CN116050847A - Data risk assessment method and device, storage medium and electronic equipment - Google Patents
Data risk assessment method and device, storage medium and electronic equipment Download PDFInfo
- Publication number
- CN116050847A CN116050847A CN202310090702.2A CN202310090702A CN116050847A CN 116050847 A CN116050847 A CN 116050847A CN 202310090702 A CN202310090702 A CN 202310090702A CN 116050847 A CN116050847 A CN 116050847A
- Authority
- CN
- China
- Prior art keywords
- data
- node
- evaluated
- evaluation
- encrypted
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0635—Risk analysis of enterprise or organisation activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Computer Security & Cryptography (AREA)
- Bioethics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- General Health & Medical Sciences (AREA)
- Economics (AREA)
- Strategic Management (AREA)
- Entrepreneurship & Innovation (AREA)
- Software Systems (AREA)
- Game Theory and Decision Science (AREA)
- General Business, Economics & Management (AREA)
- Tourism & Hospitality (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Educational Administration (AREA)
- Development Economics (AREA)
- Medical Informatics (AREA)
- Databases & Information Systems (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
Abstract
The specification discloses a method, a device, a storage medium and an electronic device for evaluating data risk, wherein the method comprises the following steps: the evaluation request party encrypts the determined data to be evaluated by adopting a first public key of the node, the encrypted data is sent to the node, the node decrypts the encrypted data according to a first private key in a trusted execution environment of the node, then risk evaluation is carried out on the decrypted data to be evaluated in the trusted execution environment to obtain an evaluation result, the node encrypts the evaluation result by adopting a second public key of the evaluation request party, the encrypted evaluation result is sent to the evaluation request party, the data to be evaluated obtained after decryption is encrypted in a data transmission process by the node and the evaluation request party, and the risk evaluation is carried out on the data to be evaluated in the trusted execution environment of the node, so that the data cannot be revealed in the data transmission process and the risk evaluation process, and the risk of privacy leakage is reduced.
Description
Technical Field
The present disclosure relates to the field of computer technologies, and in particular, to a method and apparatus for data risk assessment, a storage medium, and an electronic device.
Background
With the development of technology, the occurrence frequency of fraud is higher and higher, which requires that the service party identify the fraud to perform anti-fraud. Among them, anti-fraud through black and white lists is the simplest means.
When the risk assessment is carried out on the data, the risk assessment can be carried out on the data to be risk assessed according to the preset blacklist and the data characteristics in the whitelist, the probability that the data to be risk assessed is at risk is obtained, and when the data to be risk assessed is at risk, the data to be risk assessed is added into the blacklist. The data to be risk-evaluated may include privacy data of the user, such as a face, a document number of the user, and the like. The users on the blacklist are users with fraud records and the users on the whitelist are users without fraud records. In this process, although the data to be risk-evaluated is desensitized, some key features of the data to be risk-evaluated are still disclosed to other parties, such as cloud vendors, malicious personnel, and the like, which increases the risk of disclosure of user privacy.
Therefore, how to perform risk assessment on data under the premise of protecting private data is a problem to be solved urgently.
Disclosure of Invention
The present disclosure provides a method, an apparatus, a storage medium, and an electronic device for data risk assessment, so as to partially solve the foregoing problems in the prior art.
The technical scheme adopted in the specification is as follows:
the present specification provides a method of data risk assessment, comprising:
the node receives encrypted data sent by an evaluation requester, wherein the encrypted data is obtained by the evaluation requester by encrypting the data to be evaluated according to a first public key of the node;
decrypting the encrypted data in a trusted execution environment of the node according to a first private key stored in the node;
in the trusted execution environment, performing risk assessment on the data to be assessed obtained after decryption to obtain an assessment result;
and encrypting the evaluation result by adopting the second public key of the evaluation requester, and sending the encrypted evaluation result to the evaluation requester.
Optionally, performing risk assessment on the data to be assessed obtained after decryption to obtain an assessment result, which specifically includes:
inputting the decrypted data to be evaluated into a pre-stored prediction model to obtain the characteristics of the data to be evaluated;
Judging whether the data characteristics to be evaluated are consistent with blacklist characteristics stored by the nodes;
if yes, determining the data to be evaluated as risk data.
Optionally, the encrypted data further comprises an evaluation strategy;
when the data characteristic to be evaluated is inconsistent with the blacklist characteristic stored by the node, the method further comprises:
and carrying out risk assessment on the data to be assessed according to the assessment strategy.
Optionally, according to the evaluation policy, performing risk evaluation on the data to be evaluated specifically includes:
obtaining blacklist characteristics stored by other nodes;
and carrying out risk assessment on the data to be assessed according to the obtained blacklist features, the data features to be assessed and the assessment strategy.
Optionally, according to the obtained blacklist feature, the data feature to be evaluated and the evaluation policy, performing risk evaluation on the data to be evaluated, which specifically includes:
determining the similarity between the data features to be evaluated and the obtained blacklist features;
and judging whether the similarity is larger than a threshold value contained in the evaluation strategy, if so, determining that the data to be evaluated is risk data, otherwise, determining that the data to be evaluated is not risk data.
Optionally, after determining that the data to be evaluated is risk data, the method further comprises:
and sending the data characteristics to be evaluated to other nodes so that the other nodes store the received data characteristics to be evaluated as blacklist characteristics.
Optionally, pre-storing the prediction model specifically includes:
receiving an encrypted prediction model sent by a dispatcher;
and in the trusted execution environment, decrypting the encrypted prediction model according to the first private key stored in the node to obtain the prediction model.
