CN117807560B - Safe fusion method, system and storage medium of privacy data - Google Patents
Safe fusion method, system and storage medium of privacy data Download PDFInfo
- Publication number
- CN117807560B CN117807560B CN202410232345.3A CN202410232345A CN117807560B CN 117807560 B CN117807560 B CN 117807560B CN 202410232345 A CN202410232345 A CN 202410232345A CN 117807560 B CN117807560 B CN 117807560B
- Authority
- CN
- China
- Prior art keywords
- data
- fusion
- calling
- module
- authority level
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000007500 overflow downdraw method Methods 0.000 title claims abstract description 15
- 230000004927 fusion Effects 0.000 claims abstract description 170
- 238000012795 verification Methods 0.000 claims abstract description 38
- 238000000605 extraction Methods 0.000 claims description 26
- 238000004364 calculation method Methods 0.000 claims description 18
- 238000000034 method Methods 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 3
- 238000012545 processing Methods 0.000 abstract description 3
- 238000007499 fusion processing Methods 0.000 description 6
- 238000013507 mapping Methods 0.000 description 5
- 238000005265 energy consumption Methods 0.000 description 4
- 239000000284 extract Substances 0.000 description 4
- 238000004422 calculation algorithm Methods 0.000 description 2
- 238000006243 chemical reaction Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000010365 information processing Effects 0.000 description 2
- 239000002699 waste material Substances 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000013473 artificial intelligence Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000013480 data collection Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000003786 synthesis reaction Methods 0.000 description 1
Landscapes
- Storage Device Security (AREA)
Abstract
The invention relates to a safe fusion method, a system and a storage medium of privacy data, which relate to the technical field of data processing, wherein the safe fusion method of the privacy data comprises a data acquisition step, a first fusion step, a q-th fusion step, a data updating step, a label judging step, a label updating step, a calling step, an integrity verification step, a calling control step and an encryption step; the security fusion system of the privacy data comprises a sending end, a receiving end and a fusion terminal. The invention can improve the utilization rate of the storage space, reduce the probability of private data leakage and improve the safety of data fusion.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a method, a system, and a storage medium for secure fusion of private data.
Background
The data fusion is a comprehensive information processing technology, and relates to the fields of system theory, information theory, artificial intelligence, computer communication and the like. The data fusion refers to the information processing performed by analyzing and integrating a plurality of obtained information under a certain criterion by using a computer to complete decision making and evaluation tasks. In the process of data collection, a large amount of redundant information is generated, the data fusion result is the reduction of the data volume, and the data is more in line with the requirements of decision making and analysis through redundant processing and information synthesis.
At present, the publication date is 2019, 09 and 13, and the Chinese patent of the invention with publication number of CN106529323B proposes a multi-level security model access control data fusion method, which comprises the following steps: converting the original lattice into Hasse drawings and merging; mapping function conversion is carried out on the data source; the access control matrices are combined. According to the method, the grids are converted into Hasse through the combination of the grids, the conversion of the mapping function and the combination of the access matrixes, when the access right is judged, the safety grade mapping function on the original grids can be converted into the safety grade mapping function of the combined grids according to the partial order relation judgment on the combined Hasse graph, the data set and the user information data are combined, the access matrixes in the access strategy are combined with the user and the data set of the two original access matrixes, and when the data source modifies the access strategy, the mapping relation of the user or the data set is modified, and the combination process is not re-established.
According to the technical scheme, privacy data transmitted among institutions have different authority levels, but the same privacy data is generally contained among different authority levels as basic data, when data fusion is carried out, the original data is generally directly fused according to the authority levels, so that redundancy of a large amount of data is caused, and along with the fusion, the feature labels and the data content of the privacy data of different authority levels after fusion tend to be consistent, so that the waste of storage space is caused, and the utilization rate of the storage space is reduced.
Disclosure of Invention
In order to improve the utilization rate of a storage space, the invention provides a safe fusion method, a system and a storage medium of private data.
In a first aspect, the present invention provides a method for secure fusion of private data, which adopts the following technical scheme:
A safe fusion method of privacy data comprises the following steps:
Acquiring data: the method comprises the steps that a sending end sends ith original data I to a receiving end, and the authority level of the I required by the sending end is N;
the receiving end receives the original data I, the storage data of the receiving end is Z, the storage data comprises M authority level data, and the M-th authority level data is a set ；
First fusion: extracting stored data of authority level m=1Let/>Will/>Corresponding raw data and/>Data fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>RecordingCorresponding stored data is/>；
Fusion at q th: extracting stored data of authority level m=qQ is more than or equal to 2, letWill/>Corresponding raw data and/>Data fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>Record/>Corresponding stored data is/>Execution ends after q=n;
Updating data: when q=n, let Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>The corresponding stored data is；
Calling: when personnel with authority level q needs to call the original data I, callingCorresponding stored data.
By adopting the technical scheme, the same privacy data are generally contained among different authority levels of different institutions as basic data, the privacy data transmitted by the transmitting end and the storage data of the receiving end are sequentially subjected to data fusion according to different authority levels, and the repeated data are intersected, so that the repeated storage of the data is reduced, the feature labels and the data contents of the privacy data of the different authority levels after fusion are not consistent any more along with the fusion, the utilization rate of the storage space can be improved, and meanwhile, the probability that the sensitive privacy data are directly fused into the storage data of lower security level is reduced, so that the probability of leakage of the privacy data is reduced, and the security of data fusion is improved.
Optionally, a label judging step and a label updating step are further arranged between the data updating step and the calling step;
and (3) label judgment: in the step of updating the judgment data Whether the set is an empty set or not, if not, executing a label updating step;
Label updating: will be Data tag set/>Data tag set added to jth original data/>Wherein j < i.
By adopting the technical scheme, when personnel with authority level q invokes the jth original data J fused before the ith original data, the recorded data tag set during J fusion is extractedAnd pair/>Updating, i.e.For the corresponding/>Updating, i.e. pre-update/>Comprises/>And/>Difference set, updatedComprises/>And/>Difference set of/>Corresponding storage data/>Thus, callAfter the corresponding data are stored, the presented data are the original data J, and part of the original data of the I can not be called, so that the safety of privacy data fusion is improved, the normal calling of the fused data can not be influenced by the fusion of the next data, and the convenience and reliability of data use are improved.
Optionally, an integrity verification step is further provided after the calling step;
Integrity verification: will be Performing hash calculation on stored data before data fusion, wherein q is less than N, and obtaining a hash valueWill/>And/>Stored data/>, after data fusionPerforming hash calculation to obtain a hash value/>Will/>And/>And comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
By adopting the technical scheme, after data fusion is completed, hash calculation is carried out on the storage data with the security level of q, q is smaller than N, and the same hash value cannot correspond to different storage data under the same algorithm due to the irreversibility of the hash calculation, so that the method has the advantages thatHash value before fusion/>Hash value after fusion/>If the data are inconsistent, the situation that fusion failure occurs in the data fusion process is indicated, the received original data or the fused stored data are possibly tampered, and the integrity verification of the data is not passed, a verification record is generated and sent to a person with authority level M, and whether the fusion is normal or not is judged.
Optionally, a calling control step is further arranged after the calling step;
Calling control: when a person with authority level q calls the original data I, a call record is generated, whether the time T and the time C of calling the original data I by the person with authority level q meet the specified time dT and the specified time dC or not is judged, if yes, the file is normally used, if not, the authority of the person is closed, the call record is sent to the person with authority level M, and whether the person with authority level M is legal call or not is judged according to the call record.
By adopting the technical scheme, when the personnel with the authority level q calls the original data I, a call record is generated, when the time T or the time C of calling the I simultaneously meets the specified time dT and the specified time dC, the file is normally used, if the time D or the time dC exceeds the specified time dT or the time dC, the authority of the personnel is closed, the call record is sent to the personnel with the authority level M, and whether the personnel with the authority level M is legal call is judged according to the call record, so that the call authority of the user is standardized and limited, and the risk of privacy data leakage is reduced.
Optionally, an encryption step is further arranged after the calling step;
encryption: the transmitting end transmits the shared secret key to the receiving end, and when q is less than N, the receiving end updates the data Encryption is carried out by using a private key, and when q=N, the receiving end updates the data/>The encryption is performed simultaneously using the private key and the shared key.
By adopting the technical scheme, the sending end sends the shared secret key to the receiving end, and when q is less than N, the receiving end does not use the shared secret key pair after fusionEncryption is carried out by only using the private key of the receiving end, so that the operation energy consumption of the system is reduced, energy is saved, and when q=N, the receiving end uses the shared key and the private key pair/>And double encryption is carried out, so that the risk of privacy data disclosure is further reduced, and the security of data fusion is improved.
In a second aspect, the present invention provides a secure fusion system for private data, which adopts the following technical scheme:
a security fusion system of private data comprises a sending end, a receiving end and a fusion terminal;
And the transmitting end: the system comprises a receiving end, an output end and a receiving end, wherein the receiving end is used for receiving the I-th original data I, the authority level of the I required by the receiving end is N, and the output end is connected with the input end of the receiving end;
The receiving end: the input end is connected with the output end of the transmitting end, the output end is connected with the input end of the fusion terminal and is used for receiving the original data I transmitted by the transmitting end, and the data Z containing M authority levels is stored, wherein the data of the mth authority level is a set ；
And (3) fusing the terminal: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the using terminal of the person with authority and used for carrying out data fusion on the original data and the stored data, and the fusion terminal comprises a fusion module, a label extraction module, a data updating module and a calling module;
And a fusion module: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the tag extraction module, and the tag extraction module is used for extracting the stored data of the authority level m=q Let/>Will/>Corresponding raw data and/>Performing data fusion on the corresponding stored data, and ending after q=N;
the label extraction module: the input end is connected with the output end of the fusion module and is used for extracting the stored data Data tag set of/>Record/>Corresponding stored data is/>The output end is connected with the input end of the data updating module;
And a data updating module: the input end is connected with the output end of the label extraction module, the output end is connected with the input end of the calling module, and the label extraction module is used for enabling the label to be extracted when q=N Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>Corresponding stored data is/>；
And (3) a calling module: the input end is connected with the output end of the data updating module, the output end is connected with the input end of the using terminal of the personnel with authority, and the data updating module is used for calling when the personnel with the authority level q needs to call the original data ICorresponding stored data.
By adopting the technical scheme, the sending end sends the original data to the receiving end, the receiving end receives the original data and transmits the original data to the fusion terminal, the fusion module sequentially fuses the private data transmitted by the sending end and the storage data of the receiving end according to different authority levels, the repeated data are intersected, the tag extraction module extracts tag sets of difference sets of the original data and the storage data in each authority level of the data, and the data updating module extracts the tag sets of the difference sets of the original data and the storage data in each authority level of the data when q=NThe calling module calls updated/>The corresponding stored data is original data, so that repeated storage of the data is reduced, the utilization rate of a storage space is improved, meanwhile, the probability that sensitive private data is directly fused into the stored data with a lower security level is reduced, the probability of private data leakage is reduced, and the security of data fusion is improved.
Optionally, the fusion terminal further comprises an integrity verification module;
integrity verification module: the input end is connected with the output end of the fusion module, the output end is connected with the input end of the user terminal of the person with authority level M, and the user terminal is connected with the output end of the fusion module Performing hash calculation on stored data before data fusion, wherein q is smaller than N, and obtaining a hash value/>Will/>And/>Carrying out hash calculation on the storage data subjected to data fusion to obtain a hash value/>Will beAnd/>And comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
By adopting the technical scheme, after the data fusion is completed, the integrity verification module carries out hash calculation on the storage data with the security level of q, q is less than N,Hash value before fusion/>Hash value after fusion/>If the data are inconsistent, the situation that fusion failure occurs in the data fusion process is indicated, the received original data or the fused stored data are possibly tampered, and the integrity verification of the data is not passed, a verification record is generated and sent to a person with authority level M, and whether the fusion is normal or not is judged.
Optionally, the fusion terminal further comprises a calling control module;
And (3) calling a control module: the input end is connected with the output end of the calling module, the output end is connected with the input end of the using terminal of the personnel with the authority level of M, the calling record is generated and used for judging whether the time T and the times C of calling the original data I by the personnel with the authority level of q meet the specified time dT and times dC, namely T is less than or equal to dT and C is less than or equal to dC, if so, the file is normally used, if not, the authority of the personnel is closed, the calling record is sent to the personnel with the authority level of M, and whether the calling record is legal calling is judged according to the calling record.
By adopting the technical scheme, when the personnel with the authority level q calls the original data I, the calling control module generates the calling record, when the time T or the time C for calling the I meets the specified time dT and the time dC, the file is normally used, if the time D and the time dC are exceeded, the authority of the personnel is closed, the calling control module sends the calling record to the personnel with the authority level M, and whether the personnel with the authority level M is legal calling is judged according to the calling record, so that the calling authority of the user is standardized and limited, and the risk of privacy data leakage is reduced.
In a third aspect, the present invention provides a secure fusion storage medium for private data, which adopts the following technical scheme:
A secure fusion storage medium of private data, having stored thereon a computer program which, when executed by a processor, implements a secure fusion method of private data as described in the first aspect.
In summary, the present invention includes at least one of the following beneficial technical effects:
1. Through the setting of the safe fusion method of the privacy data, the privacy data transmitted by the transmitting end and the storage data of the receiving end are sequentially subjected to data fusion according to different authority levels, and the repeated data are intersected, so that repeated storage of the data is reduced, the feature labels and the data contents of the privacy data with different authority levels after fusion are not consistent any more along with the fusion, the utilization rate of the storage space can be improved, and meanwhile, the probability that the sensitive privacy data are directly fused into the storage data with lower safety levels is reduced, so that the probability of leakage of the privacy data is reduced, and the safety of data fusion is improved.
2. Through the setting of the label judging step and the label updating step, when a person with the authority level q calls the jth original data J fused before the ith original data, the person with the authority level q is matched with the jth original data JAfter the corresponding stored data is called, the presented data is the original data J, and part of the original data of the I can not be called, so that the safety of privacy data fusion is improved, the normal calling of the fused data can not be influenced by the fusion of the next data, and the convenience and reliability of data use are improved.
3. Since the same hash value cannot correspond to different stored data, thenThe hash value before fusion and the hash value after fusion are consistent, if the hash value before fusion and the hash value after fusion are inconsistent, the fusion failure is shown in the data fusion process, the received original data or the stored data after fusion is possibly tampered, the integrity verification of the data is not passed, a verification record is generated and sent to a person with authority level M, whether the fusion is normal or not is judged, the integrity of the data after the data fusion can be verified through the setting of the integrity verification step, the reliability and the safety of the data fusion process are improved, and the risk of privacy data leakage is reduced.
4. When personnel with authority level q call the original data I, a call record is generated, when the time T or the time C of calling the I meets the specified time dT and the time dC, files are normally used, if the time T and the time dC exceed the specified time dT and the time dC, the authority of the personnel is closed, the call record is sent to the personnel with authority level M, whether the personnel with authority level M is legal call or not is judged according to the call record, and the call authority of the user is standardized and limited through the setting of a call control step, so that the risk of privacy data leakage is reduced.
5. Through the setting of the encryption step, the transmitting end transmits the shared secret key to the receiving end, and when q is less than N, the receiving end does not use the shared secret key pair after fusionEncryption is carried out by only using the private key of the receiving end, so that the operation energy consumption of the system is reduced, energy is saved, and when q=N, the receiving end uses the shared key and the private key pair/>And double encryption is carried out, so that the risk of privacy data disclosure is further reduced, and the security of data fusion is improved.
Drawings
FIG. 1 is a flow chart of embodiment 1 of the present invention;
fig. 2 is a system diagram of embodiment 2 of the present invention.
Detailed Description
The invention is described in further detail below in connection with fig. 1-2.
Example 1: the embodiment discloses a secure fusion method of private data, referring to fig. 1, which comprises a data acquisition step S1, a first fusion step S2, a q-th fusion step S3, a data updating step S4, a tag judging step S5, a tag updating step S6, a calling step S7, an integrity verification step S8, a calling control step S9 and an encryption step S10.
S1: acquiring data: the method comprises the steps that a sending end sends ith original data I to a receiving end, and the authority level of the I required by the sending end is N;
the receiving end receives the original data I, the storage data of the receiving end is Z, the storage data comprises M authority level data, and the M-th authority level data is a set ；
S2: first fusion: extracting stored data of authority level m=1Let/>Will/>Corresponding raw data and/>Data fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>Record/>Corresponding stored data is/>；
S3: fusion at q th: extracting stored data of authority level m=qQ is more than or equal to 2, letWill/>Corresponding raw data and/>Data fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>Record/>Corresponding stored data is/>Execution ends after q=n;
S4: updating data: when q=n, let Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>Corresponding stored data is/>；
S5: and (3) label judgment: in the step of updating the judgment dataWhether the set is an empty set or not, if not, executing a label updating step;
s6: label updating: will be Data tag set/>Data tag set added to jth original data/>In pair/>Updating, wherein j < i;
S7: calling: when personnel with authority level q needs to call the original data I, calling Corresponding stored data;
S8: integrity verification: will be Performing hash calculation on stored data before data fusion, wherein q is smaller than N, and obtaining a hash value/>Will/>And/>Stored data/>, after data fusionPerforming hash calculation to obtain a hash value/>Will beAnd/>And comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
S9: calling control: judging whether the time T and the times C of calling the original data I by the personnel with the authority level q meet the stipulated time dT and times dC at the same time, namely T is less than or equal to dT and C is less than or equal to dC, generating a calling record, if so, normally using the file, if not, closing the authority of the personnel, sending the calling record to the personnel with the authority level M, and judging whether the personnel is legal to call according to the calling record.
S10: encryption: the transmitting end transmits the shared secret key to the receiving end, and when q is less than N, the receiving end updates the dataEncryption is carried out by using a private key, and when q=N, the receiving end updates the data/>The encryption is performed simultaneously using the private key and the shared key.
The principle of implementation of steps S1 to S7 will now be described by taking a contract as an example.
Acquiring data: assuming that the transmitting end is the first party, the receiving end is the second party, the first party transmits the original data I of the ith contract to the second party, and the first party transmits the original data I of the contract to the second party, wherein the original data I comprises the data of the following labels: contract name, contract template, contract number, contract amount, first party name, and requiring that the authority level of I be n=3, i.e. that the contract can be viewed by a person with level 3 authority;
The second party receives the original data I, the storage data of the second party contract is Z, the Z comprises data of M=3 authority levels, and the data of the mth authority level is Stored data/>, authority level m=1Data comprising the following tags: contract name, contract template, stored data/>, rights class m=2Data comprising the following tags: contract number, party name, stored data of rights class m=3/>Data comprising the following tags: contract amount, signing date, i.e. m-level authority personnel can check the stored data of the contract as/>Only M-level authority personnel can check the complete stored data of the contract；
First fusion: extracting stored data of authority level m=1I.e. contract data viewable by the first-level authority personnel, pair/>And/>Intersection is calculated, let/>I.e./>Raw data containing several tags: contract name, contract template, will/>And/>Data fusion is carried out, and the fusion result is/>Due to/>And/>The data contained are identical and therefore/>Corresponding data tag set/>/>Corresponding storage data/>Are empty sets, i.e./>，/>=0。
Second fusion: extracting stored data of authority level m=2I.e. contract data viewable by the secondary authority personnel, order/>I.e./>Raw data containing the following tags: contract numbering, will/>And/>Data fusion is carried out, and the fusion result is/>Due to/>And/>The data contained are not exactly identical, and therefore/>Corresponding data tag set/>Comprising the following tags: party B name,/>Corresponding storage data/>Data comprising the following tags: name of party b.
Third fusion: extracting stored data of authority level m=3Contract data viewable by three-level authority personnel, and/>I.e./>Raw data containing the following tags: contract amount, will/>And/>Data fusion is carried out, and the fusion result is/>Due to/>And/>The data contained are not exactly identical, and therefore/>Corresponding data tag set/>Comprising the following tags: signing date,/>Corresponding storage data/>Data comprising the following tags: signing date.
Updating data: after the third fusion is completed, letI.e./>Raw data containing the following tags: party A name, extract/>Data tag set of/>I.e./>Comprising the following tags: party name,/>Corresponding stored data is/>I.e./>Stored data comprising the following tags: a party name;
Will be Corresponding raw data is added to/>Corresponding stored data, pair/>Data updating, i.e. fusion result becomes/>Updated/>Data comprising the following tags: contract amount, signing date, first party name.
And (3) label judgment: judgingIf the set is not an empty set, a label updating step is executed;
Label updating: the original data J of the J-th contract contains the data of the following tag: contract name, contract template, contract number, signing date, j < i, stored in data The corresponding data tag set is/>At this time/>Raw data containing the following tags: contract name, contract template,/>，/>Raw data containing the following tags: contract number,/>Comprising the following tags: party B name,/>Is empty set,/>Comprising the following tags: contract amount;
Will be Data tag set/>Data tag set added to jth original data/>In, i.eUpdated/>Comprising the following tags: contract amount, party A name, pair/>Update, updated/>Data comprising the following tags: contract amount, first party name.
Calling: when a person with authority level 3 needs to call the original data I, callingCorresponding stored data, i.e., I = { (contract amount + signing date + first party name) - (signing date) } + { (contract number + second party name) - (second party name) } + { (contract name + contract template) -0} = (contract name + contract template + contract number + contract amount + first party name);
When personnel with authority level 3 needs to call the original data J, calling Corresponding data, i.e., J = { (contract amount + signing date + first party name) - (contract amount + first party name) } + { (contract number + second party name) - (second party name) } + { (contract name + contract template) -0} = (contract name + contract template + contract number + signing date).
The implementation principle of the security fusion method of the private data in the embodiment is as follows:
The same privacy data is generally contained among different authority levels of different institutions as basic data, the privacy data transmitted by a transmitting end and the storage data of a receiving end are sequentially subjected to data fusion according to different authority levels, and repeated data are subjected to intersection, so that repeated storage of the data is reduced, along with the fusion, the feature labels and the data contents of the fused privacy data of different authority levels are not consistent any more, the utilization rate of a storage space can be improved, and meanwhile, the probability that the sensitive privacy data are directly fused into the storage data of a lower security level is reduced, so that the probability of leakage of the privacy data is reduced, and the security of data fusion is improved; by recording only the stored data at the time of fusion of the ith original data Corresponding data tag set/>Extracting records at call time/>For storage data/>Calling is not carried out, onlyCorresponding data reduces the difference data volume of the original data and the stored data which need to be recorded in a large quantity when the original data I is fused, reduces the calling quantity of the data, further reduces the waste of the storage space and the operation energy consumption of the system, and improves the utilization rate of the storage space.
When personnel with authority level q calls jth original data J fused before ith original data, extracting recorded data tag set during J fusionAnd pair/>Updates are made, i.e./>For the corresponding/>Updating, i.e. pre-update/>Comprises/>And/>Difference set of (1), >, updatedComprises/>And/>Difference set of/>Corresponding storage data/>Thus, callAfter the corresponding data are stored, the presented data are the original data J, and part of the original data of the I can not be called, so that the safety of privacy data fusion is improved, the normal calling of the fused data can not be influenced by the fusion of the next data, and the convenience and reliability of data use are improved.
After data fusion is completed, hash calculation is carried out on the storage data with the security level of q, q is less than N, and the same hash value cannot correspond to different storage data under the same algorithm because the hash calculation has irreversibility, soHash value before fusion/>Hash value after fusion/>If the data are inconsistent, the situation that fusion failure occurs in the data fusion process is indicated, the received original data or the fused stored data are possibly tampered, and the integrity verification of the data is not passed, a verification record is generated and sent to a person with authority level M, and whether the fusion is normal or not is judged.
When personnel with authority level q calls the original data I, a call record is generated, when the time T or the time C of calling the I meets the specified time dT and the time dC, files are normally used, if the time T and the time dC exceed the specified time dT and the time dC, the authority of the personnel is closed, the call record is sent to the personnel with authority level M, whether the personnel with authority level M is legal call is judged according to the call record, and therefore the call authority of the user is standardized and limited, and the risk of privacy data leakage is reduced.
The transmitting end transmits the shared secret key to the receiving end, and when q is less than N, the receiving end does not use the shared secret key pair to fuseEncryption is carried out by only using the private key of the receiving end, so that the operation energy consumption of the system is reduced, energy is saved, and when q=N, the receiving end uses the shared key and the private key pair/>And double encryption is carried out, so that the risk of privacy data disclosure is further reduced, and the security of data fusion is improved.
Example 2: the embodiment discloses a secure fusion system of private data, which is applied to the secure fusion method of private data described in embodiment 1, and referring to fig. 2, the secure fusion system comprises a transmitting end, a receiving end and a fusion terminal;
And the transmitting end: the system comprises a receiving end, an output end and a receiving end, wherein the receiving end is used for receiving the I-th original data I, the authority level of the I required by the receiving end is N, and the output end is connected with the input end of the receiving end;
The receiving end: the input end is connected with the output end of the transmitting end, the output end is connected with the input end of the fusion terminal and is used for receiving the original data I transmitted by the transmitting end, and the data Z containing M authority levels is stored, wherein the data of the mth authority level is a set ；
And (3) fusing the terminal: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the using terminal of the person with authority and used for carrying out data fusion on the original data and the stored data, and the fusion terminal comprises a fusion module, a tag extraction module, a data updating module, a tag judging module, a tag updating module, a calling module, an integrity verification module and a calling control module;
And a fusion module: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the tag extraction module, and the tag extraction module is used for extracting the stored data of the authority level m=q Let/>Will/>Corresponding raw data and/>Performing data fusion on the corresponding stored data, and ending after q=N;
the label extraction module: the input end is connected with the output end of the fusion module and is used for extracting the stored data Data tag set of/>Record/>Corresponding stored data is/>The output end is connected with the input end of the data updating module;
and a data updating module: the input end is connected with the output end of the label extraction module, the output end is connected with the input end of the label judgment module, and the label extraction module is used for enabling the label to be extracted when q=N Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>The corresponding stored data is；
The label judging module: the input end is connected with the output end of the data updating module, the output end is respectively connected with the input ends of the tag updating module and the calling module, and the judgment is carried outWhether the set is an empty set or not, if yes, executing the calling module, and if not, executing the label updating module;
and a label updating module: the input end is connected with the output end of the label judging module, the output end is connected with the input end of the calling module, and the label judging module is connected with the input end of the calling module Data tag set/>Data tag set added to jth original data/>Wherein j < i.
And (3) a calling module: the input end is connected with the output end of the tag updating module, the output end is connected with the input end of the using terminal of the personnel with authority, and the tag updating module is used for calling when the personnel with the authority level q needs to call the original data ICorresponding stored data.
Integrity verification module: the input end is connected with the output end of the fusion module, the output end is connected with the input end of the user terminal of the person with authority level M, and the user terminal is connected with the output end of the fusion modulePerforming hash calculation on stored data before data fusion, wherein q is smaller than N, and obtaining a hash value/>Will/>And/>Carrying out hash calculation on the storage data subjected to data fusion to obtain a hash value/>Will beAnd/>And comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
And (3) calling a control module: the input end is connected with the output end of the calling module, the output end is connected with the input end of the using terminal of the personnel with the authority level of M, the calling record is generated and used for judging whether the time T and the times C of calling the original data I by the personnel with the authority level of q meet the specified time dT and times dC, namely T is less than or equal to dT and C is less than or equal to dC, if so, the file is normally used, if not, the authority of the personnel is closed, the calling record is sent to the personnel with the authority level of M, and whether the calling record is legal calling is judged according to the calling record.
The implementation principle of the security fusion system of private data in this embodiment is as follows:
The method comprises the steps that a sending end sends original data to a receiving end, the receiving end receives the original data and transmits the original data to a fusion terminal, a fusion module sequentially carries out data fusion on private data transmitted by the sending end and storage data of the receiving end according to different authority levels, intersection sets are obtained on repeated data, a tag extraction module extracts tag sets of difference sets of the original data and the storage data in each authority level of the data, and a data update module performs q=N The tag judgment module judges/>If the set is empty, executing a label updating module, and if the set is not empty, executing the label updating moduleData tag set/>Data tag set added to jth original data/>In the method, the calling module calls updated dataThe corresponding stored data is original data, so that repeated storage of the data is reduced, the utilization rate of a storage space is improved, meanwhile, the probability that sensitive private data is directly fused into the stored data with a lower security level is reduced, the probability of disclosure of the private data is reduced, and the security of data fusion is improved;
After the data fusion is completed, the integrity verification module carries out hash calculation on the storage data with the security level of q, q is less than N, Hash value before fusion/>Hash value after fusion/>If the data are inconsistent, the possibility that fusion failure occurs in the data fusion process is indicated, the received original data or the fused stored data are tampered, and the integrity verification of the data is not passed, a verification record is generated and sent to a person with authority level M, and whether the fusion is normal or not is judged;
When personnel with authority level q call the original data I, the call control module generates a call record, when the time T or the time C for calling the I meets the specified time dT and the time dC, files are normally used, if the time D and the time dC exceed the specified time dT and the time dC, the authority of the personnel is closed, the call control module sends the call record to the personnel with authority level M, and whether the personnel with authority level M is legal call is judged according to the call record, so that the call authority of the user is standardized and limited, and the risk of privacy data leakage is reduced.
Example 3: the present embodiment discloses a secure fusion storage medium of private data, on which a computer program is stored, which when executed by a processor, implements a secure fusion method of private data as described in embodiment 1.
The above embodiments are not intended to limit the scope of the present invention, so: all equivalent changes in structure, shape and principle of the invention should be covered in the scope of protection of the invention.
Claims (9)
1. The safe fusion method of the privacy data is characterized by comprising the following steps of:
Acquiring data: the method comprises the steps that a sending end sends ith original data I to a receiving end, and the authority level of the I required by the sending end is N;
the receiving end receives the original data I, the storage data of the receiving end is Z, the storage data comprises M authority level data, and the M-th authority level data is a set ；
First fusion: extracting stored data of authority level m=1Let/>Will/>Corresponding original data andData fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>Record/>Corresponding stored data is/>；
Fusion at q th: extracting stored data of authority level m=qQ is more than or equal to 2, letWill/>Corresponding raw data and/>Data fusion is carried out on corresponding storage data, and/>, in the storage data, is extractedData tag set of/>Record/>Corresponding stored data is/>Execution ends after q=n;
Updating data: when q=n, let Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>Corresponding stored data is/>；
Calling: when personnel with authority level q needs to call the original data I, callingCorresponding stored data.
2. The method for securely fusing private data according to claim 1, wherein a tag judgment step and a tag update step are further provided between the data update step and the calling step;
and (3) label judgment: in the step of updating the judgment data Whether the set is an empty set or not, if not, executing a label updating step;
Label updating: will be Data tag set/>Data tag set added to jth original data/>Wherein j < i.
3. The method for secure fusion of private data according to claim 1, wherein: an integrity verification step is further arranged after the calling step;
Integrity verification: will be Performing hash calculation on stored data before data fusion, wherein q is smaller than N, and obtaining a hash value/>Will/>And/>Stored data/>, after data fusionPerforming hash calculation to obtain a hash value/>Will/>And (3) withAnd comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
4. The method for securely fusing private data according to claim 1, wherein a call control step is further provided after the calling step;
Calling control: when a person with authority level q calls the original data I, a call record is generated, whether the time T and the time C of calling the original data I by the person with authority level q meet the specified time dT and the specified time dC or not is judged, if yes, the file is normally used, if not, the authority of the person is closed, the call record is sent to the person with authority level M, and whether the person with authority level M is legal call or not is judged according to the call record.
5. The method for secure fusion of private data according to claim 1, wherein: an encryption step is further arranged after the calling step;
encryption: the transmitting end transmits the shared secret key to the receiving end, and when q is less than N, the receiving end updates the data Encryption is carried out by using a private key, and when q=N, the receiving end updates the data/>The encryption is performed simultaneously using the private key and the shared key.
6. A security fusion system for private data, applying a security fusion method for private data according to any one of claims 1 to 5, characterized in that: the system comprises a sending end, a receiving end and a fusion terminal;
And the transmitting end: the system comprises a receiving end, an output end and a receiving end, wherein the receiving end is used for receiving the I-th original data I, the authority level of the I required by the receiving end is N, and the output end is connected with the input end of the receiving end;
The receiving end: the input end is connected with the output end of the transmitting end, the output end is connected with the input end of the fusion terminal and is used for receiving the original data I transmitted by the transmitting end, and the data Z containing M authority levels is stored, wherein the data of the mth authority level is a set ；
And (3) fusing the terminal: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the using terminal of the person with authority and used for carrying out data fusion on the original data and the stored data, and the fusion terminal comprises a fusion module, a label extraction module, a data updating module and a calling module;
And a fusion module: the input end is connected with the output end of the receiving end, the output end is connected with the input end of the tag extraction module, and the tag extraction module is used for extracting the stored data of the authority level m=q Let/>Will/>Corresponding raw data and/>Performing data fusion on the corresponding stored data, and ending after q=N;
the label extraction module: the input end is connected with the output end of the fusion module and is used for extracting the stored data Data tag set of/>Record/>Corresponding stored data is/>The output end is connected with the input end of the data updating module;
And a data updating module: the input end is connected with the output end of the label extraction module, the output end is connected with the input end of the calling module, and the label extraction module is used for enabling the label to be extracted when q=N Extraction/>Data tag set of/>Will/>Corresponding raw data is added to/>Corresponding stored data, pair/>Data update, recording/>Corresponding stored data is/>；
And (3) a calling module: the input end is connected with the output end of the data updating module, the output end is connected with the input end of the using terminal of the personnel with authority, and the data updating module is used for calling when the personnel with the authority level q needs to call the original data ICorresponding stored data.
7. The system for secure fusion of private data according to claim 6, wherein: the fusion terminal further comprises an integrity verification module;
integrity verification module: the input end is connected with the output end of the fusion module, the output end is connected with the input end of the user terminal of the person with authority level M, and the user terminal is connected with the output end of the fusion module Performing hash calculation on stored data before data fusion, wherein q is smaller than N, and obtaining a hash value/>Will/>And/>Carrying out hash calculation on the storage data subjected to data fusion to obtain a hash value/>Will/>And/>And comparing, if the data are consistent, the storage data after the q-th fusion are not tampered, if the data are inconsistent, the data after the fusion are possibly tampered, generating a verification record and sending the verification record to a person with the authority level M, and judging whether the data fusion is normal or not.
8. The system for secure fusion of private data according to claim 6, wherein: the fusion terminal also comprises a calling control module;
And (3) calling a control module: the input end is connected with the output end of the calling module, the output end is connected with the input end of the using terminal of the personnel with the authority level of M, the calling record is generated by judging whether the time T and the times C of calling the original data I by the personnel with the authority level of q meet the specified time dT and times dC, if yes, the file is normally used, if not, the authority of the personnel is closed, the calling record is sent to the personnel with the authority level of M, and whether the personnel with the authority level of M is legally called is judged according to the calling record.
9. A secure converged storage medium for private data, characterized by: a computer program stored thereon, which, when executed by a processor, implements a method of secure fusion of private data according to any of claims 1-5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410232345.3A CN117807560B (en) | 2024-03-01 | 2024-03-01 | Safe fusion method, system and storage medium of privacy data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410232345.3A CN117807560B (en) | 2024-03-01 | 2024-03-01 | Safe fusion method, system and storage medium of privacy data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117807560A CN117807560A (en) | 2024-04-02 |
| CN117807560B true CN117807560B (en) | 2024-04-30 |
Family
ID=90433837
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410232345.3A Active CN117807560B (en) | 2024-03-01 | 2024-03-01 | Safe fusion method, system and storage medium of privacy data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117807560B (en) |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113468601A (en) * | 2021-06-30 | 2021-10-01 | 建信金融科技有限责任公司 | Data privacy fusion method and device |
| WO2023272747A1 (en) * | 2021-06-29 | 2023-01-05 | 南京大学 | Scientific research data security protection system based on cloud fusion and working method thereof |
-
2024
- 2024-03-01 CN CN202410232345.3A patent/CN117807560B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2023272747A1 (en) * | 2021-06-29 | 2023-01-05 | 南京大学 | Scientific research data security protection system based on cloud fusion and working method thereof |
| CN113468601A (en) * | 2021-06-30 | 2021-10-01 | 建信金融科技有限责任公司 | Data privacy fusion method and device |
Non-Patent Citations (1)
| Title |
|---|
| 黄娟 ; 王军号 ; 杜朋 ; .数据融合中隐私保护完整性验证算法研究.计算机技术与发展.2018,(08),全文. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117807560A (en) | 2024-04-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112016279B (en) | Method, device, computer equipment and storage medium for structuring electronic medical record | |
| Kabulov et al. | Using algorithmic modeling to control user access based on functioning table | |
| EP3739493B1 (en) | File verification method, file verification system and file verification server | |
| CN109815051A (en) | The data processing method and system of block chain | |
| CN112036172B (en) | Entity identification method and device based on abbreviated data of model and computer equipment | |
| CN112150266A (en) | Design principle of intelligent contract prediction machine | |
| CN112989018A (en) | File automatic open identification method and system based on semantic analysis | |
| CN107092478A (en) | The integrated system and method for a kind of software component library and component development instrument | |
| CN117807560B (en) | Safe fusion method, system and storage medium of privacy data | |
| CN116522197A (en) | Identity authentication and access control system based on security management | |
| CN111552822A (en) | User information report generation method based on block chain node communication | |
| CN112650659B (en) | Buried point setting method and device, computer equipment and storage medium | |
| CN112036151A (en) | Method and device for constructing gene disease relation knowledge base and computer equipment | |
| CN116887264A (en) | Shared satellite-oriented on-board multi-user access control method, device and equipment | |
| CN113988862B (en) | Safety early warning system and safety early warning method for block chain data chaining method | |
| CN114360129A (en) | Access control management method, system and equipment, and storage medium | |
| CN112966787B (en) | Method, device, computer equipment and storage medium for identifying similar patients | |
| CN113591162A (en) | Block chain evidence storing method and device and computer equipment | |
| CN111611459A (en) | File data protection method based on block chain | |
| CN112651824A (en) | Non-silver account opening processing method and device, computer equipment and storage medium | |
| CN111708996A (en) | Enterprise internal management consultation information sharing system based on Internet | |
| CN111563269A (en) | Sensitive data security protection method and system based on shadow system | |
| CN116737854B (en) | Space-time data lake management system based on multi-source remote sensing data and safety protection method thereof | |
| CN117952634B (en) | Power industry source end carbon data credible rating method and system | |
| CN112363705B (en) | System package generation method, device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |