WO2022217714A1

WO2022217714A1 - Data collision method, apparatus and device, and computer-readable storage medium

Info

Publication number: WO2022217714A1
Application number: PCT/CN2021/097417
Authority: WO
Inventors: 李震川; 孔维罡; 翁志
Original assignee: 平安科技（深圳）有限公司
Priority date: 2021-04-16
Filing date: 2021-05-31
Publication date: 2022-10-20
Also published as: CN112953974B; CN112953974A

Abstract

The present application relates to the field of security protection, and provides a data collision method, apparatus and device, and a computer-readable storage medium. The method comprises: acquiring second ciphertext data and first keys of a plurality of participants, wherein different participants have different first keys; according to a second encryption algorithm and the respective first keys corresponding to the participants, decrypting the respective corresponding second ciphertext data to obtain first ciphertext data of the plurality of participants; and determining an intersection set of the first ciphertext data of the plurality of participants, and sending the intersection set to the participants. By means of the present application, the problem of realizing the collision of sensitive data insofar as the sensitive data is not leaked is solved. The present application further relates to the field of blockchains, and the computer-readable storage medium can store data, which is created according to the use of a blockchain node.

Description

Data collision method, apparatus, device, and computer-readable storage medium

This application claims the priority of the Chinese patent application filed on April 16, 2021 with the application number 202110414455.8 and the invention titled "Data Collision Method, Apparatus, Equipment and Computer-readable Storage Medium", the entire contents of which are approved by Reference is incorporated in this application.

technical field

The present application relates to the field of security protection, and in particular, to a data collision method, apparatus, device, and computer-readable storage medium.

Background technique

With the deepening of networking and digitization, a large amount of data involving personal privacy, property information, and behavioral trajectories are stored and transmitted on the Internet. The importance of protecting data security is self-evident. For enterprises, it is mainly to encrypt and protect sensitive data such as trade secrets and user information. When conducting a business cooperation with other enterprises, the use of this part of data can generate great business value, but due to the protection of sensitive data For this purpose, this part of the data often cannot be transmitted to the other party in clear text. When some services require sensitive data from both parties for data collision, this part of the business function cannot be realized.

At present, the data is mainly encrypted based on the commonly used encryption algorithm and then transmitted in ciphertext, but both parties can obtain the ciphertext by selecting the same encryption algorithm for data collision, but the inventor found that either party can establish the ciphertext and plaintext The mapping relationship is used to deduce the information transmitted by the other party, which causes the problem of data leakage. Therefore, how to realize the collision of sensitive data without revealing sensitive data is an urgent problem to be solved at present.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a data collision method, apparatus, device, and computer-readable storage medium, which aim to realize the collision of sensitive data on the premise of not leaking sensitive data.

In a first aspect, an embodiment of the present application provides a data collision method, including:

Obtain the second ciphertext data and the first key of multiple participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and according to the second encryption algorithm and the The first key encrypts the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first keys of different participants are different;

Decrypt the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first ciphertext data of the plurality of participating parties;

determining an intersection of the first ciphertext data of the plurality of parties, and sending the intersection to each of the parties, wherein the parties are based on the second encryption algorithm and the first key pair The intersection is encrypted, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the plaintext of the mapping relationship between the second ciphertext data and the plaintext of the sensitive data. The corresponding sensitive data plaintext is obtained from the plaintext of the mapping relationship.

In a second aspect, an embodiment of the present application further provides a data collision method, including:

Obtaining plaintext of sensitive data, a first key and a second key, where the first key is different from the second key;

Encrypting the sensitive data plaintext according to the first encryption algorithm to obtain first ciphertext data;

Encrypting the first ciphertext data according to a second encryption algorithm and the first key to obtain second ciphertext data, where the first encryption algorithm is different from the second encryption algorithm;

Encrypt the mapping relationship between the sensitive data plaintext and the second ciphertext data according to the third encryption algorithm and the second key to obtain mapping relationship ciphertext data;

Send the second ciphertext data and the first key to the data collision device, so that the data collision device can compare the corresponding first key according to the second encryption algorithm and the first key of each participant. Decrypt the two ciphertext data to obtain the first ciphertext data of the multiple participants, and determine the intersection of the first ciphertext data of the multiple participants;

acquiring the intersection sent by the data collision device, and encrypting the intersection according to the second encryption algorithm and the first key;

Decrypt the mapping relationship ciphertext data according to the third encryption algorithm and the second key to obtain the mapping relationship plaintext between the sensitive data plaintext and the second ciphertext data;

According to the encrypted intersection, the corresponding sensitive data plaintext is obtained from the mapping relationship plaintext.

In a third aspect, an embodiment of the present application further provides a data collision device, where the data collision device includes:

The obtaining module is used to obtain the second ciphertext data and the first key of the plurality of participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and the second ciphertext data is obtained according to the second encryption algorithm. The encryption algorithm and the first key encrypt the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first encryption algorithm of different participants is different. a different key;

The data collision module is used for decrypting the corresponding second ciphertext data according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the data of the multiple participants. the first ciphertext data;

The data collision module is further configured to determine the intersection of the first ciphertext data of the multiple participants, and send the intersection to each of the participants, wherein the participants are based on the second encryption The intersection is encrypted with the algorithm and the first key, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the mapping relationship between the second ciphertext data and the plaintext of the sensitive data For the plaintext, according to the encrypted intersection, obtain the corresponding plaintext of the sensitive data from the plaintext of the mapping relationship.

In a fourth aspect, embodiments of the present application further provide a computer device, the computer device includes a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein the computer program is executed by When executed by the processor, the steps of the data collision method described above are implemented.

In a fifth aspect, embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, wherein when the computer program is executed by a processor, the data collision method as described above is implemented A step of.

The embodiments of the present application provide a data collision method, apparatus, device, and computer-readable storage medium. The method obtains the second ciphertext data and the first key of multiple participants, and the first key of each participant and decrypt the corresponding second ciphertext data according to the encryption algorithm and the first key of each participant to obtain the first ciphertext data of multiple participants, and then determine the first ciphertext data of the multiple participants. The intersection of text data and the intersection of text and data are sent to each participant. Since the data collision is carried out for the cipher text data, and the first key of each participant is different, it is possible to use different first keys. Obtaining different ciphertext data ensures the isolation of ciphertext data between participants, which can solve the problem of collision of sensitive data without revealing sensitive data, and improve the security and shared circulation of sensitive data.

Description of drawings

In order to explain the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. For those of ordinary skill, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic flowchart of a data collision method provided by an embodiment of the present application;

FIG. 2 is a schematic diagram of a scene for implementing the data collision method provided by the present embodiment;

3 is a schematic flowchart of another data collision method provided by an embodiment of the present application;

4 is a schematic block diagram of a data collision device provided by an embodiment of the present application;

5 is a schematic block diagram of a submodule of the data collision device in FIG. 4;

FIG. 6 is a schematic structural block diagram of a computer device provided by an embodiment of the present application.

The realization, functional characteristics and advantages of the purpose of the present application will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

The flowcharts shown in the figures are for illustration only, and do not necessarily include all contents and operations/steps, nor do they have to be performed in the order described. For example, some operations/steps can also be decomposed, combined or partially combined, so the actual execution order may be changed according to the actual situation.

Embodiments of the present application provide a data collision method, apparatus, device, and computer-readable storage medium. The data collision method can be applied to a data collision device or a data encryption device, and the data collision device or data encryption device can be a terminal device or a server, and the terminal device can be a mobile phone, a tablet computer, a notebook computer, a desktop computer, Personal digital assistants and wearable devices, etc., the data collision method can also be applied to a server, and the server can be a single server or a server cluster composed of multiple servers.

Some embodiments of the present application will be described in detail below with reference to the accompanying drawings. The embodiments described below and features in the embodiments may be combined with each other without conflict.

Please refer to FIG. 1. FIG. 1 is a schematic flowchart of a data collision method provided by an embodiment of the present application. The data collision method is applied to a data collision device, and the data collision device may be a terminal device or a server.

As shown in FIG. 1 , the data collision method includes steps S101 to S103.

Step S101: Acquire second ciphertext data and first keys of multiple participants.

The participant is the holder of the sensitive data, and the second ciphertext data is obtained by encrypting the plaintext of the sensitive data twice.

Exemplarily, the data encryption device obtains the sensitive data plaintext, the first key and the second key input by the participant, and generates a random key; encrypts the sensitive data plaintext according to the random key and the first encryption algorithm, and obtains the first key. ciphertext data, and encrypt the first ciphertext data according to the second encryption algorithm and the first key to obtain the second ciphertext data; according to the third encryption algorithm and the second key, the sensitive data plaintext and the second ciphertext data are encrypted The mapping relationship between the text data is encrypted to obtain the mapping relationship cipher text data, and the second cipher text data and the mapping relationship cipher text data are stored. For example, the plaintext of the sensitive data is plain_id, the plain_id is encrypted based on the first encryption algorithm and the random key to obtain the first ciphertext data tmp_secure_id, and the tmp_secure_id is encrypted based on the second encryption algorithm and the first key to obtain the second ciphertext For the data app_secure_id, the mapping relationship between plain_id and app_secure_id is encrypted according to the third encryption algorithm and the second key to obtain the mapping relationship ciphertext data secure_cypher_id_map.

Wherein, each participant holds its own data encryption device, and the data encryption device can be a terminal device or a server installed with a data encryption program. Through the data encryption program, the plaintext of the sensitive data can be encrypted, and then the second ciphertext can be obtained. The data and the ciphertext of the mapping relationship, the first key and the second key of each participant are different, and the first encryption algorithm is different from the second encryption algorithm. The first encryption algorithm can be any one of the deterministic encryption algorithms. An encryption algorithm includes but is not limited to MD5 algorithm, SM3 algorithm, SHA256 algorithm, HMAC algorithm, for example, using SM3 algorithm to encrypt sensitive data plaintext, the second encryption algorithm is any one of the format-preserving encryption algorithms, the second encryption algorithm Including but not limited to FF1 algorithm, FF3-1 algorithm, for example, using FF3-1 algorithm and the first key to encrypt the first ciphertext data, the third encryption algorithm can be any public key or private key encryption algorithm, the third encryption algorithm Three encryption algorithms include but are not limited to RSA algorithm, SM2 algorithm, ECC algorithm, AES algorithm, SM4 algorithm, 3DES algorithm, for example, use the SM2 algorithm and the second key to map the relationship between the sensitive data plaintext and the second ciphertext data to encrypt.

Exemplarily, the plaintext of the sensitive data is plain_id, and the plain_id is encrypted based on the SHA256 algorithm and a random key to obtain the first ciphertext data tmp_secure_id, and the tmp_secure_id is encrypted based on the FF1 algorithm and the first key to obtain the second ciphertext data app_secure_id , encrypt the mapping relationship between plain_id and app_secure_id according to the RSA algorithm and the second key, and obtain the mapping relationship ciphertext data secure_cypher_id_map.

In one embodiment, the data collision device obtains the second ciphertext data and the first key of the plurality of participants from an external storage device. Alternatively, the data collision device receives the second ciphertext data and the first key sent by multiple data encryption devices, one data encryption device sends a set of second ciphertext data and the first key, and each participant holds their own data encrypted device. The external storage device includes a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash memory card (Flash Card), a USB flash drive, and the like.

Step S102: Decrypt the second ciphertext data corresponding to each participant according to the second encryption algorithm and the first key corresponding to each participant to obtain the first ciphertext data of the multiple participants.

For example, the multiple participants include a first participant, a second participant, and a third participant, and the second ciphertext data and the first key held by the first participant are app_secure_id-1 and key_1-1, respectively. The second ciphertext data and the first key held by the second party are app_secure_id-2 and key_1-2 respectively, and the second ciphertext data and the first key held by the third party are app_secure_id-3 and key_1 respectively -3, therefore, decrypt app_secure_id-1 according to the second encryption algorithm and key_1-1 to obtain the first ciphertext data tmp_secure_id-1, and decrypt app_secure_id-2 according to the second encryption algorithm and key_1-2 to obtain For the first ciphertext data tmp_secure_id-2, decrypt app_secure_id-3 according to the second encryption algorithm and key_1-3 to obtain the first ciphertext data tmp_secure_id-3.

In one embodiment, the second ciphertext data and the first key of the multiple participants are input into the security chip, so that the security chip can use the second encryption algorithm and the first key corresponding to each participant to Decrypt the corresponding second ciphertext data to obtain the first ciphertext data of the multiple participants; and obtain the first ciphertext data of the multiple participants output by the security chip. The security of sensitive data can be further improved by inputting the second ciphertext data and the first key of multiple participants into the security chip and decrypting by the security chip.

Step S103: Determine the intersection of the first ciphertext data of the multiple participants, and send the intersection to each participant.

Wherein, after receiving the intersection of the first ciphertext data of multiple participants, the participant encrypts the intersection based on the second encryption algorithm and its own first key, and encrypts the intersection according to the third encryption algorithm and the second key. Decrypt the ciphertext data of the mapping relationship to obtain the plaintext of the mapping relationship between the second ciphertext data and the plaintext of the sensitive data, and obtain the corresponding plaintext of the sensitive data from the plaintext of the mapping relationship according to the encrypted intersection.

In one embodiment, the data collision program in the security chip is run to perform collision comparison on the first ciphertext data of the multiple participants; the collision comparison result output by the security chip is obtained, and the first ciphertext data of the multiple participants is determined according to the collision comparison result. An intersection of ciphertext data. Among them, the data collision program in the security chip can be updated according to the needs of each participant. The first ciphertext data of multiple participants is subjected to collision comparison through the security chip, and the collision comparison result is output, which can further ensure the security of sensitive data.

In one embodiment, the second ciphertext data and the first key of the multiple participants are input into the security chip, and the security chip, according to the second encryption algorithm and the first key corresponding to each participant, Decrypt the second ciphertext data to obtain the first ciphertext data of multiple participants; run the data collision program in the security chip to compare the first ciphertext data of the multiple participants; obtain the collision comparison result output by the security chip , and determine the intersection of the first ciphertext data of multiple participants according to the collision comparison result. By inputting the second ciphertext data and the first key of multiple participants into the security chip, the security chip completes the decryption process and the data collision process, and outputs the collision comparison result without outputting the intermediate result, which can further ensure the security of sensitive data. sex.

In one embodiment, the data collision device obtains a data collision application request sent by the target participant, and the data collision application request includes a plurality of remaining participants applying for participating in the data collision; sends authorization application information to each of the remaining participants, and obtains the data collision application request. The second ciphertext data and the first key sent by each of the remaining participants based on the authorization application information; the second ciphertext data and the first key of the target participant are obtained from the data collision application request. Among them, the data collision device obtains the data collision application request sent by the data encryption device held by the target participant, and sends authorization application information to the data encryption device held by each other participant, and the data encryption device outputs the authorization application information. When the data encryption device detects the authorization confirmation instruction of the participant, it sends the stored second ciphertext data and the first key to the data collision device.

For example, as shown in FIG. 2, the data encryption device 21 is held by the first participant, the data encryption device 22 is held by the second participant, and the data encryption device 23 is held by the third participant. When the sensitive data is collided, a data collision application request is sent to the data collision device 10 through the data encryption device 21, and the data collision device 10 obtains the data collision application request sent by the data encryption device 21, and the data collision application request carries the IP of the data encryption device 22. address and the IP address of the data encryption device 23, the data collision device 10 sends authorization application information to the data encryption device 22 and the data encryption device 23 through the IP address of the data encryption device 22 and the IP address of the data encryption device 23;

The data encryption device 22 outputs the authorization application information. When the data encryption device 22 detects the authorization confirmation instruction triggered by the second participant, it sends the second ciphertext data and the first key held by the second participant to the data collision device 10 , the data encryption device 23 outputs the authorization application information, and when the data encryption device 23 detects the authorization confirmation instruction triggered by the third participant, it sends the second ciphertext data and the first password held by the second participant to the data collision device 10 The data collision device 10 obtains the second ciphertext data and the first key held by the first participant from the data collision application request, and obtains the second ciphertext data held by the second participant sent by the data encryption device 22 and the first key, to obtain the second ciphertext data and the first key held by the third party and sent by the data encryption device 23 .

In one embodiment, the data collision device sends the intersection of the first ciphertext data of the multiple participants to the target participant, and the target participant inputs the intersection of the first ciphertext data of the multiple participants into the security chip for decryption, and outputs the result. The plaintext of the sensitive data corresponding to the intersection. Decrypting the intersection of the first ciphertext data of multiple participants through the security chip can further improve the security of sensitive data. For example, as shown in FIG. 2, the data collision device 10 sends the intersection of the first ciphertext data of the multiple participants to the data encryption device 21, and the data encryption device 21 inputs the intersection of the first ciphertext data of the multiple participants into the security The chip decrypts, and the security chip outputs the plaintext of the sensitive data corresponding to the intersection.

The data collision method provided by the above-mentioned embodiment, by acquiring the second ciphertext data and the first key of multiple participants, the first key of each participant is different, and according to the encryption algorithm and the first key of each participant. The key decrypts the corresponding second ciphertext data to obtain the first ciphertext data of multiple participants, then determines the intersection of the first ciphertext data of the multiple participants, and sends the intersection to each participant, Since the data collision is carried out for the ciphertext data, and the first key of each participant is different, different ciphertext data can be obtained through different first keys, so as to ensure the encryption between the participants. The isolation of text data can solve the problem of collision of sensitive data without leaking sensitive data, and improve the security and shared circulation of sensitive data.

Please refer to FIG. 3 , which is a schematic flowchart of another data collision method provided by an embodiment of the present application. The data collision method is applied to a data encryption device, and the data encryption device is connected in communication with the data collision device.

As shown in FIG. 3 , the data collision method includes steps S201 to S208.

Step S201: Obtain the plaintext of the sensitive data, the first key and the second key.

The plaintext of the sensitive data may include data such as customer information, property information, and behavioral trajectories. The customer information includes the customer's ID number, mobile phone number, bank card password, home address, etc. The first key and the second key are different.

Step S202: Encrypt the plaintext of the sensitive data according to the first encryption algorithm to obtain the first ciphertext data.

The first encryption algorithm may be any one of deterministic encryption algorithms, and the first encryption algorithm includes but is not limited to MD5 algorithm, SM3 algorithm, SHA256 algorithm, and HMAC algorithm. For example, the plaintext of the sensitive data is plain_id, and the plain_id is encrypted based on the SM3 algorithm to obtain the first ciphertext data tmp_secure_id.

Step S203: Encrypt the first ciphertext data according to the second encryption algorithm and the first key to obtain second ciphertext data.

The second encryption algorithm may be any one of the format-reserved encryption algorithms, and the second encryption algorithm includes but is not limited to the FF1 algorithm and the FF3-1 algorithm. For example, tmp_secure_id is encrypted based on the FF1 algorithm and the first key to obtain the second ciphertext data app_secure_id.

Step S204: Encrypt the mapping relationship between the plaintext of the sensitive data and the second ciphertext data according to the third encryption algorithm and the second key to obtain the ciphertext data of the mapping relationship.

The third encryption algorithm may be any public key or private key encryption algorithm, including but not limited to RSA algorithm, SM2 algorithm, ECC algorithm, AES algorithm, SM4 algorithm, and 3DES algorithm. For example, the mapping relationship between plain_id and app_secure_id is encrypted according to the AES algorithm and the second key to obtain the mapping relationship ciphertext data secure_cypher_id_map. The second ciphertext data, the first key and the mapping relation ciphertext data are stored.

Step S205: Send the second ciphertext data and the first key to the data collision device.

Exemplarily, obtain the data collision application instruction triggered by the target participant, obtain the second ciphertext data of the target participant, the first key, and the IP addresses of the other participants participating in the data collision, and generate a second ciphertext carrying the second ciphertext. The data collision application request of the data, the first key and the IP addresses of the remaining participants participating in the data collision, and then send the data collision application request to the data collision device, and the data collision device obtains the target participant's data collision application request from the data collision application request. The second ciphertext data and the first key are sent to the remaining participants based on their IP addresses, and the authorization application information is sent to the remaining participants, and the second ciphertext data and the first key sent by the remaining participants based on the authorization application information are obtained. .

In one embodiment, the data collision device inputs the received second ciphertext data and the first key of each participant into the security chip, and the security chip uses the second encryption algorithm and the corresponding first cipher of each participant. and decrypt the corresponding second ciphertext data to obtain the first ciphertext data of multiple participants; the security chip runs a data collision program to collide and compare the first ciphertext data of multiple participants; obtain the output of the security chip and the intersection of the first ciphertext data of the multiple participants is determined according to the collision comparison result, and then the intersection of the first ciphertext data of the multiple participants is sent to the target participant.

Step S206: Acquire the intersection sent by the data collision device, and encrypt the intersection according to the second encryption algorithm and the first key.

The data encryption device obtains the intersection of the first ciphertext data of the multiple participants sent by the data collision device, and encrypts the intersection of the first ciphertext data of the multiple participants according to the second encryption algorithm and its own first key .

Step S207: Decrypt the ciphertext data of the mapping relationship according to the third encryption algorithm and the second key to obtain the plaintext of the mapping relationship between the plaintext of the sensitive data and the second ciphertext data.

The third encryption algorithm may be any public key or private key encryption algorithm, including but not limited to RSA algorithm, SM2 algorithm, ECC algorithm, AES algorithm, SM4 algorithm, and 3DES algorithm. By decrypting the previously stored ciphertext data of the mapping relationship by using the third encryption algorithm and the second key, the plaintext of the mapping relationship between the plaintext of the sensitive data and the second ciphertext data can be obtained.

Step S208: Obtain the corresponding sensitive data plaintext from the mapping relationship plaintext according to the encrypted intersection.

After obtaining the plaintext of the mapping relationship between the plaintext of the sensitive data and the data of the second ciphertext, the corresponding plaintext of the sensitive data can be obtained from the plaintext of the mapping relationship between the plaintext of the sensitive data and the data of the second ciphertext according to the encrypted intersection.

Please refer to FIG. 4. FIG. 4 is a schematic block diagram of a data collision apparatus provided by an embodiment of the present application.

As shown in FIG. 4 , the data collision device 300 includes: an acquisition module 310 and a data collision module 320, wherein:

The acquiring module 310 is configured to acquire the second ciphertext data and the first key of the multiple participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and The second ciphertext data is obtained by encrypting the first ciphertext data according to the second encryption algorithm and the first key. The first encryption algorithm is different from the second encryption algorithm, and the the first keys are different;

The data collision module 320 is configured to decrypt the corresponding second ciphertext data according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the plurality of The first ciphertext data of the participant.

The data collision module 320 is further configured to determine the intersection of the first ciphertext data of the multiple participants, and send the intersection to each of the participants, wherein the participants are based on the second Encrypting the intersection with the encryption algorithm and the first key, and decrypting the ciphertext data of the mapping relationship according to the third encryption algorithm and the second key, to obtain the mapping between the second ciphertext data and the plaintext of the sensitive data For the relation plaintext, according to the encrypted intersection, obtain the corresponding sensitive data plaintext from the mapping relation plaintext.

In one embodiment, as shown in FIG. 5 , the data collision module 320 includes an input sub-module 321, a security chip 322 and an acquisition sub-module 323, wherein:

The input sub-module 321 is used to input the second ciphertext data and the first key of the multiple participants into the security chip 322;

The security chip 322 is configured to decrypt the corresponding second ciphertext data according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the plurality of participants The first ciphertext data of ;

The obtaining sub-module 323 is configured to obtain the first ciphertext data of the multiple participants output by the security chip 322 .

In one embodiment, the security chip 322 is further configured to run a data collision program to perform collision comparison on the first ciphertext data of the multiple participants;

The obtaining sub-module 323 is further configured to obtain the collision comparison result output by the security chip, and determine the intersection of the first ciphertext data of the multiple participants according to the collision comparison result.

In one embodiment, the obtaining module 310 is further configured to:

obtaining a data collision application request sent by the target participant, where the data collision application request includes a plurality of other participants applying for participating in the data collision;

Send authorization application information to each of the remaining participants, and obtain the second ciphertext data and the first key sent by each of the remaining participants based on the authorization application information;

Obtain the second ciphertext data and the first key of the target participant from the data collision application request.

In one embodiment, the data collision device further includes a sending module, the sending module is configured to:

Sending the intersection set to the target participant, so that the target participant can input the intersection set into the security chip for decryption, and obtain the sensitive data plaintext corresponding to the intersection set.

In one embodiment, the first encryption algorithm is a deterministic encryption algorithm, and the first encryption algorithm includes: MD5 algorithm, SM3 algorithm, SHA256 algorithm, and HMAC algorithm;

The second encryption algorithm is a format-preserving encryption algorithm, and the second encryption algorithm includes: FF1 algorithm and FF3-1 algorithm.

It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module and unit may refer to the corresponding process in the foregoing data collision method embodiment, It is not repeated here.

The apparatuses provided in the above embodiments may be implemented in the form of a computer program, and the computer program may be executed on the computer device as shown in FIG. 6 .

Please refer to FIG. 6. FIG. 6 is a schematic structural block diagram of a computer device provided by an embodiment of the present application. The computer device may be a data collision device or a data encryption device.

As shown in FIG. 6, the computer device includes a processor, a memory, and a network interface connected through a system bus, wherein the memory may include a storage medium and an internal memory.

The storage medium may store an operating system and a computer program. The computer program includes program instructions that, when executed, can cause the processor to perform any data collision method.

The processor is used to provide computing and control capabilities to support the operation of the entire computer equipment.

The internal memory provides an environment for running the computer program in the storage medium. When the computer program is executed by the processor, the processor can execute any data collision method.

The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art can understand that the structure shown in FIG. 6 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer equipment to which the solution of the present application is applied. Include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.

It should be understood that the processor may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSP), application specific integrated circuits (Application Specific Integrated circuits) Circuit, ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Wherein, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like.

Wherein, in one embodiment, the processor is used for running the computer program stored in the memory to realize the following steps:

Decrypt the second ciphertext data corresponding to each of the participants according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the first ciphertext data of the multiple participants.

In an embodiment, the processor decrypts the corresponding second ciphertext data according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the corresponding second ciphertext data. When describing the first ciphertext data of multiple participants, it is used to implement:

inputting the second ciphertext data and the first key of the plurality of participants into the security chip;

The security chip decrypts the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first encryption data of the multiple participating parties. ciphertext data;

Obtain the first ciphertext data of the multiple participants output by the security chip.

In an embodiment, when the processor determines the intersection of the first ciphertext data of the multiple participants, the processor is configured to:

Running the data collision program in the security chip to perform collision comparison on the first ciphertext data of the multiple participants;

The collision comparison result output by the security chip is acquired, and the intersection of the first ciphertext data of the multiple participants is determined according to the collision comparison result.

In one embodiment, when the processor acquires the second ciphertext data and the first key of the multiple participants, the processor is configured to:

Wherein, in one embodiment, the processor is further configured to implement the following steps:

In one embodiment, the processor is further configured to implement the following steps:

It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, for the specific working process of the computer equipment described above, reference may be made to the corresponding process in the foregoing data collision method embodiment, which is not repeated here. Repeat.

From the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in storage media, such as ROM/RAM, magnetic disks , CD-ROM, etc., including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of the present application.

Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed, the following steps are implemented:

For the method executed when the program instruction is executed, reference may be made to the various embodiments of the data collision method of the present application. The computer-readable storage medium may be volatile or non-volatile. The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as a hard disk or a memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) ) card, Flash Card, etc.

Further, the computer-readable storage medium may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function, and the like; The data created by the use of the node, etc.

The blockchain referred to in this application is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanism, and encryption algorithm. Blockchain, essentially a decentralized database, is a series of data blocks associated with cryptographic methods. Each data block contains a batch of network transaction information to verify its Validity of information (anti-counterfeiting) and generation of the next block. The blockchain can include the underlying platform of the blockchain, the platform product service layer, and the application service layer.

It should be understood that the terms used in the specification of the present application herein are for the purpose of describing particular embodiments only and are not intended to limit the present application. As used in this specification and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural unless the context clearly dictates otherwise.

It will also be understood that, as used in this specification and the appended claims, the term "and/or" refers to and including any and all possible combinations of one or more of the associated listed items. It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments. The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalents within the technical scope disclosed in the present application. Modifications or substitutions shall be covered by the protection scope of this application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

A data collision method, including:

Obtain the second ciphertext data and the first key of multiple participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and according to the second encryption algorithm and the The first key encrypts the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first keys of different participants are different;

Decrypt the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first ciphertext data of the plurality of participating parties;

determining an intersection of the first ciphertext data of the plurality of parties, and sending the intersection to each of the parties, wherein the parties are based on the second encryption algorithm and the first key pair The intersection is encrypted, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the plaintext of the mapping relationship between the second ciphertext data and the plaintext of the sensitive data. The corresponding sensitive data plaintext is obtained from the plaintext of the mapping relationship.
The data collision method according to claim 1, wherein the second ciphertext data corresponding to each of the participants is decrypted according to the second encryption algorithm and the first key corresponding to each of the participating parties. , obtain the first ciphertext data of the multiple participants, including:

inputting the second ciphertext data and the first key of the plurality of participants into the security chip;

The security chip decrypts the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first encryption data of the multiple participating parties. ciphertext data;

Obtain the first ciphertext data of the multiple participants output by the security chip.
The data collision method according to claim 2, wherein the determining the intersection of the first ciphertext data of the multiple participants comprises:

Running the data collision program in the security chip to perform collision comparison on the first ciphertext data of the multiple participants;

The collision comparison result output by the security chip is acquired, and the intersection of the first ciphertext data of the multiple participants is determined according to the collision comparison result.
The data collision method according to claim 1, wherein the acquiring the second ciphertext data and the first key of the plurality of participants comprises:

obtaining a data collision application request sent by the target participant, where the data collision application request includes a plurality of other participants applying for participating in the data collision;

Send authorization application information to each of the remaining participants, and obtain the second ciphertext data and the first key sent by each of the remaining participants based on the authorization application information;

Obtain the second ciphertext data and the first key of the target participant from the data collision application request.
The data collision method according to claim 4, wherein the method further comprises:

Sending the intersection set to the target participant, so that the target participant can input the intersection set into the security chip for decryption, and obtain the sensitive data plaintext corresponding to the intersection set.
The data collision method according to any one of claims 1-5, wherein the first encryption algorithm is a deterministic encryption algorithm, and the first encryption algorithm includes: MD5 algorithm, SM3 algorithm, SHA256 algorithm, and HMAC algorithm;

The second encryption algorithm is a format-preserving encryption algorithm, and the second encryption algorithm includes: FF1 algorithm and FF3-1 algorithm.
A data collision method, which includes:

Obtaining plaintext of sensitive data, a first key and a second key, where the first key is different from the second key;

Encrypting the sensitive data plaintext according to the first encryption algorithm to obtain first ciphertext data;

Encrypting the first ciphertext data according to a second encryption algorithm and the first key to obtain second ciphertext data, where the first encryption algorithm is different from the second encryption algorithm;

Encrypt the mapping relationship between the sensitive data plaintext and the second ciphertext data according to the third encryption algorithm and the second key to obtain mapping relationship ciphertext data;

Send the second ciphertext data and the first key to the data collision device, so that the data collision device can compare the corresponding first key according to the second encryption algorithm and the first key of each participant. Decrypt the two ciphertext data to obtain the first ciphertext data of the multiple participants, and determine the intersection of the first ciphertext data of the multiple participants;

acquiring the intersection sent by the data collision device, and encrypting the intersection according to the second encryption algorithm and the first key;

Decrypt the mapping relationship ciphertext data according to the third encryption algorithm and the second key to obtain the mapping relationship plaintext between the sensitive data plaintext and the second ciphertext data;

According to the encrypted intersection, the corresponding sensitive data plaintext is obtained from the mapping relationship plaintext.
A data collision device, wherein the data collision device comprises:

The obtaining module is used to obtain the second ciphertext data and the first key of the plurality of participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and the second ciphertext data is obtained according to the second encryption algorithm. The encryption algorithm and the first key encrypt the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first encryption algorithm of different participants is different. a different key;

The data collision module is used for decrypting the corresponding second ciphertext data according to the second encryption algorithm and the first key corresponding to each of the participants to obtain the data of the multiple participants. the first ciphertext data;

The data collision module is further configured to determine the intersection of the first ciphertext data of the multiple participants, and send the intersection to each of the participants, wherein the participants are based on the second encryption The intersection is encrypted with the algorithm and the first key, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the mapping relationship between the second ciphertext data and the plaintext of the sensitive data For the plaintext, according to the encrypted intersection, obtain the corresponding plaintext of the sensitive data from the plaintext of the mapping relationship.
A computer device, wherein the computer device includes a processor, a memory, and a computer program stored on the memory and executable by the processor, wherein the computer program, when executed by the processor, implements the following steps;

Obtain the second ciphertext data and the first key of multiple participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and according to the second encryption algorithm and the The first key encrypts the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first keys of different participants are different;

Decrypt the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first ciphertext data of the plurality of participating parties;

determining an intersection of the first ciphertext data of the plurality of parties, and sending the intersection to each of the parties, wherein the parties are based on the second encryption algorithm and the first key pair The intersection is encrypted, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the plaintext of the mapping relationship between the second ciphertext data and the plaintext of the sensitive data. The corresponding sensitive data plaintext is obtained from the plaintext of the mapping relationship.
The computer device according to claim 9, wherein, when the processor implements, according to the second encryption algorithm and the first key corresponding to each of the participants, the corresponding second ciphertext When the data is decrypted to obtain the first ciphertext data of the multiple participants, it is used to realize:

inputting the second ciphertext data and the first key of the plurality of participants into the security chip;

The security chip decrypts the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first encryption data of the multiple participating parties. ciphertext data;

Obtain the first ciphertext data of the multiple participants output by the security chip.
The computer device according to claim 10, wherein the processor, when implementing determining the intersection of the first ciphertext data of the plurality of participants, is configured to implement:

Running the data collision program in the security chip to perform collision comparison on the first ciphertext data of the multiple participants;

The collision comparison result output by the security chip is acquired, and the intersection of the first ciphertext data of the multiple participants is determined according to the collision comparison result.
The computer device according to claim 9, wherein, when the processor obtains the second ciphertext data and the first key of the plurality of participants, the processor is configured to:

obtaining a data collision application request sent by the target participant, where the data collision application request includes a plurality of other participants applying for participating in the data collision;

Send authorization application information to each of the remaining participants, and obtain the second ciphertext data and the first key sent by each of the remaining participants based on the authorization application information;

Obtain the second ciphertext data and the first key of the target participant from the data collision application request.
The computer device of claim 12, wherein the processor is further configured to implement the steps of:

Sending the intersection set to the target participant, so that the target participant can input the intersection set into the security chip for decryption, and obtain the sensitive data plaintext corresponding to the intersection set.
The computer device according to any one of claims 9-13, wherein the first encryption algorithm is a deterministic encryption algorithm, and the first encryption algorithm includes: MD5 algorithm, SM3 algorithm, SHA256 algorithm, HMAC algorithm ;

The second encryption algorithm is a format-preserving encryption algorithm, and the second encryption algorithm includes: FF1 algorithm and FF3-1 algorithm.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

Obtain the second ciphertext data and the first key of multiple participants, wherein the participants encrypt the sensitive data plaintext according to the first encryption algorithm to obtain the first ciphertext data, and according to the second encryption algorithm and the The first key encrypts the first ciphertext data to obtain the second ciphertext data, the first encryption algorithm is different from the second encryption algorithm, and the first keys of different participants are different;

Decrypt the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first ciphertext data of the plurality of participating parties;

determining an intersection of the first ciphertext data of the plurality of parties, and sending the intersection to each of the parties, wherein the parties are based on the second encryption algorithm and the first key pair The intersection is encrypted, and the ciphertext data of the mapping relationship is decrypted according to the third encryption algorithm and the second key to obtain the plaintext of the mapping relationship between the second ciphertext data and the plaintext of the sensitive data. The corresponding sensitive data plaintext is obtained from the plaintext of the mapping relationship.
The computer-readable storage medium according to claim 15, wherein, when the processor implements, according to the second encryption algorithm and the first key corresponding to each of the participating parties, to the corresponding first key When the second ciphertext data is decrypted to obtain the first ciphertext data of the multiple participants, it is used to realize:

inputting the second ciphertext data and the first key of the plurality of participants into the security chip;

The security chip decrypts the second ciphertext data corresponding to each of the participating parties according to the second encryption algorithm and the first key corresponding to each of the participating parties to obtain the first encryption data of the multiple participating parties. ciphertext data;

Obtain the first ciphertext data of the multiple participants output by the security chip.
The computer-readable storage medium of claim 16, wherein the processor, when implementing determining the intersection of the first ciphertext data of the plurality of participants, is configured to implement:

Running the data collision program in the security chip to perform collision comparison on the first ciphertext data of the multiple participants;

The collision comparison result output by the security chip is acquired, and the intersection of the first ciphertext data of the multiple participants is determined according to the collision comparison result.
The computer-readable storage medium according to claim 15, wherein, when the processor implements acquiring the second ciphertext data and the first key of the plurality of participants, the processor is configured to implement:

obtaining a data collision application request sent by the target participant, where the data collision application request includes a plurality of other participants applying for participating in the data collision;

Send authorization application information to each of the remaining participants, and obtain the second ciphertext data and the first key sent by each of the remaining participants based on the authorization application information;

Obtain the second ciphertext data and the first key of the target participant from the data collision application request.
The computer-readable storage medium of claim 18, wherein the processor is further configured to implement the steps of:

Sending the intersection set to the target participant, so that the target participant can input the intersection set into the security chip for decryption, and obtain the sensitive data plaintext corresponding to the intersection set.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the following steps are implemented:

Obtaining plaintext of sensitive data, a first key and a second key, where the first key is different from the second key;

Encrypting the sensitive data plaintext according to the first encryption algorithm to obtain first ciphertext data;

Encrypting the first ciphertext data according to a second encryption algorithm and the first key to obtain second ciphertext data, where the first encryption algorithm is different from the second encryption algorithm;

Encrypt the mapping relationship between the sensitive data plaintext and the second ciphertext data according to the third encryption algorithm and the second key to obtain mapping relationship ciphertext data;

Send the second ciphertext data and the first key to the data collision device, so that the data collision device can compare the corresponding first key according to the second encryption algorithm and the first key of each participant. Decrypt the two ciphertext data to obtain the first ciphertext data of the multiple participants, and determine the intersection of the first ciphertext data of the multiple participants;

acquiring the intersection sent by the data collision device, and encrypting the intersection according to the second encryption algorithm and the first key;

Decrypt the mapping relationship ciphertext data according to the third encryption algorithm and the second key to obtain the mapping relationship plaintext between the sensitive data plaintext and the second ciphertext data;

According to the encrypted intersection, the corresponding sensitive data plaintext is obtained from the mapping relationship plaintext.