Optionally, before receiving the encrypted prediction model sent by the dispatcher, the method further includes:
receiving a remote attestation request sent by a dispatcher;
and sending a proving report and a first public key to the dispatching party so that the dispatching party verifies the proving report, encrypting a pre-trained prediction model by adopting the first public key after verification is passed, and sending the encrypted prediction model to the node.
Optionally, the encrypted data further includes the second public key;
encrypting the evaluation result by adopting a second public key of the evaluation requester, wherein the method specifically comprises the following steps:
And decrypting the encrypted data in the trusted execution environment of the node according to the first private key to obtain the second public key, and encrypting the evaluation result by adopting the second public key.
The present specification provides a method of data risk assessment, the method being applied to an assessment requester, the method comprising:
determining data to be evaluated, and encrypting the data to be evaluated according to a first public key of a node to obtain encrypted data;
the encrypted data is sent to the node, so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and risk assessment is carried out on the data to be assessed, which is obtained after decryption, to obtain an assessment result;
and receiving an evaluation result sent by the node.
Optionally, encrypting the data to be evaluated according to the first public key of the node specifically includes:
receiving a first public key of a node sent by a dispatcher;
and encrypting the data to be evaluated according to the first public key.
Optionally, encrypting the data to be evaluated according to the first public key of the node to obtain encrypted data, which specifically includes:
Encrypting the data to be evaluated and the second public key of the evaluation requester according to the first public key of the node to obtain encrypted data;
receiving an evaluation result sent by the node, which specifically comprises the following steps:
receiving an encrypted evaluation result sent by the node, wherein the encrypted evaluation result is obtained by encrypting the evaluation result by the node by adopting the second public key;
and decrypting the encrypted evaluation result according to the second private key stored by the evaluation requester to obtain the evaluation result.
The present specification provides an apparatus for data risk assessment, the apparatus being applied to a node, the apparatus comprising:
the receiving module is used for receiving the encrypted data sent by the evaluation requester by the node, wherein the encrypted data is obtained by encrypting the data to be evaluated by the evaluation requester according to the first public key of the node;
the decryption module is used for decrypting the encrypted data in the trusted execution environment of the node according to the first private key stored in the node;
the evaluation module is used for performing risk evaluation on the data to be evaluated obtained after decryption in the trusted execution environment to obtain an evaluation result;
And the encryption module is used for encrypting the evaluation result by adopting the second public key of the evaluation requester and sending the encrypted evaluation result to the evaluation requester.
The present specification provides an apparatus for data risk assessment, the apparatus being applied to an assessment requester, the apparatus comprising:
the determining module is used for determining the data to be evaluated, encrypting the data to be evaluated according to the first public key of the node and obtaining encrypted data;
the sending module is used for sending the encrypted data to the node so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and performs risk assessment on the data to be assessed, which is obtained after decryption, to obtain an assessment result;
and the result module is used for receiving the evaluation result sent by the node.
The present specification provides a computer readable storage medium storing a computer program which when executed by a processor implements the method of data risk assessment described above.
The present specification provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing a method of data risk assessment as described above when executing the program.
The above-mentioned at least one technical scheme that this specification adopted can reach following beneficial effect:
in the method for evaluating the risk of the data provided by the specification, a node receives encrypted data obtained by encrypting determined data to be evaluated according to a first public key of the node by an evaluation requesting party, the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key, then carries out risk evaluation on the decrypted data to be evaluated in the trusted execution environment to obtain an evaluation result, encrypts the evaluation result by adopting a second public key of the evaluation requesting party, and sends the encrypted evaluation result to the evaluation requesting party.
According to the method, the evaluation request party encrypts the determined data to be evaluated by the first public key of the node, the encrypted data is sent to the node, the node decrypts the encrypted data according to the first private key in the trusted execution environment of the node, then risk evaluation is carried out on the data to be evaluated obtained after decryption in the trusted execution environment to obtain an evaluation result, the node encrypts the evaluation result by the second public key of the evaluation request party, the encrypted evaluation result is sent to the evaluation request party, the data to be evaluated is encrypted by the evaluation request party and then sent to the node and the node to encrypt the evaluation result and then sent to the evaluation request party, so that the node and the evaluation request party cannot leak data in the data transmission process, the risk of privacy leakage is reduced, and meanwhile, the node carries out risk evaluation on the data to be evaluated obtained after decryption in the trusted execution environment of the node to obtain the evaluation result, so that the risk of the data to be evaluated does not leak data, and the risk of privacy leakage is reduced.
Drawings
The accompanying drawings, which are included to provide a further understanding of the specification, illustrate and explain the exemplary embodiments of the present specification and their description, are not intended to limit the specification unduly. Attached at
In the figure:
FIG. 1 is a flow chart of a method for data risk assessment provided in the present specification;
FIG. 2 is a flow chart of another method of data risk assessment provided in the present specification;
FIG. 3 is a schematic diagram of a data transmission process provided in the present specification;
FIG. 4 is a schematic diagram of an apparatus for data risk assessment provided in the present specification;
FIG. 5 is a schematic diagram of another apparatus for data risk assessment provided in the present specification;
fig. 6 is a schematic view of the electronic device corresponding to fig. 1 provided in the present specification.
Detailed Description
For the purposes of making the objects, technical solutions and advantages of the present specification more apparent, the technical solutions of the present specification will be clearly and completely described below with reference to specific embodiments of the present specification and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, of the embodiments of the present specification. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are intended to be within the scope of the present disclosure.
The embodiments of the present disclosure provide a method, an apparatus, a storage medium, and an electronic device for data risk assessment, and in the following, with reference to the drawings, the technical solutions provided by each embodiment of the present disclosure are described in detail.
Fig. 1 is a flow chart of a method for evaluating data risk provided in the present specification, where the method shown in fig. 1 is applied to a node, and specifically includes the following steps:
s100: and receiving encrypted data sent by an evaluation requester, wherein the encrypted data is obtained by encrypting the data to be evaluated by the evaluation requester according to a first public key of the node.
When the data is encrypted, symmetric encryption and asymmetric encryption can be adopted, the same key is used in the encryption and decryption processes, for example, when the symmetric encryption is used for encrypting the data, the public key is adopted for encrypting the data, and correspondingly, when the data is decrypted, the public key is adopted for decrypting the data. The asymmetric encryption is a pair of keys used in the encryption and decryption processes, for example, when the asymmetric encryption is used for encrypting the data, the public key is adopted for encrypting the data, and when the data is decrypted correspondingly, the private key corresponding to the public key can only be adopted for decrypting the encrypted data. In this specification, in order to reduce the risk of disclosure of private data, encryption of data using asymmetric encryption will be described as an example.
In this specification, a node for performing data risk assessment receives encrypted data sent by an assessment requester, where the node for performing data risk assessment is a node that has a trusted execution environment, and the node may be any node that has a trusted execution environment and can perform data risk assessment in a distributed system, or the node may be a server that has a trusted execution environment and can perform data risk assessment, and for convenience of description, the following description will be made with the node as an execution subject. The assessment requester is a data provider that needs to perform risk assessment on its own data. The encrypted data is obtained by encrypting the data to be evaluated according to the first public key of the node by the evaluation requester. The trusted execution environment (Trusted Execution Environment, TEE for short) is a hardware-based isolated running environment, and isolation is not affected by any external software and hardware and operators.
S102: and decrypting the encrypted data in the trusted execution environment of the node according to the first private key stored in the node.
S104: and in the trusted execution environment, performing risk assessment on the data to be assessed, which are obtained after decryption, to obtain an assessment result.
And the node decrypts the encrypted data in the trusted execution environment of the node according to the first private key stored in the node, and then carries out risk assessment on the data to be assessed obtained after decryption to obtain an assessment result. Specifically, the node decrypts the encrypted data in a trusted execution environment of the node according to the first private key stored in the node, inputs the data to be evaluated obtained after decryption into a pre-stored prediction model to obtain data characteristics to be evaluated, judges whether the data characteristics to be evaluated are consistent with blacklist characteristics stored in the node, and determines the data to be evaluated as risk data when the data characteristics to be evaluated are consistent with the blacklist characteristics stored in the node. The pre-stored prediction model is a model pre-trained by a dispatcher, and the blacklist features are features of users on the blacklist, such as face features, certificate features and the like.
When judging whether the data features to be evaluated are consistent with the blacklist features stored by the nodes, the data features to be evaluated can be judged by adopting a preset rule algorithm or a pre-trained machine learning model, the specification is not particularly limited, and only the data features to be evaluated are required to be judged whether the data features to be evaluated are consistent with the blacklist features stored by the nodes.
The encrypted data may further include an evaluation policy, so that when the feature of the data to be evaluated is inconsistent with the blacklist feature stored in the node, the node may perform risk evaluation on the data to be evaluated according to the evaluation policy. Specifically, when the data characteristics to be evaluated are inconsistent with the blacklist characteristics stored by the nodes, the blacklist characteristics stored by other nodes are obtained, and risk evaluation is performed on the data to be evaluated according to the obtained blacklist characteristics, the data characteristics to be evaluated and the evaluation strategy. The evaluation policy is an evaluation policy formulated by an evaluation requester, for example, when the similarity between the feature of the data to be evaluated and the feature of the blacklist is greater than a preset threshold value, determining the data to be evaluated as risk data. The threshold values preset by different evaluation requesters may be the same or different.
When risk assessment is performed on data to be assessed according to the obtained blacklist features, the data features to be assessed and the assessment policy, the node can determine similarity between the data features to be assessed and the obtained blacklist features, judge whether the similarity is larger than a threshold value contained in the assessment policy, if so, determine that the data to be assessed is risk data, otherwise, determine that the data to be assessed is not risk data. For example, assuming that the data features to be evaluated include face features and certificate features, the obtained blacklist features are face features of users on the blacklist, the threshold included in the evaluation policy is 0.9, the node determines similarity between the data features to be evaluated and the obtained blacklist features, that is, determines similarity between the face features and the face features of the users on the blacklist, assuming that the similarity is 0.91, judging whether the similarity is greater than the threshold included in the evaluation policy, if yes, determining that the data to be evaluated is risk data, otherwise, determining that the data to be evaluated is not risk data. Obviously, 0.91 is larger than 0.9, and the data to be evaluated is determined to be risk data.
The node may further determine a similarity between the feature of the data to be evaluated and the obtained blacklist feature, determine a number of similarities greater than a threshold value included in the evaluation policy, and determine that the data to be evaluated is risk data when the determined number is greater than a preset number included in the evaluation policy, or determine that the data to be evaluated is not risk data. For example, assuming that the data features to be evaluated include face features and certificate features, the obtained blacklist features are face features and certificate features of the user on the blacklist, the threshold value included in the evaluation policy is 0.9, the preset number is 2, the node determines the similarity between the data features to be evaluated and the obtained blacklist features, that is, determines the face similarity between the face features and the face features of the user on the blacklist and determines the certificate similarity between the certificate features and the certificate features of the user on the blacklist, the face similarity is assumed to be 0.91, the certificate similarity is 0.8, the number of the similarity greater than the threshold value included in the evaluation policy is determined, that is, 1, when the determined number is greater than the preset number included in the evaluation policy, the data to be evaluated is determined to be risk data, otherwise, the data to be evaluated is determined not to be risk data. It is obvious that the determined number 1 is smaller than the preset number 2, and that the data to be evaluated are not risk data.
The node may also determine that, according to an evaluation criterion included in the evaluation policy, a blacklist feature that meets the evaluation criterion is determined from the obtained blacklist features, determine a similarity between the data feature to be evaluated and the blacklist feature that meets the evaluation criterion, determine whether the similarity is greater than a threshold included in the evaluation policy, if so, determine that the data to be evaluated is risk data, and if not, determine that the data to be evaluated is not risk data. For example, it is assumed that the evaluation criterion included in the evaluation policy is to only determine whether the similarity between the credential feature included in the data to be evaluated and the credential feature included in the blacklist feature is greater than a threshold, if so, it is determined that the data to be evaluated is risk data, otherwise, it is determined that the data to be evaluated is not risk data. The data characteristics to be evaluated comprise face characteristics and certificate characteristics, the obtained blacklist characteristics are face characteristics and certificate characteristics of users on the blacklist, and the threshold value contained in the evaluation strategy is 0.9. The node determines that according to the evaluation criteria contained in the evaluation policy, determines blacklist features meeting the evaluation criteria, namely certificate features, from the obtained blacklist features (namely face features and certificate features of the user on the blacklist), determines the similarity between the data features to be evaluated and the blacklist features meeting the evaluation criteria, namely determines the similarity between the certificate features contained in the data to be evaluated and the certificate features contained in the blacklist features, and if the similarity is 0.91, judges whether the similarity is greater than a threshold value (namely 0.9) contained in the evaluation policy, if so, determines that the data to be evaluated is risk data, otherwise, determines that the data to be evaluated is not risk data. Obviously, 0.91 is larger than 0.9, and the data to be evaluated is determined to be risk data.
S106: and encrypting the evaluation result by adopting the second public key of the evaluation requester, and sending the encrypted evaluation result to the evaluation requester.
The node encrypts the evaluation result by adopting the second public key of the evaluation requester and sends the encrypted evaluation result to the evaluation requester. Specifically, the encrypted data may further include a second public key, the encrypted data is decrypted in the trusted execution environment of the node according to the first private key to obtain the second public key, that is, the encrypted data includes not only the data to be evaluated, but also the second public key, the node decrypts the encrypted data in the trusted execution environment of the node according to the first private key to obtain the second public key, and then the evaluation result may be encrypted by using the second public key and sent to the evaluation requester after the encryption.
According to the method, the node receives the encrypted data sent by the assessment requesting party, decrypts the encrypted data in the trusted execution environment of the node according to the first private key, then carries out risk assessment on the data to be assessed obtained after decryption in the trusted execution environment to obtain an assessment result, encrypts the assessment result by adopting the second public key of the assessment requesting party, and sends the encrypted assessment result to the assessment requesting party. By sending the encrypted evaluation result obtained by encrypting the evaluation result by the second public key to the evaluation requester, the risk of leakage of the evaluation result is reduced in the data transmission process. Meanwhile, the encrypted data received by the node is the data encrypted by the first public key by the assessment requester, so that the risk of leakage of the data to be assessed is reduced in the process of transmitting the encrypted data to the node by the assessment requester, the node decrypts the encrypted data in a trusted execution environment and performs risk assessment on the data to be assessed obtained after decryption, the risk of leakage of the data to be assessed can be reduced, and privacy in the data can be better protected.
After determining that the data to be evaluated is risk data in the step S104, the node sends the data features to be evaluated to other nodes, so that the other nodes store the received data features to be evaluated as blacklist features. Specifically, when the data to be evaluated is risk data, public keys of other nodes stored in the nodes are determined, for each public key, the data features to be evaluated are encrypted by adopting the public key, the encrypted data features to be evaluated are sent to the node corresponding to the public key, so that the node corresponding to the public key decrypts according to the private key corresponding to the public key, and the decrypted data features to be evaluated are stored as blacklist features.
When the prediction model is pre-stored in step S104, the node may receive the encrypted prediction model sent by the dispatcher, and decrypt the encrypted prediction model according to the first private key stored in the node in the trusted execution environment, to obtain the prediction model. The prediction model is a model pre-trained by a dispatcher and is used for extracting data characteristics of data, and because the model is trained by using the data, the data serving as training samples also contains private data, in order to avoid private data leakage caused by model leakage, before receiving the encrypted prediction model sent by the dispatcher, a node receives a remote attestation request sent by the dispatcher, sends an attestation report and a first public key to the dispatcher, so that the dispatcher verifies the attestation report, encrypts the pre-trained prediction model by adopting the first public key after verification is passed, and sends the attestation report to the node. The remote proving is that the dispatcher verifies the identity of the node, namely, whether the node has a trusted execution environment or not is determined, and data cannot be revealed, and the proving report is that the node sends a report capable of proving the identity of the node to the dispatcher, wherein the proving report can be a digital signature of the node or any other report capable of proving the identity of the node to the dispatcher. The method and the system are not particularly limited, and only a dispatcher can determine that a trusted execution environment exists in the node and cannot leak data.
When the proving report is a digital signature of the node, the dispatcher can receive the proving report and the first public key sent by the node, decrypt the proving report by adopting the first public key, when the proving report is successfully decrypted by adopting the first public key, determine identification information in the decrypted proving report, judge whether the determined identification information is consistent with the pre-stored identification information of the node, if the determined identification information is consistent with the pre-stored identification information, the proving report is verified, the dispatcher encrypts the pre-trained prediction model by adopting the first public key and sends the encrypted pre-trained prediction model to the node, otherwise, the proving report is not verified, and the dispatcher does not send the pre-trained prediction model to the node. When the first public key is adopted to decrypt the evidence report, the evidence report is not verified, and the dispatcher does not send the pre-trained prediction model to the node. The proving report is a report obtained after the node adopts the first private key to encrypt, the identification information can be the identification of the node, or any other content, the specification is not particularly limited, and the dispatcher can only determine the identity of the node according to the identification information.
Before the node receives the encrypted data sent by the evaluation requester in the step S100, the node receives a remote attestation request sent by the evaluation requester, sends an attestation report and a first public key to the evaluation requester, so that the evaluation requester verifies the received attestation report, and encrypts the data to be evaluated by using the received first public key after verification is passed, so as to obtain the encrypted data.
In the step S100, the node may receive the encrypted data sent by the dispatcher, where the encrypted data is encrypted by the evaluation requester according to the first public key of the node, and the encrypted data is sent to the dispatcher. Correspondingly, in the step S106, the node may send the encrypted evaluation result to the dispatcher, so that the dispatcher sends the received encrypted evaluation result to the evaluation requester.
The present disclosure further provides a method for evaluating data risk, which is applied to an evaluating requester, as shown in fig. 2, and fig. 2 is a flow chart of another method for evaluating data risk provided in the present disclosure, specifically including the following steps:
s200: and determining the data to be evaluated, and encrypting the data to be evaluated according to the first public key of the node to obtain encrypted data.
The evaluation requester determines the data to be evaluated, encrypts the data to be evaluated according to the first public key of the node, and obtains encrypted data. Specifically, the evaluation requester determines the data to be evaluated, the first public key of the node sent by the receiving node, encrypts the data to be evaluated according to the first public key to obtain encrypted data, and in the process, the determining the data to be evaluated and the first public key of the node sent by the receiving node have no sequence, the first public key of the node sent by the receiving node may be determined before the data to be evaluated is not determined yet, or the first public key of the node sent by the receiving node may be determined before the first public key of the node sent by the receiving node.
When the data to be evaluated is encrypted according to the first public key of the node to obtain encrypted data, the evaluation requester can encrypt the data to be evaluated and the second public key of the evaluation requester according to the first public key of the node to obtain encrypted data.
S202: and sending the encrypted data to the node so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and performs risk assessment on the data to be assessed, which is obtained after decryption, to obtain an assessment result.
The method comprises the steps that encrypted data of an evaluation requester are sent to a node, so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, risk evaluation is conducted on the data to be evaluated obtained after decryption, and an evaluation result is obtained.
S204: and receiving an evaluation result sent by the node.
The evaluation request party receives the evaluation result sent by the node, specifically, the encrypted evaluation result sent by the node is received, and then the encrypted evaluation result is decrypted according to the second private key stored by the evaluation request party, so that the evaluation result is obtained. The encrypted evaluation result is obtained by encrypting the evaluation result by the node through the second public key.
According to the method, the evaluation requesting party determines the data to be evaluated, encrypts the data to be evaluated according to the first public key of the node, sends the encrypted data obtained by encryption to the node, receives the evaluation result sent by the node, and sends the encrypted data to the node after encrypting the data to be evaluated, so that the risk of leakage of the data to be evaluated can be reduced, and the privacy in the data can be better protected.
Before the first public key of the node sent by the receiving node in the step S200, the evaluation request sends a remote attestation request to the node, so that the node receives the remote attestation request of the evaluation requester for evaluating the requester, sends an attestation report and the first public key to the evaluation requester, verifies the received attestation report by the evaluation requester, and encrypts the data to be evaluated by using the received first public key after the verification is passed, so as to obtain encrypted data.
In the step S200, the evaluation requester may further determine the data to be evaluated, receive the first public key of the node sent by the dispatcher, and encrypt the data to be evaluated according to the first public key. In the above process, the determining of the data to be evaluated and the receiving of the first public key of the node sent by the scheduler have no sequence, and may be performed before the determining of the data to be evaluated is not yet performed, or may be performed before the receiving of the first public key of the node sent by the scheduler. Correspondingly, in the step S202, the evaluation requester may send the encrypted data to the dispatcher, so that the dispatcher may send the received encrypted data to the node, and the node decrypts the encrypted data in the trusted execution environment of the node according to the first private key stored in the node, and performs risk evaluation on the data to be evaluated obtained after decryption, to obtain an evaluation result. In the above step S204, the evaluation requester may receive the evaluation result sent by the scheduler, where the evaluation result is sent by the node to the scheduler.
In the step S200, the data to be evaluated is encrypted according to the first public key of the node, and when the encrypted data is obtained, the evaluation requester may encrypt the data to be evaluated and the evaluation policy of the evaluation requester according to the first public key of the node, so as to obtain encrypted data. The evaluation requester may encrypt the data to be evaluated, the evaluation policy of the evaluation requester, and the second public key according to the first public key of the node, to obtain encrypted data.
In the step S100, the node receives encrypted data sent by the scheduler, where the encrypted data is encrypted data of the evaluation requester bound to the node, and in the step S106, the node may send the encrypted evaluation result to the scheduler, so that the scheduler sends the received encrypted evaluation result to the evaluation requester, where the evaluation requester is the evaluation requester bound to the node. Correspondingly, in the steps S200 to S204, the dispatcher also sends the first public key and the evaluation result to the evaluation requester bound to the node according to the binding relationship between the node and the evaluation requester, and sends the encrypted data to the node bound to the evaluation requester. A specific data transmission process among a scheduler, a node and an evaluation requester is shown in fig. 3, fig. 3 is a schematic diagram of a data transmission process provided in the present specification, and the node in fig. 3 has a binding relationship with the evaluation requester. The preset rule may be binding the node with the evaluation requester according to a predictive model pre-stored in the node, or binding the node with the evaluation requester according to any rule, which is not specifically limited in this specification.
Because there may be multiple nodes in the distributed system, when determining the binding relationship between the nodes and the evaluation requesters, the dispatcher may be in one-to-one correspondence, or may be in one-to-many binding relationship, that is, one node may bind with one evaluation requester, or one node may bind with multiple evaluation requesters, or one evaluation requester may bind with multiple nodes.
The dispatcher in the present specification may be a server, or may be a device such as a mobile phone, a personal computer (Personal Computer, PC) or the like capable of executing the aspects of the present specification, and the present specification is not particularly limited.
After the evaluation requester in the specification obtains the evaluation result, the user corresponding to the data to be evaluated may be limited according to the evaluation result, specifically, when the evaluation result is that the data to be evaluated is risk data, the evaluation requester determines that the data to be evaluated corresponds to the user, and limits the user according to a preset management and control rule, for example, the transaction behavior of the user may be limited according to the preset management and control rule. However, when the evaluation result is that the data to be evaluated is not risk data, the evaluation requester determines the user corresponding to the data to be evaluated, and the user is not limited.
The above method for evaluating data risk provided for one or more embodiments of the present disclosure further provides a corresponding apparatus for evaluating data risk based on the same concept, as shown in fig. 4.
Fig. 4 is a schematic diagram of an apparatus for data risk assessment provided in the present specification, which specifically includes:
the receiving module 300 is configured to receive, by using the node, encrypted data sent by an evaluation requester, where the encrypted data is obtained by encrypting, by the evaluation requester, data to be evaluated according to a first public key of the node;
a decryption module 302, configured to decrypt the encrypted data in a trusted execution environment of the node according to a first private key stored in the node;
the evaluation module 304 is configured to perform risk evaluation on the data to be evaluated obtained after decryption in the trusted execution environment, to obtain an evaluation result;
and the encryption module 306 is configured to encrypt the evaluation result by using the second public key of the evaluation requester, and send the encrypted evaluation result to the evaluation requester.
Optionally, the evaluation module 304 is specifically configured to input the data to be evaluated obtained after decryption into a pre-stored prediction model to obtain the data feature to be evaluated; judging whether the data characteristics to be evaluated are consistent with blacklist characteristics stored by the nodes; if yes, determining the data to be evaluated as risk data.
Optionally, the encrypted data further comprises an evaluation strategy;
the evaluation module 304 is specifically configured to perform risk evaluation on the data to be evaluated according to the evaluation policy when the feature of the data to be evaluated is inconsistent with the blacklist feature stored in the node.
Optionally, the evaluation module 304 is specifically configured to obtain blacklist features stored in other nodes; and carrying out risk assessment on the data to be assessed according to the obtained blacklist features, the data features to be assessed and the assessment strategy.
Optionally, the evaluation module 304 is specifically configured to determine a similarity between the data feature to be evaluated and the obtained blacklist feature; and judging whether the similarity is larger than a threshold value contained in the evaluation strategy, if so, determining that the data to be evaluated is risk data, otherwise, determining that the data to be evaluated is not risk data.
Optionally, after the evaluation module 304 determines that the data to be evaluated is risk data, the apparatus further includes:
and the forwarding module 308 is configured to send the data feature to be evaluated to other nodes, so that the other nodes store the received data feature to be evaluated as a blacklist feature.
Optionally, the apparatus further comprises:
a deployment model module 310, configured to receive the encrypted prediction model sent by the dispatcher; and in the trusted execution environment, decrypting the encrypted prediction model according to the first private key stored in the node to obtain the prediction model.
Optionally, the deployment model module 310 is further configured to receive a remote attestation request sent by the dispatcher before receiving the encrypted prediction model sent by the dispatcher; and sending a proving report and a first public key to the dispatching party so that the dispatching party verifies the proving report, encrypting a pre-trained prediction model by adopting the first public key after verification is passed, and sending the encrypted prediction model to the node.
Optionally, the encrypted data further includes the second public key;
the encryption module 306 is specifically configured to decrypt the encrypted data in the trusted execution environment of the node according to the first private key, obtain the second public key, and encrypt the evaluation result with the second public key.
The present disclosure also provides an apparatus for data risk assessment, as shown in fig. 5.
Fig. 5 is a schematic diagram of another apparatus for risk assessment of data provided in the present specification, specifically including:
The determining module 400 is configured to determine data to be evaluated, and encrypt the data to be evaluated according to a first public key of a node to obtain encrypted data;
a sending module 402, configured to send the encrypted data to the node, so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and performs risk assessment on data to be assessed obtained after decryption, to obtain an assessment result;
and a result module 404, configured to receive the evaluation result sent by the node.
Optionally, the determining module 400 is specifically configured to receive a first public key of a node sent by a dispatcher; and encrypting the data to be evaluated according to the first public key.
Optionally, the determining module 400 is specifically configured to encrypt, according to the first public key of the node, the data to be evaluated and the second public key of the evaluation requester to obtain encrypted data;
the result module 404 is specifically configured to receive an encrypted evaluation result sent by the node, where the encrypted evaluation result is obtained by encrypting the evaluation result by the node using the second public key; and decrypting the encrypted evaluation result according to the second private key stored by the evaluation requester to obtain the evaluation result.
The present specification also provides a computer readable storage medium storing a computer program operable to perform the method of data risk assessment shown in fig. 1 described above.
The present specification also provides a schematic structural diagram of the electronic device shown in fig. 6. At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile storage, as illustrated in fig. 6, although other hardware required by other services may be included. The processor reads the corresponding computer program from the nonvolatile memory into the memory and then runs the computer program to implement the data risk assessment method shown in fig. 1.
Of course, other implementations, such as logic devices or combinations of hardware and software, are not excluded from the present description, that is, the execution subject of the following processing flows is not limited to each logic unit, but may be hardware or logic devices.
In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (Field Programmable Gate Array, FPGA)) is an integrated circuit whose logic function is determined by the programming of the device by a user. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented by using "logic compiler" software, which is similar to the software compiler used in program development and writing, and the original code before the compiling is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), but not just one of the hdds, but a plurality of kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), lava, lola, myHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog are currently most commonly used. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.
The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic controllers, and embedded microcontrollers, examples of which include, but are not limited to, the following microcontrollers: ARC625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.
The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation is a computer. In particular, the computer may be, for example, a personal computer, a laptop computer, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
For convenience of description, the above devices are described as being functionally divided into various units, respectively. Of course, the functions of each element may be implemented in one or more software and/or hardware elements when implemented in the present specification.
It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises the element.
It will be appreciated by those skilled in the art that embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the present specification may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present description can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
The description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
In this specification, each embodiment is described in a progressive manner, and identical and similar parts of each embodiment are all referred to each other, and each embodiment mainly describes differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, as relevant to see a section of the description of method embodiments.
The foregoing is merely exemplary of the present disclosure and is not intended to limit the disclosure. Various modifications and alterations to this specification will become apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present description, are intended to be included within the scope of the claims of the present description.
Claims (16)
1. A method of data risk assessment, the method being applied to a node, the method comprising:
the node receives encrypted data sent by an evaluation requester, wherein the encrypted data is obtained by the evaluation requester by encrypting the data to be evaluated according to a first public key of the node;
decrypting the encrypted data in a trusted execution environment of the node according to a first private key stored in the node;
In the trusted execution environment, performing risk assessment on the data to be assessed obtained after decryption to obtain an assessment result;
and encrypting the evaluation result by adopting the second public key of the evaluation requester, and sending the encrypted evaluation result to the evaluation requester.
2. The method of claim 1, wherein the risk assessment is performed on the data to be assessed obtained after decryption to obtain an assessment result, and specifically comprises:
inputting the decrypted data to be evaluated into a pre-stored prediction model to obtain the characteristics of the data to be evaluated;
judging whether the data characteristics to be evaluated are consistent with blacklist characteristics stored by the nodes;
if yes, determining the data to be evaluated as risk data.
3. The method of claim 2, further comprising evaluating a policy in the encrypted data;
when the data characteristic to be evaluated is inconsistent with the blacklist characteristic stored by the node, the method further comprises:
and carrying out risk assessment on the data to be assessed according to the assessment strategy.
4. A method according to claim 3, wherein the risk assessment is performed on the data to be assessed according to the assessment policy, specifically comprising:
Obtaining blacklist characteristics stored by other nodes;
and carrying out risk assessment on the data to be assessed according to the obtained blacklist features, the data features to be assessed and the assessment strategy.
5. The method of claim 4, wherein the risk assessment is performed on the data to be assessed according to the obtained blacklist feature, the data feature to be assessed and the assessment policy, and specifically comprises:
determining the similarity between the data features to be evaluated and the obtained blacklist features;
and judging whether the similarity is larger than a threshold value contained in the evaluation strategy, if so, determining that the data to be evaluated is risk data, otherwise, determining that the data to be evaluated is not risk data.
6. The method of claim 2, after determining that the data to be evaluated is risk data, the method further comprising:
and sending the data characteristics to be evaluated to other nodes so that the other nodes store the received data characteristics to be evaluated as blacklist characteristics.
7. The method of claim 2, wherein the predictive model is pre-stored, and specifically comprises:
receiving an encrypted prediction model sent by a dispatcher;
And in the trusted execution environment, decrypting the encrypted prediction model according to the first private key stored in the node to obtain the prediction model.
8. The method of claim 7, prior to receiving the encrypted predictive model sent by the dispatcher, the method further comprising:
receiving a remote attestation request sent by a dispatcher;
and sending a proving report and a first public key to the dispatching party so that the dispatching party verifies the proving report, encrypting a pre-trained prediction model by adopting the first public key after verification is passed, and sending the encrypted prediction model to the node.
9. The method of claim 1, further comprising the second public key in the encrypted data;
encrypting the evaluation result by adopting a second public key of the evaluation requester, wherein the method specifically comprises the following steps:
and decrypting the encrypted data in the trusted execution environment of the node according to the first private key to obtain the second public key, and encrypting the evaluation result by adopting the second public key.
10. A method of data risk assessment, the method being applied to an assessment requester, the method comprising:
determining data to be evaluated, and encrypting the data to be evaluated according to a first public key of a node to obtain encrypted data;
The encrypted data is sent to the node, so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and risk assessment is carried out on the data to be assessed, which is obtained after decryption, to obtain an assessment result;
and receiving an evaluation result sent by the node.
11. The method according to claim 10, wherein encrypting the data to be evaluated according to the first public key of the node specifically comprises:
receiving a first public key of a node sent by a dispatcher;
and encrypting the data to be evaluated according to the first public key.
12. The method of claim 10, wherein the encrypting the data to be evaluated according to the first public key of the node to obtain encrypted data specifically comprises:
encrypting the data to be evaluated and the second public key of the evaluation requester according to the first public key of the node to obtain encrypted data;
receiving an evaluation result sent by the node, which specifically comprises the following steps:
receiving an encrypted evaluation result sent by the node, wherein the encrypted evaluation result is obtained by encrypting the evaluation result by the node by adopting the second public key;
And decrypting the encrypted evaluation result according to the second private key stored by the evaluation requester to obtain the evaluation result.
13. An apparatus for data risk assessment, the apparatus being applied to a node, the apparatus comprising:
the receiving module is used for receiving the encrypted data sent by the evaluation requester by the node, wherein the encrypted data is obtained by encrypting the data to be evaluated by the evaluation requester according to the first public key of the node;
the decryption module is used for decrypting the encrypted data in the trusted execution environment of the node according to the first private key stored in the node;
the evaluation module is used for performing risk evaluation on the data to be evaluated obtained after decryption in the trusted execution environment to obtain an evaluation result;
and the encryption module is used for encrypting the evaluation result by adopting the second public key of the evaluation requester and sending the encrypted evaluation result to the evaluation requester.
14. An apparatus for data risk assessment, the apparatus being applied to an assessment requester, the apparatus comprising:
the determining module is used for determining the data to be evaluated, encrypting the data to be evaluated according to the first public key of the node and obtaining encrypted data;
The sending module is used for sending the encrypted data to the node so that the node decrypts the encrypted data in a trusted execution environment of the node according to a first private key stored in the node, and performs risk assessment on the data to be assessed, which is obtained after decryption, to obtain an assessment result;
and the result module is used for receiving the evaluation result sent by the node.
15. A computer readable storage medium storing a computer program which, when executed by a processor, implements the method of any one of the preceding claims 1 to 12.
16. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of any of the preceding claims 1-12 when the program is executed.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310090702.2A CN116050847A (en) | 2023-01-17 | 2023-01-17 | Data risk assessment method and device, storage medium and electronic equipment |
| PCT/CN2023/137840 WO2024152798A1 (en) | 2023-01-17 | 2023-12-11 | Data risk assessment method and apparatus, storage medium, and electronic device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310090702.2A CN116050847A (en) | 2023-01-17 | 2023-01-17 | Data risk assessment method and device, storage medium and electronic equipment |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116050847A true CN116050847A (en) | 2023-05-02 |
Family
ID=86119879
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310090702.2A Pending CN116050847A (en) | 2023-01-17 | 2023-01-17 | Data risk assessment method and device, storage medium and electronic equipment |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN116050847A (en) |
| WO (1) | WO2024152798A1 (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2024152798A1 (en) * | 2023-01-17 | 2024-07-25 | 支付宝(杭州)信息技术有限公司 | Data risk assessment method and apparatus, storage medium, and electronic device |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP3770779A1 (en) * | 2019-07-24 | 2021-01-27 | Christian Hieronimi | Computer-implemented methods for handling requests by using a distributed ledger database |
| CN112163757B (en) * | 2020-09-24 | 2023-09-22 | 福建省星云大数据应用服务有限公司 | Enterprise risk assessment method and system |
| CN112699353B (en) * | 2021-03-25 | 2022-04-29 | 北京瑞莱智慧科技有限公司 | Financial information transmission method and financial information transmission system |
| CN114971841A (en) * | 2022-04-11 | 2022-08-30 | 中国工商银行股份有限公司 | Risk management method, risk model training method, device, equipment and medium |
| CN116050847A (en) * | 2023-01-17 | 2023-05-02 | 支付宝(杭州)信息技术有限公司 | Data risk assessment method and device, storage medium and electronic equipment |
-
2023
- 2023-01-17 CN CN202310090702.2A patent/CN116050847A/en active Pending
- 2023-12-11 WO PCT/CN2023/137840 patent/WO2024152798A1/en unknown
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2024152798A1 (en) * | 2023-01-17 | 2024-07-25 | 支付宝(杭州)信息技术有限公司 | Data risk assessment method and apparatus, storage medium, and electronic device |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2024152798A1 (en) | 2024-07-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110222531B (en) | Method, system and equipment for accessing database | |
| CN106997439B (en) | TrustZone-based data encryption and decryption method and device and terminal equipment | |
| CN112714117B (en) | Service processing method, device, equipment and system | |
| CN116340955A (en) | Data processing method, device and equipment based on block chain | |
| CN113704826A (en) | Privacy protection-based business risk detection method, device and equipment | |
| CN111190974B (en) | Method, device and equipment for forwarding and acquiring verifiable statement | |
| CN112182506A (en) | Data compliance detection method, device and equipment | |
| WO2024152798A1 (en) | Data risk assessment method and apparatus, storage medium, and electronic device | |
| CN111737304A (en) | Processing method, device and equipment of block chain data | |
| CN113807856B (en) | Resource transfer method, device and equipment | |
| CN112182509A (en) | Method, device and equipment for detecting abnormity of compliance data | |
| CN111600882A (en) | Block chain-based account password management method and device and electronic equipment | |
| CN114553516B (en) | Data processing method, device and equipment | |
| CN110866274A (en) | Data fusion method, data fusion platform, data fusion system and data processing platform | |
| CN117131541A (en) | Data processing method and computing device for privacy protection | |
| CN117033442A (en) | Data aggregation method and device, storage medium and electronic equipment | |
| CN110995447B (en) | Data storage method, device, equipment and medium | |
| CN115550071B (en) | Data processing method, device, storage medium and equipment | |
| CN114553428B (en) | Trusted verification system, trusted verification device, trusted verification storage medium and electronic equipment | |
| CN114301606B (en) | Unmanned equipment key management system, method, device, equipment and storage medium | |
| CN117725572B (en) | SDK integrity checking method, device, medium and equipment | |
| CN117956447B (en) | Privacy information protection method, system and storage medium in Internet of vehicles | |
| CN115766115B (en) | Identity verification method and device, storage medium and electronic equipment | |
| CN118611927A (en) | Data transmission method and device, storage medium and electronic equipment | |
| CN117094014A (en) | Service processing method and device, storage medium and electronic equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |