for example, the ciphertext calculation program "a × pp.
And step 26, taking the plurality of input data sets as the input of the plaintext calculation program, and operating the plaintext calculation program to obtain an output data set containing the output data.
For example, in the Python program code example one, alice and bob are both data sets composed of uniformly distributed integers between 1 and 100. It can be counted that for all possible values of alice and bob, the output res is 5050 times false and 4950 times true.
For example, in the Python program code example one, 5050 times of output res are false,4950 times of output res are true, and the information entropy of output res can be calculated to be 1.00 according to the formula for calculating the information entropy.
And step 28, calculating the percentage of the output information entropy in the sum of the multiple input information entropies to serve as the information transmission rate of the output data set.
In the embodiment of the application, the input information entropy of the input data set and the output information entropy of the output data set can be compared according to a plurality of methods, and the comparison result is displayed to the user for prompting the security of data leakage of the ciphertext computing task to the user.
For example, one way of comparison may be to calculate the percentage of the output information entropy to the sum of the input information entropies as the information transmittance of the output data set.
For example, in the Python program code example one, the output information entropy of the output data set res is 1.00, and the input information entropies of the input data set alice and the input data set bob are both 6.64, the information transmittance of the output data set res is 1.00/(6.64 + 6.64) ≈ 7.53%, which means that the possibility of reversely deducing the information of the input data from the output data set as the calculation result is low.
As another example, the following Python program code is example two:
inportprivpy as pp
alice = pp.ss(“alice_data”)
bob = pp.ss(“bob_data”)
res = alice+ bob
pp.reveal(res,“result”)
assuming that the input data sets alice and bob are uniformly distributed integers between 1 and 100, the information transmittance of the output data set res can be calculated to be 55.43% through the above information transmittance calculation process, which means that there is a greater possibility that the information of the input data is reversely deduced from the calculation result. For example, if res has a value of 2, it can be concluded that alice and bob both have a value of 1. Or if res has a value of 3, it can be concluded that alice and bob have very small values.
As another example, the following Python program code is exemplary three:
inportprivpy as pp
alice = pp.ss(“alice_data”)
bob = pp.ss(“bob_data”)
res = alice* 100+ bob
pp.reveal(res,“result”)
assuming that the input data set alice and the input data set bob are uniformly distributed integers between 1 and 100, the information transmittance of the output data set res can be calculated to be 100% through the above information transmittance calculation process, which means that there is a great possibility that the information of the input data is inversely deduced from the calculation result. In the actual ciphertext calculation process, for the ciphertext operation task and the input rule, the respective numerical values of alice and bob can be reversely deduced from each calculation result.
In practical applications, a detection standard of security may be preset, for example, if the information transmission rate exceeds a certain value (e.g., 80%), it is considered that the security risk of data leakage for the ciphertext calculation task is large, and the ciphertext calculation task needs to be further reviewed (e.g., manually analyzed).
In the embodiment of the present application, for the case that the output variable of the ciphertext calculation task includes floating point type data, the case that the input variable includes floating point type data may be referred to for processing, the effective precision of the floating point type data is specified in advance by a user, and the output information entropy and the information transparent transmission rate are calculated according to the output data set of the effective precision.
For some ciphertext calculation tasks, the calculation result may include multiple output variables, and at this time, as shown in fig. 3, the following steps may be further adopted to calculate the joint information transmittance:
In this step, a plurality of output data sets corresponding to each other may be specifically spliced into string data to obtain a combined output data set including all the spliced string data, where the corresponding pair of output data sets is calculated using the same set of input data to obtain a plurality of output data sets.
And calculates the information entropy of the joint output data set as the joint information entropy of the plurality of output data sets, which may also be referred to as output joint information entropy.
And 32, calculating the percentage of the output joint information entropy in the sum of the multiple input information entropies to serve as the joint information transmission rate of the multiple output data sets.
Such as the following Python program code example four:
inportprivpy as pp
alice = pp.ss(“alice_data”)
bob = pp.ss(“bob_data”)
res1 = alice+ bob
res2 = alice- bob
pp.reveal(res1,“result”)
pp.reveal(res2,“result”)
the calculation task includes 2 output variables res1 and res2, and after the calculation task is executed, an output data set res1 and an output data set res2 are obtained.
Assuming that the input data of the input data set alice is 1 and 2, the input data of the input data set bob is also 1 and 2, and the input data are uniformly distributed, the input information entropy of the input data set alice is calculated to be 1, and the input information entropy of the input data set bob is also calculated to be 1 according to the formula for calculating the information entropy.
The calculation method for the output variables res1, res1 is: when alice is 1 and bob is 1, res1 is 2; when alice is 1 and bob is 2, res1 is 3; when alice is 2 and bob is 1, res1 is 3; when alice is 2 and bob is 2, res1 is 4. Then, according to the formula for calculating the information entropy, the output information entropy of the output data set res1 can be calculated to be 1.5, and the information transparent transmission rate of the output data set res1 is 1.5/(1 + 1) =0.75.
The calculation method for the output variables res2, res2 is: when alice is 1 and bob is 1, res2 is 0; when alice is 1 and bob is 2, res2 is-1; when alice is 2 and bob is 1, res2 is 1; when alice is 2 and bob is 2, res2 is 0. Then, according to the formula for calculating the information entropy, the output information entropy of the output data set res2 can be calculated to be 1.5, and the information transparent transmission rate of the output data set res2 is 1.5/(1 + 1) =0.75.
According to the above calculation method of the joint information transmission rate shown in fig. 3, the corresponding output data in the output data sets res1 and res2 are first spliced into string-type data "{ res1}: { res2}", so as to obtain a joint output data set, and when alice is 1 and bob is 1, the data values of "{ res1}: { res2}" are "2; when alice is 1 and bob is 2, "{ res1}: { res2}" is "-3; when alice is 2 and bob is 1, "{ res1}: { res2}" is "3; when alice is 2 and bob is 2, "{ res1}: { res2}" is "4. Then, according to the formula for calculating the information entropy, the joint output information entropy of the joint output data set "{ res1}: { res2}" is calculated to be 2, and the joint information transmittance of the joint output data set "{ res1}: { res2}" is calculated to be 2/(1 +1) =1, that is, 100%. That is, based on the output data sets res1 and res2, the input data sets alice and bob can be reversely deduced, because the original value of alice can be reversely deduced by (res 1+ res 2)/2, and (res 1-res 2)/2 can be reversely deduced by the original value of bob.
When the calculation result of the ciphertext calculation task comprises a plurality of output variables, the joint information transparent transmission rate of a plurality of output data sets is calculated, and the safety of data leakage of the ciphertext calculation task can be further detected more accurately and comprehensively.
By adopting the security detection method for data leakage provided by the embodiment of the application, the information transmission rate of the output data set of the ciphertext calculation task to be detected is calculated, the information transmission rate of the output data set can represent the possibility of reversely pushing out the input data based on the output data, namely can represent the security of data leakage, and the transmission rate of the ciphertext calculation task to the original input data is disclosed, so that the security detection for the data leakage of the ciphertext calculation task is realized.
In addition, in the calculation process, historical input data is not needed, and the method is more suitable for detecting the data leakage safety of the ciphertext calculation task and judging whether to start the multiparty safety calculation and the privacy calculation in the multiparty safety calculation and privacy calculation processes.
Moreover, by adopting the method, the data leakage safety of various numerical calculation tasks can be monitored.
Based on the same inventive concept, according to the security detection method for data leakage provided in the foregoing embodiment of the present application, correspondingly, another embodiment of the present application further provides a security detection apparatus for data leakage, a schematic structural diagram of which is shown in fig. 4, and specifically includes:
a data obtaining module 41, configured to obtain, for each input variable of the multiple input variables of the ciphertext computation task, an input data set that meets an input data specification of the input variable, so as to obtain multiple input data sets;
an information entropy calculation module 42, configured to calculate, for each input data set, information entropy of the input data set based on input data included in the input data set, as input information entropy of the input data set;
a task conversion module 43, configured to convert a ciphertext calculation program that executes the ciphertext calculation task into a plaintext calculation program;
a task running module 44, configured to use the multiple input data sets as inputs of the plaintext calculation program, and run the plaintext calculation program to obtain an output data set including output data;
the information entropy calculating module 42 is further configured to calculate, based on the output data included in the output data set, an information entropy of the output data set as an output information entropy;
and a transparent transmission rate calculating module 45, configured to calculate a percentage of the output information entropy to a sum of the plurality of input information entropies, as an information transparent transmission rate of the output data set.
Further, the data obtaining module 41 is specifically configured to obtain an input data set that meets the input data specification of the input variable; or alternatively
And acquiring the input data generation rule of the input variable, and generating an input data set conforming to the input data specification of the input variable according to the data generation rule.
Further, the data obtaining module 41 is further configured to, before obtaining, for each input variable in the plurality of input variables of the ciphertext calculation task, an input data set that meets the input data specification of the input variable, analyze the plurality of input variables of the ciphertext calculation task; and obtains a data specification for each input variable.
Further, the information entropy calculating module 42 is specifically configured to, when each piece of input data in the input data set is data in an array form, for each position of the array, calculate the information entropy of the element at the position based on the elements at the position of all input data of the input data set, and obtain the information entropy for each position as the multiple input information entropies of the input data set.
Further, the information entropy calculating module 42 is specifically configured to determine that the information entropy of the input data set is 0 when, in the ciphertext calculation task, the participant providing the input data set is the result recipient of the ciphertext calculation task.
Further, the information entropy calculating module 42 is further configured to, when multiple output data sets are obtained, calculate joint information entropies of the multiple output data sets as output joint information entropies based on output data included in the multiple output data sets;
the transparent transmission rate calculating module 45 is further configured to calculate a percentage of the output joint information entropy to a sum of the multiple input information entropies, as the joint information transparent transmission rates of the multiple output data sets.
The functions of the above modules may correspond to the corresponding processing steps in the flows shown in fig. 1 to fig. 3, and are not described herein again.
The security detection apparatus provided by the embodiment of the present application can be implemented by a computer program. It should be understood by those skilled in the art that the above-mentioned module division is only one of many module division, and if the module is divided into other modules or not, it is within the scope of the present application as long as the security detection apparatus has the above-mentioned functions.
An electronic device is further provided in an embodiment of the present application, as shown in fig. 5, and includes a processor 51 and a machine-readable storage medium 52, where the machine-readable storage medium 52 stores machine-executable instructions that can be executed by the processor 51, and the processor 51 is caused by the machine-executable instructions to: implementing any of the above security detection methods.
An embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the computer program implements any one of the foregoing security detection methods.
Embodiments of the present application further provide a computer program product containing instructions, which when run on a computer, cause the computer to perform any one of the above-mentioned security detection methods.
The machine-readable storage medium in the electronic device may include a Random Access Memory (RAM) and a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.
The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.
All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on differences from other embodiments. In particular, for the apparatus, the electronic device, the computer-readable storage medium, and the computer program product embodiment, since they are substantially similar to the method embodiment, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising one of 8230; \8230;" 8230; "does not exclude the presence of additional like elements in a process, method, article, or apparatus that comprises the element.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.
Claims (10)
1. A security detection method for data leakage is characterized by comprising the following steps:
respectively aiming at each input variable in a plurality of input variables of the ciphertext computing task, acquiring an input data set which accords with the input data specification of the input variable, and obtaining a plurality of input data sets;
for each input data set, calculating the information entropy of the input data set based on the input data contained in the input data set as the input information entropy of the input data set;
converting the ciphertext calculation program for executing the ciphertext calculation task into a plaintext calculation program;
taking the plurality of input data sets as the input of the plaintext calculation program, and operating the plaintext calculation program to obtain an output data set containing output data;
calculating the information entropy of the output data set based on the output data contained in the output data set as the output information entropy;
and calculating the percentage of the output information entropy in the sum of the multiple input information entropies as the information transmission rate of the output data set, wherein the information transmission rate represents the security of data leakage.
2. The method of claim 1, wherein obtaining an input data set that meets an input data specification for the input variable comprises:
acquiring an input data set which is input and accords with the input data specification of the input variable; or
And acquiring the input data generation rule of the input variable, and generating an input data set conforming to the input data specification of the input variable according to the data generation rule.
3. The method of claim 2, wherein prior to obtaining, for each of a plurality of input variables of the ciphertext computing task, an input data set that conforms to an input data specification for the input variable, respectively, further comprising:
analyzing a plurality of input variables of the ciphertext computing task;
a data specification for each input variable is obtained.
4. The method of claim 1, wherein the calculating the information entropy of the input data set based on the input data included in the input data set as the input information entropy of the input data set comprises:
when each piece of input data in the input data set is data in an array form, for each position of the array, calculating the information entropy of the element of the position based on the elements of the position of all the input data of the input data set, and obtaining the information entropy for each position as a plurality of input information entropies of the input data set.
5. The method of claim 1, wherein the calculating the information entropy of the input data set based on the input data included in the input data set as the input information entropy of the input data set comprises:
and when the participant providing the input data set in the ciphertext computing task is the result receiver of the ciphertext computing task, determining that the information entropy of the input data set is 0.
6. The method of claim 1, when multiple output data sets are obtained, the method further comprising:
calculating joint information entropies of the plurality of output data sets based on output data included in the plurality of output data sets as output joint information entropies;
and calculating the percentage of the output joint information entropy to the sum of the plurality of input information entropies as the joint information transmission rate of the plurality of output data sets.
7. A security detection apparatus for data leakage, comprising:
the data acquisition module is used for respectively acquiring an input data set which accords with the input data specification of the input variable aiming at each input variable in a plurality of input variables of the ciphertext calculation task to obtain a plurality of input data sets;
the information entropy calculation module is used for calculating the information entropy of each input data set based on the input data contained in the input data set as the input information entropy of the input data set;
the task conversion module is used for converting a ciphertext calculation program for executing the ciphertext calculation task into a plaintext calculation program;
the task operation module is used for taking the plurality of input data sets as the input of the plaintext calculation program, operating the plaintext calculation program and obtaining an output data set containing output data;
the information entropy calculation module is further configured to calculate an information entropy of the output data set based on output data included in the output data set, and the information entropy is used as an output information entropy;
and the transmission rate calculation module is used for calculating the percentage of the output information entropy in the sum of the multiple input information entropies to serve as the information transmission rate of the output data set, and the information transmission rate represents the security of data leakage.
8. The apparatus of claim 7, wherein the information entropy calculation module is further configured to, when obtaining a plurality of output data sets, calculate joint information entropies of the plurality of output data sets as output joint information entropies based on output data included in the plurality of output data sets;
the transparent transmission rate calculation module is further configured to calculate a percentage of the output joint information entropy to a sum of the plurality of input information entropies, and the percentage is used as the joint information transparent transmission rate of the plurality of output data sets.
9. An electronic device comprising a processor and a machine-readable storage medium storing machine-executable instructions executable by the processor, the processor being caused by the machine-executable instructions to: carrying out the method of any one of claims 1 to 6.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210881723.1A CN115062299B (en) | 2022-07-26 | 2022-07-26 | Security detection method and device for data leakage and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210881723.1A CN115062299B (en) | 2022-07-26 | 2022-07-26 | Security detection method and device for data leakage and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115062299A CN115062299A (en) | 2022-09-16 |
| CN115062299B true CN115062299B (en) | 2022-11-01 |
Family
ID=83206623
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210881723.1A Active CN115062299B (en) | 2022-07-26 | 2022-07-26 | Security detection method and device for data leakage and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115062299B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116151627B (en) * | 2023-04-04 | 2023-09-01 | 支付宝(杭州)信息技术有限公司 | Business wind control method and device, storage medium and electronic equipment |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109743203B (en) * | 2018-12-28 | 2022-02-01 | 西安电子科技大学 | Distributed service security combination system and method based on quantitative information flow |
| US11128457B2 (en) * | 2019-06-18 | 2021-09-21 | Microsoft Technology Licensing, Llc | Cryptographic key generation using external entropy generation |
| CN111552597A (en) * | 2020-03-27 | 2020-08-18 | 深圳开源互联网安全技术有限公司 | Automobile CAN bus network safety test system and method |
| CN114117487A (en) * | 2021-11-24 | 2022-03-01 | 上海派拉软件股份有限公司 | Plaintext similarity estimation method, device, equipment and medium for encrypted character string |
| CN114692149B (en) * | 2022-03-31 | 2023-06-27 | 北京九章云极科技有限公司 | Multiparty security calculation verification method and multiparty security calculation verification system |
-
2022
- 2022-07-26 CN CN202210881723.1A patent/CN115062299B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN115062299A (en) | 2022-09-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20200366460A1 (en) | Homomorphic data decryption method and apparatus for implementing privacy protection | |
| CN107683502B (en) | Generating cryptographic function parameters from compact source code | |
| Mironov | On significance of the least significant bits for differential privacy | |
| EP3424175B1 (en) | Converting a boolean masked value to an arithmetically masked value for cryptographic operations | |
| CN111543025A (en) | High precision privacy preserving real valued function evaluation | |
| CN110166446B (en) | Method for realizing geographical weighted average center based on safe multi-party calculation | |
| US20180034634A1 (en) | Method and system for determining desired size of private randomness using tsallis entropy | |
| CN109446828B (en) | Secure multi-party computing method and device | |
| WO2009137593A1 (en) | Cryptographic system including a random number generator using finite field arithmetics | |
| Böhler et al. | Secure multi-party computation of differentially private heavy hitters | |
| TW202103154A (en) | Data processing method and apparatus, and electronic device | |
| Falcetta et al. | Privacy-preserving deep learning with homomorphic encryption: An introduction | |
| CN115062299B (en) | Security detection method and device for data leakage and electronic equipment | |
| CN111143862A (en) | Data processing method, query method, device, electronic equipment and system | |
| Moon et al. | An Efficient Encrypted Floating‐Point Representation Using HEAAN and TFHE | |
| Jallouli | Chaos-based security under real-time and energy constraints for the Internet of Things | |
| CN113704805B (en) | Wind control rule matching method and device and electronic equipment | |
| CN111159730B (en) | Data processing method, query method, device, electronic equipment and system | |
| Makkonen et al. | Analog secure distributed matrix multiplication over complex numbers | |
| WO2020211075A1 (en) | Decentralized secure multi-party data processing method and device, and storage medium | |
| CN112668016A (en) | Model training method and device and electronic equipment | |
| CN115361131A (en) | Ciphertext data calculation method and device and electronic equipment | |
| CN115529120A (en) | Secret computing system | |
| Okada et al. | Learned pseudo-random number generator: WGAN-GP for generating statistically robust random numbers | |
| US20160170937A1 (en) | Calculation device, calculation method, and program |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |