WO2023093312A1 - 信息处理系统、方法、设备及存储介质 - Google Patents

信息处理系统、方法、设备及存储介质 Download PDF

Info

Publication number
WO2023093312A1
WO2023093312A1 PCT/CN2022/123841 CN2022123841W WO2023093312A1 WO 2023093312 A1 WO2023093312 A1 WO 2023093312A1 CN 2022123841 W CN2022123841 W CN 2022123841W WO 2023093312 A1 WO2023093312 A1 WO 2023093312A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
information
file
client
feature
Prior art date
Application number
PCT/CN2022/123841
Other languages
English (en)
French (fr)
Inventor
丁杰
张瑞
吴财军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023093312A1 publication Critical patent/WO2023093312A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V40/00—Recognition of biometric, human-related or animal-related patterns in image or video data
    • G06V40/10—Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands
    • G06V40/16—Human faces, e.g. facial parts, sketches or expressions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of computer technology, and in particular to an information processing system, method, device and storage medium.
  • the face information is usually encrypted on the client side, so that the server needs to generate a key based on the client.
  • the encrypted face information is compared with known face information.
  • the present application provides an information processing system, method, device and storage medium, which can effectively ensure information security.
  • the technical solution is as follows:
  • an information processing system includes: a client, a first node, and a second node;
  • the client is configured to send an identification request carrying the number information of the client to the first node, and send the encryption feature of the first object to be identified and the number information of the client to the second node, and the number information of the first object
  • the encryption feature is obtained based on the public key of the first node and the feature of the first object
  • the first node is configured to, in response to the identification request, determine the first target file in the second node, and send an identification indication to the second node, where the identification indication carries the serial number information of the client and the information of the first target file file information;
  • the second node is configured to, in response to the identification instruction, based on the received encryption feature of the first object, the serial number information of the client, the file information of the first target file, and the evaluation key of the first node, to comparing the encrypted features of the first object to obtain a comparison result, and sending the comparison result to the first node;
  • the first node is further configured to decrypt the comparison result based on the private key of the first node when receiving the comparison result, and obtain the object of the first object based on the decrypted comparison result information, sending the object information of the first object to the client.
  • the object information includes information used to identify objects in the information processing system.
  • the object information refers to the user name entered by the user when registering in the face recognition system.
  • the object information includes the identity information of the object.
  • the object information includes the name, age, and ID number entered by the user when registering in the face recognition system.
  • the private key and publicly available object information are stored in the first node, and the information encrypted based on the public key of the first node is stored in the second node, which ensures the separation of storage authority and decryption authority.
  • the feature information of the node does not come out of the client, multiple nodes interact based on the information mapping relationship, which can realize efficient information processing and effectively ensure information security.
  • one-to-many information identification can be realized based on one set of keys, which effectively solves the problem of occupying a large amount of storage space in order to store multiple sets of keys corresponding to multiple registered features.
  • the client is further configured to perform encoding based on the features of the first object to obtain a first feature vector of the first object, where the first feature vector is an M-dimensional vector;
  • the second eigenvector of the first object Based on the first eigenvector of the first object, the second eigenvector of the first object is obtained, the second eigenvector of the first object is an N ⁇ M dimensional vector, and the second eigenvector of the first object includes N a first eigenvector of the first object;
  • M and N are positive integers.
  • the features of the object to be identified are encoded into a multi-dimensional vector matching the dimensions of the first target file, and the features of the object to be identified can be combined with multiple registered Object comparison is equivalent to completing the information processing process for multiple registered objects within one processing cycle, which greatly improves the efficiency of information processing.
  • the second node includes a scheduling node and multiple target nodes
  • the first node is configured to determine from the file information table the first target node corresponding to the client in the second node based on the serial number information of the client in the identification request, and determine the first target from the file information table
  • the file information of the first target file in the node, the file information table includes the corresponding relationship between the number information of the client and the multiple target nodes included in the second node, and the relationship between the multiple target nodes and the file Correspondence.
  • the scheduling node in the second node is configured to instruct the first target node to load the evaluation key of the first node into memory in response to the identification indication.
  • the first target node when the first target node receives the identification instruction, it directly loads the evaluation key, so that when the first target node receives the encryption feature sent by the client, it can directly load the evaluation key based on the evaluation key in the memory.
  • the key is identified, which saves the time of evaluating key loading during the identification process.
  • the multi-node architecture of the information processing system is fully used to physically process data in parallel, and the efficiency of information processing is greatly improved.
  • the scheduling node of the second node is configured to, in response to the identification instruction, send the first target file information of the first target file to the first
  • the target node sends the identification indication and the encryption feature of the first object
  • the first target node in response to the identification indication, compares the encrypted feature of the first object based on the received encrypted feature of the first object, the first target file, and the evaluation key of the first node , to get the comparison result.
  • the scheduling node in the second node can schedule multiple target nodes in parallel according to the instructions of the first node, and identify the client.
  • the physical The parallel computing on the computer not only improves the efficiency of information processing, but also ensures the real-time performance of information recognition.
  • the scheduling node in the second node is configured to, in response to the identification indication, if the number information received from the client is consistent with the number information of the client carried in the identification indication , sending the identification indication and the encryption feature of the first object to the first target node among the second nodes according to the file information of the first target file.
  • the first target node in the second node is configured to, based on the evaluation key of the first node, perform an encryption feature of the received first object and each The registered feature performs the inner product operation in the ciphertext state to obtain the comparison result.
  • the first node is configured to determine a target feature based on the decrypted comparison result, where the target feature is a registered feature with the largest similarity with the feature of the first object;
  • the object information of the target feature is obtained from the file information table, and the file information table includes the object information of each registered feature in the file in the second node and location information of each registered feature in the file in the second node;
  • the object information of the target feature is determined as the object information of the first object.
  • the client is further configured to send a registration request to the first node, where the registration request carries number information of the client and object information of a second object to be registered;
  • the first node is further configured to, in response to the registration request, determine the second target file in the second target node in the second node, send the file information of the second target file to the client, and send the file information of the second target file to the second node sending a registration instruction, the registration instruction carries the number information of the client and the file information of the second target file;
  • the client is further configured to send the encryption feature of the second object and the serial number information of the client to the second node, the encryption feature of the second object is based on the public key of the first node, the feature of the second object, and obtaining the file information of the second target file;
  • the second node is further configured to, in response to the registration instruction, based on the received encryption feature of the second object, serial number information of the client, file information of the second target file, and evaluation key of the first node, Adding the encryption feature of the second object to the second target file through the second target node, and sending successful addition information to the first node;
  • the first node is further configured to add the object information of the second object to the file information table and send registration success information to the client when receiving the adding success information, and the file information table includes the second object The object information of each registered feature in the file in the node and the position information of each registered feature in the file in the second node.
  • the file information of the second target file includes an available location number of the second target file
  • the client is further configured to encode the features of the second object to obtain a first feature vector of the second object, where the first feature vector of the second object is an M-dimensional vector;
  • a second feature vector of the second object is obtained, the second feature vector of the second object is an N ⁇ M dimensional vector, and the second feature vector of the second object is A feature vector is located at a position corresponding to the available position number in the second feature vector of the second object, and positions other than the position corresponding to the available position number in the second feature vector of the second object are 0;
  • M and N are positive integers.
  • the registration code is used to ensure that the registration is based on the available position in the second target file corresponding to the object to be registered.
  • the registration process does not affect other registered features, and the encrypted state is realized. Dynamic registration improves the flexibility of information processing and improves the efficiency of information processing on the basis of ensuring information security.
  • the client is further configured to send a deregistration request to the first node, where the deregistration request carries the number information of the client and the object information of the third object to be deregistered;
  • the first node is further configured to, in response to the deregistration request, determine the third target file in the third target node in the second node where the registered feature corresponding to the third object is located, and send a deregistration instruction to the second node , the logout instruction carries the serial number information of the client and the file information of the third object file, and the file information of the third object file includes the position number of the registered feature corresponding to the third object in the third object file;
  • the second node is further configured to, in response to the logout instruction, based on the serial number information of the client, the file information of the third target file, and the evaluation key of the first node, through the third target node, send the third The registered feature corresponding to the object is deleted from the third target file, and a deletion success message is sent to the first node;
  • the first node is further configured to delete the object information of the third object and the registered feature corresponding to the third object in the third object file from the file information table when the deletion success information is received.
  • Location information, sending logout success information to the client, the file information table includes the object information of each registered feature in the file in the second node and the location information of each registered feature in the file in the second node.
  • an information processing system in a second aspect, includes: a client, a third node, and a fourth node;
  • the client is configured to send to the third node an identification request carrying the number information of the client and the encryption feature of the first object to be identified, the encryption feature of the first object is based on the public key of the third node and the The characteristics of the first object are obtained;
  • the third node is configured to, in response to the identification request, determine the file information of the first target file in the third node, based on the received encryption feature of the first object, the file information of the first target file, and the received
  • the evaluation key of the third node is compared with the encryption feature of the first object to obtain a comparison result, and the comparison result is sent to the fourth node;
  • the fourth node is configured to, when receiving the comparison result, decrypt the comparison result based on the private key of the third node, and send the decrypted comparison result to the third node;
  • the third node is further configured to obtain the object information of the first object based on the received decrypted comparison result, and send the object information of the first object to the client.
  • the information based on public key encryption and the object information that can be disclosed is stored in the third node, and the private key is stored in the fourth node, which ensures the separation of storage authority and decryption authority.
  • the client multiple nodes interact based on the information mapping relationship to achieve efficient information processing and effectively ensure information security.
  • the fourth node is only used to provide the decryption service, the process of information exchange between multiple nodes is simplified, and the efficiency of information processing is effectively improved.
  • the client is further configured to perform encoding based on the features of the first object to obtain a first feature vector of the first object, where the first feature vector is an M-dimensional vector;
  • the second eigenvector of the first object Based on the first eigenvector of the first object, the second eigenvector of the first object is obtained, the second eigenvector of the first object is an N ⁇ M dimensional vector, and the second eigenvector of the first object includes N a first eigenvector of the first object;
  • M and N are positive integers.
  • the third node is configured to determine the file information of the first target file from a file information table based on the serial number information of the client in the identification request, and the file information table includes the serial number information of the client The corresponding relationship with the files in the third node.
  • the third node is configured to load the evaluation key of the third node into memory in response to the identification request.
  • the third node is configured to, in response to the identification request, determine the file information of the first target file in the third node according to the serial number information of the client;
  • the encrypted feature of the first object is compared to obtain a comparison result.
  • the third node is configured to perform an inner product on the received encrypted feature of the first object and each registered feature in the first target file based on the evaluation key of the third node operation to get the comparison result.
  • the third node is configured to determine a target feature based on the decrypted comparison result, where the target feature is a registered feature with the largest similarity with the feature of the first object;
  • the object information of the target feature is obtained from the file information table, and the file information table includes the object information of each registered feature in the file in the third node and The location information of each registered feature in the file in the third node;
  • the object information of the target feature is determined as the object information of the first object.
  • the client is further configured to send a registration request to the third node, where the registration request carries number information of the client and object information of the second object to be registered;
  • the third node is further configured to, in response to the registration request, determine a second target file in the third node based on the serial number information of the client, and send file information of the second target file to the client;
  • the client is further configured to send the encryption feature of the second object to the third node, the encryption feature of the second object is based on the public key of the third node, the feature of the second object, and the second target file file information is obtained;
  • the third node is further configured to add the encrypted feature of the second object to the first object based on the received encrypted feature of the second object, the file information of the second target file, and the evaluation key of the third node.
  • the second object file In the second object file;
  • the third node is further configured to add the object information of the second object to the file information table when the encryption feature of the second object is added successfully, and send registration success information to the client, and the file information table includes The object information of each registered feature in the file in the third node and the position information of each registered feature in the file in the third node.
  • the file information of the second target file includes an available location number of the second target file
  • the client is further configured to encode the features of the second object to obtain a first feature vector of the second object, where the first feature vector of the second object is an M-dimensional vector;
  • a second feature vector of the second object is obtained, the second feature vector of the second object is an N ⁇ M dimensional vector, and the second feature vector of the second object is A feature vector is located at a position corresponding to the available position number in the second feature vector of the second object, and positions other than the position corresponding to the available position number in the second feature vector of the second object are 0;
  • M and N are positive integers.
  • the registration code is used to ensure that the registration is based on the available location in the second target file corresponding to the object to be registered, and the registration process does not affect other registered features, and the encrypted state is realized.
  • the dynamic registration under the system improves the flexibility of information processing, and improves the efficiency of information processing on the basis of ensuring information security.
  • the client is further configured to send a deregistration request to the third node, where the deregistration request carries the number information of the client and the object information of the third object to be deregistered;
  • the third node is further configured to, in response to the deregistration request, determine a third target file in which the registered feature corresponding to the third object among the plurality of third nodes is located;
  • the third node is further configured to delete the registered feature corresponding to the third object from the third object file based on the file information of the third object file and the evaluation key of the third node, and the third object
  • the file information of the file includes the position number of the registered feature corresponding to the third object in the third object file
  • the third node is also used to delete the object information of the third object and the registered feature corresponding to the third object from the file information table in the case that the registered feature corresponding to the third object is successfully deleted.
  • an information processing method executed by a client in an information processing system, the information processing system further includes a first node and a second node, and the method includes:
  • the encryption feature of the first object is obtained based on the public key of the first node and the feature of the first object;
  • the object information of the first object is received from the first node, and the object information of the first object is obtained based on the encryption characteristic of the first object, the evaluation key of the first node, and the private key of the first node.
  • the method before sending the encryption feature of the first object to be identified and the serial number information of the client to the second node, the method further includes:
  • the second eigenvector of the first object Based on the first eigenvector of the first object, the second eigenvector of the first object is obtained, the second eigenvector of the first object is an N ⁇ M dimensional vector, and the second eigenvector of the first object includes N a first eigenvector of the first object;
  • M and N are positive integers.
  • the method also includes:
  • the registration request carrying the number information of the client and the object information of the second object to be registered;
  • the encryption feature of the second object is based on the public key of the first node, the feature of the second object and the first node in the second node
  • Obtaining the file information of the second target file the file information of the second target file is determined by the first node in response to the registration request;
  • Registration success information is received from the first node.
  • the file information of the second target file includes an available location number of the second target file, and before sending the encryption feature of the second object and the number information of the client to the second node, the method also includes:
  • a second feature vector of the second object is obtained, the second feature vector of the second object is an N ⁇ M dimensional vector, and the second feature vector of the second object is A feature vector is located at a position corresponding to the available position number in the second feature vector of the second object, and positions other than the position corresponding to the available position number in the second feature vector of the second object are 0;
  • M and N are positive integers.
  • the method also includes:
  • an information processing method executed by a first node in an information processing system, the information processing system further includes a client and a second node, and the method includes:
  • the client In response to the identification request received from the client that carries the number information of the client, determine the first target file in the second node, and send an identification indication to the second node, where the identification indication carries the number information of the client and file information of the first target file;
  • the comparison result is received from the second node, the comparison result is decrypted based on the private key of the first node, and the object information of the first object is obtained based on the decrypted comparison result, and sent to the The client sends the object information of the first object;
  • the comparison result is indicated by the second node in response to the identification instruction, based on the encryption feature of the first object, the serial number information of the client, the file information of the first target file, and the evaluation key of the first node,
  • the encryption feature of the first object is obtained by comparing; the encryption feature of the first object is obtained by the client based on the public key of the first node and the feature of the first object.
  • the second node includes a scheduling node and a plurality of target nodes, and in response to an identification request received from a client carrying the serial number information of the client, determine the first Object files include:
  • the file information table includes the corresponding relationship between the serial number information of the client and the multiple target nodes included in the second node, and the corresponding relationship between the multiple target nodes and the file.
  • obtaining the object information of the first object based on the decrypted comparison result includes:
  • the first node determines a target feature based on the decrypted comparison result, and the target feature is a registered feature with the largest similarity with the feature of the first object;
  • the object information of the target feature is obtained from the file information table, and the file information table includes the object information of each registered feature in the file in the second node and location information of each registered feature in the file in the second node;
  • the object information of the target feature is determined as the object information of the first object.
  • the method also includes:
  • the object information of the second object is added to the file information table, and the registration success information is sent to the client, and the file information table includes the files in the second node
  • the addition success information is used to indicate that the encrypted feature of the second object has been added to the second target file.
  • the method also includes:
  • the deregistration instruction carries the serial number information of the client and the file information of the third object file, and the deregistration request carries the serial number information of the client and the object information of the third object to be deregistered;
  • the deletion success message Indicates that the registered feature corresponding to the third object has been deleted from the third object file.
  • an information processing method executed by a second node in an information processing system, the information processing system further includes a client and a first node, the method includes:
  • the identification instruction carries the serial number information of the client and the file information of the first target file
  • the encryption feature of the first object is obtained based on the public key of the first node and the feature of the first object
  • the comparison result is used for determining the object information of the first object.
  • the method also includes:
  • the scheduling node of the second node instructs the first target node to load the evaluation key of the first node into memory in response to the identification indication.
  • the second node includes a scheduling node and a plurality of target nodes, and in response to the identification indication received from the first node, based on the information of the first object to be identified received from the client
  • the encryption feature, the serial number information of the client, the file information of the first target file in the second node, and the evaluation key of the first node are compared with the encryption feature of the first object, and the comparison results include:
  • the scheduling node In response to the identification indication, the scheduling node sends the identification indication and the encryption feature of the first object to the first target node among the second nodes according to the file information of the first target file and the serial number information of the client;
  • the first target node in response to the identification indication, compares the encrypted feature of the first object based on the received encrypted feature of the first object, the first target file, and the evaluation key of the first node , to get the comparison result.
  • sending the identification indication and the encryption feature of the first object to the first target node in the second node includes:
  • the scheduling node in the second node in response to the identification indication, the scheduling node in the second node, in the case that the number information received from the client is consistent with the number information of the client carried in the identification indication, according to the file information of the first target file, The identification indication and the encryption feature of the first object are sent to the first target node in the second node.
  • the encryption feature of the first object to be identified is received from the client, the serial number information of the client, the file information of the first target file in the second node, and the first
  • the evaluation key of the node is compared with the encrypted features of the first object, and the obtained comparison results include:
  • an inner product operation is performed on the received encrypted feature of the first object and each registered feature in the first target file in a ciphertext state to obtain a comparison result.
  • the method also includes:
  • the encryption feature of the second object is based on The public key of the first node, the feature of the second object and the file information of the second object file are obtained.
  • the method also includes:
  • the file information of the third target file where the registered feature corresponding to the third object in the third target node in the second node is located In response to the logout instruction received from the first node, based on the serial number information of the client, the file information of the third target file where the registered feature corresponding to the third object in the third target node in the second node is located, and The evaluation key of the first node deletes the registered feature corresponding to the third object from the third target file, and sends deletion success information to the first node, and the cancellation instruction carries the serial number information of the client and the first node File information for three object files.
  • an information processing method executed by a third node in an information processing system, the information processing system further includes a client and a fourth node, the method includes:
  • the identification request In response to the identification request received from the client, determine the file information of the first target file in the third node, based on the encryption feature of the first object to be identified received from the client, the first target file.
  • the file information and the evaluation key of the third node are compared with the encrypted features of the first object to obtain a comparison result, and the comparison result is sent to the fourth node, and the identification request carries the serial number information of the client,
  • the encryption feature of the first object is obtained based on the public key of the third node and the feature of the first object;
  • the object information of the first object is obtained, and the object information of the first object is sent to the client, and the decrypted comparison result is determined by the fourth node based on The private key of the third node is obtained by decrypting the comparison result.
  • a seventh aspect provides a computing device, which can include a processor and a memory, the memory is used to store at least one piece of program code, the at least one piece of program code is loaded by the processor and executes the information provided by the third aspect above.
  • a computer-readable storage medium is provided, and the computer-readable storage medium is used to store at least one piece of program code.
  • the computer-readable storage medium is executed by a processor of a computing device, Enabling the computing device to execute the information processing method provided in the third aspect above, or the information processing method provided in the fourth aspect above, or the information processing method provided in the fifth aspect above, or the information processing method provided in the sixth aspect above .
  • a ninth aspect provides a computer program product, which enables the computing device to execute the information processing method provided in the third aspect above, or the information processing method provided in the fourth aspect above when the computer program product runs on the computing device method, or the information processing method provided in the fifth aspect above, or the information processing method provided in the sixth aspect above.
  • FIG. 1 is a schematic diagram of the architecture of an information processing system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a hardware structure of a computing device provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of an information processing method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a file information table provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a registration process provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a registration process provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of an information processing method provided in an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an identification process provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of an identification process provided by an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of an information processing method provided in an embodiment of the present application.
  • Fig. 11 is a schematic diagram of a cancellation process provided by the embodiment of the present application.
  • FIG. 12 is a schematic diagram of the architecture of an information processing system provided by an embodiment of the present application.
  • FIG. 13 is a schematic flowchart of an information processing method provided in an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of an information processing method provided by an embodiment of the present application.
  • FIG. 15 is a schematic flowchart of an information processing method provided by an embodiment of the present application.
  • FIG. 16 is a schematic diagram of an information processing system provided by an embodiment of the present application.
  • Face verification is a technology to judge whether two face images correspond to the same person. This is a two-category problem, which is usually applied to face-based login control, access control, identity confirmation, etc. aspects, such as face-based mobile phone unlocking and operating system login. Face verification involves a 1:1 comparison and operation.
  • Face recognition face recognition, FR: The recognition system extracts the face features to be recognized from the input face image, and compares and searches in the face database based on the face features to be recognized. If the similarity of the closest known face image in the face database is greater than a certain threshold, it is judged that this input face image corresponds to the same face as the known face image, otherwise it is considered that the input face image corresponds to An unknown human face. Face recognition is usually used for face-based attendance check-in, personnel search, etc. Face recognition involves 1:N comparison and operation. Compared with face verification, face recognition requires much more calculation, depending on the number N of faces registered in the recognition system, where N is a positive integer.
  • Homomorphic encryption Homomorphic encryption technology can realize the homomorphic operation of the ciphertext state of the data, and the result of decrypting the ciphertext state operation result is equivalent to the result of the corresponding operation on the plaintext.
  • HE Homomorphic encryption
  • full homomorphic encryption full homomorphic encryption, FHE
  • FHE full homomorphic encryption
  • Key A parameter entered in an algorithm for converting plaintext to ciphertext (encryption algorithm) or converting ciphertext to plaintext (decryption algorithm).
  • the key obtained by the key generation algorithm includes a pair of public key, private key and evaluation key.
  • the public key (public key, PK) is a public parameter, which can be used to encrypt the plaintext to obtain the ciphertext;
  • the private key (private key, PK) is a non-public parameter, which is used to encrypt the ciphertext based on the public key Decryption;
  • the evaluation key (evaluation key, EK) is also called auxiliary calculation key, which is used to perform homomorphic operations on ciphertext (such as ciphertext multiplication), including relinearization key and key exchange key, and relinearization key
  • the linearization key is used to prevent ciphertext expansion
  • the key exchange key is used to support the ciphertext rotation operation
  • the evaluation key can ensure that the decryption result of the operation result on the ciphertext is equivalent to the corresponding operation result on the plaintext.
  • CKKS (Cheon-Kim-Kim-Song) algorithm is an approximate computing homomorphic encryption algorithm that supports floating-point number addition and multiplication homomorphic operations for real or complex numbers, and the calculation results obtained are approximate values , suitable for scenarios that do not require accurate results, such as machine learning model training.
  • BFV Brain-Vercauteren
  • LWE learning with error
  • RLWE ring Learning with error
  • both the ciphertext and the key are represented by vectors, and the product of the ciphertext and the corresponding key product is a tensor, so the multiplication operation of the ciphertext will cause the explosive growth of the dimension of the ciphertext, and the BFV algorithm passes
  • the key exchange technology is used to control the dimension expansion of the ciphertext vector, and after the ciphertext calculation, the expanded ciphertext dimension can be restored to the original ciphertext dimension through key exchange.
  • Open multi-processing is a collection of compiler instructions and library functions designed for parallel programming on shared storage computing devices.
  • Programmable logic device field programmable gate array, FPGA
  • FPGA field programmable gate array
  • the FPGA accelerator card is a professional board for specific fields and applications.
  • the board is designed with rich high-speed I/O interfaces and storage resources.
  • FIG. 1 is a schematic diagram of an information processing system provided by an embodiment of the present application.
  • the information processing system 100 includes: a client 110 , a first node 120 and a second node 130 , wherein the second node 130 includes a scheduling node 131 and multiple target nodes 132 .
  • the client 110 is used to acquire the feature of the object to be identified when the object to be identified is detected, and encrypt the acquired feature of the object to be identified based on the public key 121 of the first node 120 to obtain the encrypted feature, and send The second node sends the encrypted feature; sends an identification request to the first node 120, instructing the first node to obtain the file information required for identifying the object to be identified.
  • the first node 120 is used to store the file information table, obtain the file information of the file required for identifying the object to be identified based on the received identification request, and send an identification instruction to the second node 130 based on the file information, and the identification instruction is used for Instruct the first target node 1321 corresponding to the client in the second node 120 to identify the client 110 .
  • the scheduling node 131 in the second node 130 is configured to send the identification indication and the encryption feature received from the client node to the first target node 1321 corresponding to the client in response to receiving the identification indication of the first node; the second node
  • the first target node 1321 in 130 is used to store the file where the registered feature is located.
  • the encrypted feature is encrypted based on the evaluation key 122 of the first node 120, the stored file, and the encrypted feature. Compare, obtain a comparison result, and send the comparison result to the first node 120 .
  • the first node 120 is further configured to decrypt the received comparison result based on the private key 123 of the first node 120, and determine the object information (for example, identity information) of the object to be identified based on the decrypted comparison result, The object information is sent to the client 110 .
  • the client 110, the first node 120 and the second node 130 are connected through a wired network or a wireless network.
  • the wireless or wired network described above uses standard communication techniques and/or protocols.
  • the network is usually the Internet, but can be any network, including but not limited to local area network (LAN), metropolitan area network (MAN), wide area network (WAN), mobile, wired or wireless Any combination of network, private network, or virtual private network.
  • the client 110, the first node 120 and the second node 130 implement peer-to-peer (P2P) communication based on a remote procedure call protocol (RPC).
  • P2P peer-to-peer
  • RPC remote procedure call protocol
  • the client 110, the first node 120, and the second node 130 use technologies including hyper text markup language (hyper text markup language, HTML), extensible markup language (extensible markup language, XML) and/or or format to represent data exchanged over a network.
  • hyper text markup language hyper text markup language
  • extensible markup language extensible markup language
  • XML extensible markup language
  • custom and/or dedicated data communication techniques can also be used instead of or in addition to the data communication techniques described above.
  • the client refers to a terminal or server on the user side.
  • a terminal is also called a smart terminal or a mobile smart terminal, which refers to a type of device that has rich human-computer interaction methods, has the ability to access the Internet, is usually equipped with various operating systems, and has strong processing capabilities.
  • the types of mobile smart terminals include, but are not limited to, smart phones, tablet computers, vehicle-mounted terminals, handheld game consoles, and the like.
  • the server may be a server cluster composed of one or more computing devices.
  • the first node and the second node can be independent physical servers, or server clusters or distributed systems composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, Cloud servers for basic cloud computing services such as cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.
  • cloud services such as cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.
  • the architecture of an information processing system provided by the embodiment of the present application is introduced from the perspective of system architecture, and the hardware structure of the client, the first node and the second node in the information processing system is introduced below .
  • FIG. 2 is a schematic diagram of a hardware structure of a computing device provided by an embodiment of the present application.
  • the computing device 200 includes a memory 201 , a processor 202 , a communication interface 203 and a bus 204 .
  • the memory 201 , the processor 202 , and the communication interface 203 are connected to each other through the bus 204 .
  • the memory 201 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or other types that can store information and instructions It can also be an electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be programmed by a computer Any other medium accessed, but not limited to.
  • EEPROM electrically erasable programmable read-only memory
  • CD-ROM compact disc read-only memory
  • optical disc storage including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.
  • magnetic disk storage media or other magnetic storage devices or can be used to carry
  • the memory 201 can store at least one piece of program code, and when the program code stored in the memory 201 is executed by the processor 202, the computing device can realize the operations performed by the client in the information processing system.
  • the storage 201 may store characteristics of objects, public keys, etc., which are not limited in this embodiment of the present application.
  • the processor 202 may be a network processor (network processor, NP), a central processing unit (central processing unit, CPU), a specific application integrated circuit (application-specific integrated circuit, ASIC), or an integrated circuit for controlling the execution of the program program of this application. circuit.
  • the processor 202 may be a single-core (single-CPU) processor, or a multi-core (multi-CPU) processor. The number of the processor 202 may be one or more.
  • the communication interface 203 uses a transceiver module such as a transceiver to implement communication between the computing device 200 and other devices or communication networks. For example, data can be acquired through the communication interface 203 .
  • the memory 201 and the processor 202 may be provided separately, or may be integrated together.
  • Bus 204 may include pathways for transferring information between various components of computing device 200 (eg, memory 201 , processor 202 , communication interface 203 ).
  • the public key, private key and evaluation key deployed in the information processing system are determined through a key generation algorithm based on the processing requirement parameters in the system.
  • the processing requirement parameters include: (1) Dimensional information of the characteristics of the object, the key generated based on the dimension information of the characteristics can guarantee the homomorphic operation of the encrypted characteristics of the object based on the evaluation key (2) Security strength parameters, which can determine the complexity of encryption algorithms and decryption algorithms; (3) Identify performance requirements, used to construct encryption algorithms, decryption algorithms and keys that meet performance requirements; (4) Maximum characteristics Quantity, indicating the upper limit of the number of features that can be stored in the information processing system.
  • the process of determining the public key, private key and evaluation key is performed by the first node, and the first node configures the public key to the client, and the public key is used to perform
  • the evaluation key is allocated to the second node, and the evaluation key is used to perform homomorphic operations on the encrypted features (ciphertext).
  • the first node can configure the public key and the evaluation key to any node, which is not limited in this embodiment of the present application.
  • the private key is only held by the first node, that is, the first node can decrypt the encrypted information in the information processing system.
  • the first node stores the private key in secure hardware, for example, a trusted execution environment (trusted execution environment, TEE), so as to ensure the security of the private key.
  • TEE trusted execution environment
  • Fig. 3 is a schematic flow chart of an information processing method provided by an embodiment of the present application. Referring to Fig. 3, the method includes:
  • the client Based on the object information of the object A to be registered, the client sends a registration request to the first node to obtain the characteristics of the object A.
  • the registration request carries the serial number information of the client and the object information of the object A.
  • the serial number information of the client can uniquely identify the client, and the registration request carries the serial number information and the object information of object A, which can indicate which client the registration request comes from.
  • the object information includes information used to identify the object in the information processing system.
  • the object information refers to the user name entered by the user when registering in the face recognition system.
  • the object information includes the identity information of the object.
  • the object information includes the name, age and ID number entered by the user when registering in the face recognition system.
  • the first node determines the second target node included in the second node, determines the file information of the second target file in the second target node, and sends the file information of the second target file to the client.
  • the second node is used to store a file, and the file includes a plurality of registered features, and the registered features correspond to registered objects. Understandably, the registered features stored in the second node are encrypted features of registered objects.
  • the second node includes a scheduling node and a plurality of target nodes.
  • the scheduling node is configured to forward the indication and related information to the target node corresponding to the indication in response to receiving the indication; the multiple target nodes are respectively configured to store registered features corresponding to registered objects.
  • the files stored by the target nodes respectively include different registered objects. For example, in a scenario based on face recognition, multiple departments in the same enterprise correspond to different target nodes, and each target node is used to store the registered face files of the department.
  • the first node when the first node receives the registration request for object A initiated by the client, it needs to determine the second target node corresponding to the client in the second node, and then through the second target node, obtain the The second object file required by the client for registration. For example, in a scenario based on face recognition, when registering through a client, after receiving the registration request from the client, the first node determines the second target node corresponding to the department based on the department information carried in the registration request, and then sends the The face features carried in the registration request are stored in the registered face file corresponding to the department.
  • the first node stores a file information table
  • the file information table includes the corresponding relationship between the number information of the client and the multiple target nodes included in the second node, and the multiple target nodes and the file Correspondence between.
  • the first node can query the node number of the target node corresponding to the client from the file information table, thereby determining the second target node.
  • the second target file required by the client for registration can be determined by querying the file information table according to the node number of the second target node.
  • the file information table includes Table 1, Table 2, and Table 3.
  • Table 1 in Figure 4 it can be queried from Table 1 that: the client whose serial number information (Client-ID) is 1 corresponds to the target node whose node serial number (Node-ID) in the second node is 1 ;
  • the target node whose node number (Node-ID) is 1 stores a file whose file identifier (PCfile-ID) is 2; based on this, the client whose number information is 1 registers the second target file required by the client, That is, the file stored in the target node whose node number is 1 and whose file ID is 2.
  • the file information table includes: the file identification (PCfile-ID) of the file, the number (Node-ID) of the second node where the file is located, the bitmap (Bitmap) of the file and the registered feature in the file. serial number.
  • PCfile-ID file identification
  • Node-ID the number of the second node where the file is located
  • bitmap Bitmap
  • serial number the number of the file.
  • the available location number of the file is determined based on the bitmap (Bitmap) of the file, and the bitmap is used to indicate the arrangement order of the available location number of the file
  • the file information table also includes: the total number of current available location numbers (vacant-Number) of the file. Wherein, the available location refers to a free storage location in the file.
  • the first node can obtain the file information of the second target file by querying Table 2 in the file information table according to the number information of the second target node , the file information at least includes the file identification available location number of the file.
  • the first node sends the file information of the second target file to the client, so that the client can process the features of object A based on the available position numbers, ensuring that after the registration is completed, the registered features corresponding to object A will be stored in the The corresponding location in the second object file.
  • the first node further sends the node number of the second target node queried based on the above Table 1 to the client.
  • the file information table also includes the object information of each registered feature in the file in the second node, and the position information of the registered feature in the file, for example, the object information can be the user name of the object,
  • the position information of the registered feature in the file may be the position number of the registered feature in the file.
  • Table 3 includes: the user name (User-ID) of the object, the characteristic identification (Cfile-ID) of the registered characteristic of the object, the file identification (PCfile-ID) of the file where the registered characteristic of the object is located -ID), the location number (slot-ID) of the registered feature of the object in the file, and the node number (Node-ID) of the node where the registered feature of the object is located.
  • the file information table may also include more information about the file, for example, the storage date of the file, the modification authority of the file, etc., which is not limited in this embodiment of the present application.
  • the first node sends a registration indication to the second node, where the registration indication carries the serial number information of the client and the file information of the second target file.
  • the first node sends a registration instruction to the second node, and sends the node number of the client corresponding to the target node queried from the file information table to the second node to indicate the node number in the second node
  • the corresponding second target node performs subsequent steps.
  • the client After receiving the file information of the second target file sent by the first node, the client encodes the features of the object A to obtain the first feature vector FA of the object A, where FA is an M-dimensional vector, where, M is a positive integer.
  • the first feature vector FA is used to represent the feature of the object A
  • FA is a face feature vector that can represent the feature of the object A extracted from the face image of the object A.
  • M is a power of 2.
  • the client obtains the second feature vector PA of the object A based on the first feature vector FA of the object A and the file information of the second target file, where PA is an N ⁇ M dimensional vector, where M and N are positive integers.
  • the file information of the second target file includes a file identifier of the second target file and an available location number of the second target file.
  • the client constructs an N ⁇ M-dimensional vector PA (vector PA includes N M-dimensional vector spaces), and encodes the M-dimensional vector FA into the Xth M In a vector space of dimension size, where X is less than or equal to N.
  • the FA is located at the position corresponding to the available position number X in the PA, and the positions other than the position corresponding to the available position number X in the PA are all 0 vectors.
  • both M and N are preset positive integers. In some embodiments, both M and N are powers of two.
  • Figure 5 includes Figures (a) and Figures (b), wherein Figure (a) in Figure 5 is a registration code provided by the embodiment of the application
  • Figure 5 (b) is a schematic diagram of a registration encryption process provided by the embodiment of the present application.
  • FA is the M-dimensional first feature vector determined based on the features of object A
  • PA is the second feature vector determined based on the encoding algorithm Encode, and its size is N ⁇ M
  • X is the first feature vector 2 Available position numbers in the object file.
  • the multiple available position numbers in the second target file can be obtained, and the multiple objects to be registered can be registered by the above encoding method
  • the first eigenvectors of are coded into the same second eigenvector respectively, realizing algorithmic parallelism and effectively improving the efficiency of information processing.
  • the client encodes the feature of the object to be registered in the available position in the second target file, so that the position of the effective information in the encrypted feature to be registered is the same as that of the second target
  • the actual available position matching of the file on the basis of ensuring the accuracy of information processing, realizes the parallelism of the algorithm, and effectively improves the efficiency of information processing.
  • the client encrypts the second feature vector PA of the object A based on the public key of the first node to obtain the encrypted feature EPA of the object A.
  • Figure (b) in Figure 5 is a schematic diagram of a registration encryption process provided by the embodiment of the present application.
  • the EPA obtained by encrypting the PA based on the public key is an N ⁇ M dimensional vector, and, based on the public key
  • the FA encrypted by the key is located in the X-th M-dimensional ciphertext vector space of EPA, where X is the available position number, and all ciphertexts in EPA except the position corresponding to the available position number X are pairs of 0 vectors
  • the encrypted ciphertext vector V0 See Figure (b) in Figure 5, where Encrypt is the encryption algorithm, PK is the public key, and FAx is the FA encrypted based on the public key.
  • the output of the encryption algorithm is EPA.
  • the encryption algorithm can be in the form of a polynomial.
  • the conditions that the degree of the polynomial needs to meet include: (1) the degree of the polynomial is a power of 2; (2) the degree of the polynomial Much larger than the feature dimension M; (3) The polynomial degree is a multiple of M.
  • the characteristics of the object are encrypted on the client side to ensure that the plaintext of user information will not appear in devices other than the client, effectively ensuring information security.
  • the client sends the EPA and the number information of the client to the second node.
  • the client sends the node number obtained from the first node to the second node, for instructing the second target node in the second node to register based on the EPA.
  • the scheduling node of the second node in the case that the number information received from the client is consistent with the number information of the client carried in the registration indication, according to the file information of the second target file , sending the registration indication and the EPA to a second target node in the second node.
  • the second node compares whether the number information of the client received from the first node is consistent with the number information of the client received from the client to ensure that the file information carried in the registration instruction is for the object ADocument information required for registration.
  • the second node effectively guarantees information security by verifying the consistency of numbering information from two different sources.
  • the file information of the second target file includes a file identifier of the second target file, a node number of a node where the second target file is located, and an available location number of the second target file.
  • the scheduling node in the second node sends the registration indication and the information received from the client to the second target node corresponding to the node number when it is determined that the registration indication is consistent with the client.
  • the scheduling node in the second node receives the node number sent by the first node and the node number sent by the client, and before sending the registration indication and the EPA received from the client to the second target node, The scheduling node further ensures information security by comparing whether the node numbers of two different sources are consistent.
  • the scheduling node in the second node can schedule multiple target nodes in parallel according to the instructions of the first node, register information for the client, and realize the Physical parallel computing greatly improves the efficiency of information processing.
  • the second target node in the second nodes adds the received encryption feature EPA of object A to the second target file.
  • the second target file includes a plurality of registered features, and the multiple registered features are all encrypted ciphertexts based on the public key. Therefore, the second target node will be based on the encrypted features encrypted by the public key, in the ciphertext state
  • add to the second target file for example, the second target node will add the encryption feature based on the public key encryption to the second target file to obtain the updated second target file, since the newly registered encryption feature can be used in addition to The parts other than the position are all 0, therefore, it will not affect other registered features in the second target file, achieving the purpose of storing multiple features in parallel in one file.
  • the EPA is an N ⁇ M dimensional vector
  • the FA encrypted based on the public key is located in the Xth M-dimensional ciphertext vector space of the EPA
  • the second target file is an N ⁇ M dimensional vector EREP2
  • the N registered features in the second target file are all in the form of M-dimensional vectors, and are respectively located in N ciphertext vector spaces of M-dimensional size.
  • X is the available position number of EREP2, that is, the X-th M-dimensional ciphertext vector space of EREP2 can be used to store new registered features.
  • the encrypted FA can be stored in the X-th M-dimensional ciphertext vector space of EREP2.
  • the second node saves the EPA and the EREP2 after adding the EPA.
  • the EREP2 includes the registered features of the object A. Understandably, since all ciphertexts in EPA except for the X-th M-dimensional ciphertext vector space are encrypted 0 vectors, in the process of adding, the existing ciphertexts other than those available in EREP2 will not be changed. Registered features are affected.
  • the embodiment of the present application provides a schematic diagram of the registration process, see Figure 6, wherein, EPA is the encryption feature of object A, and its size is N ⁇ M; EREP2 is the second target file, its size is N ⁇ M, including N registered features RV; CAdd is a ciphertext addition algorithm.
  • the second node sends adding success information to the first node.
  • the second target node in the second node returns adding success information to the scheduling node in the second node, and the scheduling node sends the adding success information to the first node.
  • the first node receives the adding success information, add the object information of the object A to the file information table, and the file information table includes the object information of each registered feature in the file in the second node and Location information of each registered feature in the file in the second node.
  • the first node adds the object information of the object A and the location information of the registered feature of the object A in the second target file to the file information table when the second node has stored the registered features of the object A.
  • the location information includes the location number of the registered feature of object A in the second object file.
  • the first node adds the object information of the object A in the file information table, for example, in Table 2 of FIG.
  • the first node can use the position number X in the table 2 corresponding to the second target file In the corresponding position, write the user name of object A, add a new column in Table 3 in Figure 4, which is used to record the user name of object A, the feature identifier of the registered feature of object A, and the location of the registered feature of object A
  • the first node sends registration success information to the client.
  • the private key and publicly available object information are stored in the first node, and the information encrypted based on the public key of the first node is stored in the second node, which ensures the separation of storage authority and decryption authority.
  • the feature information of the node does not come out of the client, multiple nodes interact based on the information mapping relationship, which can realize efficient information processing and effectively ensure information security.
  • the registration code is used to ensure that the registration is based on the available location in the second target file corresponding to the object to be registered.
  • the registration process does not affect other registered features, and the dynamic Registration improves the flexibility of information processing and improves the efficiency of information processing on the basis of ensuring information security.
  • Fig. 7 is a schematic flow chart of an information processing method provided in an embodiment of the present application. Referring to Fig. 7, the method includes:
  • the client When detecting an object B to be identified, the client sends an identification request to the first node to acquire features of the object B, and the identification request carries serial number information of the client.
  • step 301 For this step, refer to step 301.
  • the client detects a face, triggers a face-based recognition request, sends a recognition request to the first node, and processes the detected face to obtain face features .
  • the client encodes the features of the object B to obtain a first feature vector FB of the object B, where FB is an M-dimensional vector, where M is a positive integer.
  • M is a power of 2.
  • step 701 the step of sending the identification request to the first node and the step of acquiring the characteristics of the object B can be performed simultaneously or sequentially, which is not limited in this embodiment of the present application.
  • the client obtains the second feature vector PB of the object B based on the first feature vector FB of the object B, where PB is an N ⁇ M dimensional vector, where M and N are positive integers.
  • the client constructs an N ⁇ M-dimensional vector PB (the vector PB includes N M-dimensional vector spaces), and encodes the M-dimensional vector FB into each M-dimensional vector space in the PB.
  • the PB includes N FBs, where M and N are both preset positive integers. In some embodiments, both M and N are powers of two.
  • Figure 8 includes Figures (a) and Figures (b), wherein Figure (a) in Figure 8 is an identification code provided by the embodiment of the application
  • Figure 8 (b) is a schematic diagram of an identification encryption process provided by the embodiment of the present application.
  • FB is the M-dimensional first feature vector determined based on the features of the object B
  • PB is the second feature vector determined based on the encoding algorithm Encode, and its size is N ⁇ M.
  • the client encrypts the second feature vector PB of the object B based on the public key of the first node to obtain the encrypted feature EPB of the object B.
  • step 306 For this step, refer to step 306, which will not be repeated here.
  • Figure 8 (b) is a schematic diagram of an identification encryption process provided by the embodiment of the present application, wherein Encrypt is an encryption algorithm, PK is a public key, and PB is encrypted based on the public key
  • Encrypt is an encryption algorithm
  • PK is a public key
  • PB is encrypted based on the public key
  • the obtained EPB is an N ⁇ M dimensional vector
  • FBx is an encrypted FB based on the public key.
  • the client sends the EPB and the serial number information of the client to the second node.
  • the first node determines the first target file in the first target node in the second node in response to the identification request.
  • the first node determines the first target file by querying the file information table stored in the first node based on the serial number information of the client in the identification request. For the principle, refer to step 302, which will not be repeated here.
  • the target node since the registered objects corresponding to the files in the multiple target nodes included in the second node are different, it is necessary to determine the first object corresponding to the client in the second node based on the serial number information of the client.
  • the target node and then through the first target node, can obtain the first target file required for client-based identification. For example, in a face recognition-based scenario, when the client performs recognition, the first node determines the first target node corresponding to the department based on the department information carried in the recognition request after receiving the client's recognition request, thereby Identify in the department's registered face files.
  • the first node sends an identification indication to the second node, where the identification indication carries the serial number information of the client and the file information of the first target file.
  • step 303 For this step, refer to step 303, which will not be repeated here.
  • the scheduling node in the second node instructs the first target node to load the evaluation key of the first node into memory.
  • each target node in the second node stores the evaluation key of the first node. Since the data volume of the evaluation key is usually large, the node will load the evaluation key into the memory when using it, avoiding the evaluation key In other cases, it takes up running memory.
  • the scheduling node in the second node instructs the first target node corresponding to the node number to send the first
  • the node's evaluation key is loaded into memory. Based on this, when the first target node receives the identification instruction, it directly loads the evaluation key, so that when the first target node receives the encryption feature sent by the client, it can directly perform the evaluation based on the evaluation key in the memory. Identification, which saves time evaluating key loading during identification.
  • the multi-node architecture of the information processing system is fully used to physically process data in parallel, and the efficiency of information processing is greatly improved.
  • the first target node loads the evaluation key of the first node into memory.
  • the scheduling node can instruct the first target node to perform loading by sending notification information to the first target node.
  • the first target node loads the evaluation key of the first node into the memory in response to receiving the notification information.
  • the scheduling node in the second node sends a message to the second node according to the file information of the first target file
  • the first target node in sends the identification indication and the EPB.
  • step 308 For this step, refer to step 308, which will not be repeated here.
  • the scheduling node in the second node can schedule multiple target nodes in parallel according to the instructions of the first node, and identify the client.
  • the physical The parallel computing on the computer not only improves the efficiency of information processing, but also ensures the real-time performance of information recognition.
  • the first target node in the second node Based on the evaluation key of the first node, the first target node in the second node performs an inner product operation on the received encrypted feature EPB of the object B and each registered feature in the first target file to obtain a ratio to the result.
  • step 309 For the principle of this step, refer to step 309, which will not be repeated here.
  • the evaluation key of the first node used in this step is preloaded into the memory in step 709 .
  • the first target node does not pre-load the evaluation key of the first node, but starts to load the evaluation key of the first node after receiving the EPB and identification indication of the client.
  • the EPB is an N ⁇ M dimensional vector
  • the FB encrypted based on the public key is located in each M-dimensional ciphertext vector space of the EPB
  • the first target file is an N ⁇ M dimensional vector EREP1
  • the N registered features in the first target file are all in the form of M-dimensional vectors, and are respectively located in N ciphertext vector spaces of M-dimensional size.
  • the second node Based on the evaluation key, the second node performs ciphertext inner product operation on EPB and EREP1 in the ciphertext vector space to obtain the comparison result EIPR.
  • each M-dimensional ciphertext vector space in EPB stores the encrypted FB based on the public key, therefore, based on the ciphertext inner product operation, the N registered The result of the inner product operation between the features and the encrypted FB.
  • the inner product operation essentially compares the similarity between vectors. Therefore, the EIPR includes comparing N registered features with the encrypted FB to obtain the similarity in N encrypted states.
  • EPB is the encrypted feature of object B, which is an N ⁇ M dimensional vector
  • EREP1 is the first object
  • the file is an N ⁇ M dimensional vector
  • CinnerProduct is the ciphertext inner product algorithm
  • EIPR is the comparison result, which is an N ⁇ M dimensional vector.
  • the ciphertext inner product operation in the embodiment of the present application is a multidimensional vector multiplication process.
  • the dimension expansion of the ciphertext vector caused by vector multiplication is controlled.
  • the expanded ciphertext feature dimension is restored to the original ciphertext feature dimension through key exchange, so as to reduce the error caused by calculation in the ciphertext state and improve the accuracy of information processing , for example, the hierarchical fully homomorphic CKKS algorithm and the hierarchical fully homomorphic BFV algorithm.
  • the inner product operation is to calculate the Euclidean distance, and in other embodiments, the inner product operation is to calculate the cosine distance, which is not limited in this embodiment of the present application.
  • the information identification process involves multiple first target nodes, and the second node can schedule the multiple first target nodes based on their respective stored first target files and in parallel based on the received
  • the encryption feature EPB of the object B is operated, and multiple comparison results determined by multiple first target nodes are obtained.
  • the second node sends the comparison result to the first node.
  • the first target node in the second node returns the comparison result to the scheduling node in the second node, and the scheduling node sends the multiple received comparison results to the first node.
  • the first node When the first node receives the comparison result, it decrypts the comparison result based on the private key of the first node, and determines the target feature based on the decrypted comparison result, and the target feature is the same as the The registered feature with the greatest similarity between the features of object B.
  • the first node holds the private key, and according to the principle of homomorphic encryption, the result after decrypting the comparison result is equivalent to the difference between the characteristics of object B and the characteristics of each registered object in the unencrypted state. Similarity between. Understandably, among the multiple similarities obtained after decryption, the registered object corresponding to the highest similarity can be considered as the same object as the object B.
  • the decrypted comparison result is N M-dimensional result vectors R, see FIG. 9, in each result vector R, the numerical value on the target dimension is used to represent the similarity of its corresponding registered features Degree, for example, the comparison result is N 128-dimensional result vectors R, and the value of the first dimension of each R is similarity.
  • the first node obtains the serial number of the result vector with the largest similarity value from the decrypted comparison result, and determines the registered feature corresponding to the serial number in the first target file as the target feature.
  • a similarity threshold is set. After the maximum similarity is determined, if the similarity is greater than the similarity threshold, the registered feature corresponding to the similarity is determined as the target feature to further ensure the comparison the accuracy of the results.
  • the first node Based on the position information of the target feature in the first target file, the first node acquires the object information of the target feature from the file information table, and determines the object information of the target feature as the object information of object B,
  • the file information table includes object information of each registered feature in the file in the second node and position information of each registered feature in the file in the second node.
  • the position information of the target feature in the first target file includes a position number of the target feature in the first target file.
  • the first node can query the object information of the target feature from the file information table.
  • the object information can be the registered The username of the object.
  • the object information of the object B is determined.
  • the object information includes the identity information of the registered object corresponding to the target feature, such as name, age, ID number, etc., which is not limited in this embodiment of the present application.
  • the first node sends object information of object B to the client.
  • the private key and publicly available object information are stored in the first node, and the information encrypted based on the public key of the first node is stored in the second node, which ensures the separation of storage authority and decryption authority.
  • the feature information of the node does not come out of the client, multiple nodes interact based on the information mapping relationship, which can realize efficient information processing and effectively ensure information security.
  • one-to-many information identification can be realized based on one set of keys, which effectively solves the problem of occupying a large amount of storage space in order to store multiple sets of keys corresponding to multiple registered features.
  • the features of the object to be identified are encoded into a multi-dimensional vector matching the dimensions of the first target file, and the features of the object to be identified can be compared with multiple registered objects in parallel. Yes, it is equivalent to completing the information processing process for multiple registered objects within one processing cycle, which greatly improves the efficiency of information processing.
  • Fig. 10 is a schematic flow chart of an information processing method provided in an embodiment of the present application. Referring to Fig. 10, the method includes:
  • the client sends a deregistration request to the first node based on the object information of the object C to be deregistered, and the deregistration request carries the serial number information of the client and the object information of the object C to be deregistered.
  • step 301 For this step, refer to step 301, which will not be repeated here.
  • the first node determines the third target file in which the registered feature corresponding to the object C in the third target node of the second node is located.
  • object C is an object that has been registered and is to be canceled. Therefore, the object information of object C and the registered features corresponding to object C in the file in the second node are stored in the file information table. location information.
  • the first node can determine the third target node by querying the file information table based on the information number of the client carried in the request to be registered in response to the deregistration request. Based on the object information of the object C, query the file information table to directly determine the third object file where the registered feature corresponding to the object C is located. For the principle of this step, refer to step 302, which will not be repeated here.
  • the first node sends a logout instruction to the second node, where the logout instruction carries the serial number information of the client and the file information of the third target file.
  • step 303 For this step, refer to step 303, which will not be repeated here.
  • the scheduling node in the second node sends a message to A third target node in the second node sends the logout indication.
  • step 308 For this step, refer to step 308, which will not be repeated here.
  • the third target node in the second node deletes the registered feature EPC corresponding to the object C from the third target file based on the file information of the third target file.
  • the registered feature EPC of object C is saved (refer to the process of adding EPA in step 309), therefore, the second node according to the file of the third object file Information, based on the file identification of the third target file EREP3 and the feature identification of the registered feature EPC of the object C, obtain EREP3 and EPC, subtract EPC and EREP3 in the ciphertext vector space, and save the EREP3 after deleting the EPC.
  • step 309 For the principle of this step, refer to step 309, which will not be repeated here.
  • the embodiment of this application provides a schematic diagram of the cancellation process, see Figure 11, where EPC is the registered feature of object C, and its size is N ⁇ M; FCx is in the process of object C registration Based on the feature of object C, encryption is obtained after registration and encoding (referring to step 304 to step 306); EREP3 is the third target file, and its size is N ⁇ M; X is the position number of the registered feature of object C in EREP3; Csubtract is Ciphertext Subtraction Algorithm.
  • the second node sends deletion success information to the first node.
  • step 310 For this step, refer to step 310, and details are not repeated here.
  • the first node After receiving the deletion success information, the first node deletes the object information of the object C and the position information of the registered feature corresponding to the object C in the third object file from the file information table.
  • the information table includes the object information of each registered feature in the file in the second node and the position information of each registered feature in the file in the second node.
  • the first node deletes the object information of object C and the position information of the registered feature of object C in the second target file from the file information table when the second node has deleted the registered feature of object C. This step is the same as step 311, and will not be repeated here.
  • the first node sends logout success information to the client.
  • the private key and publicly available object information are stored in the first node, and the information encrypted based on the public key of the first node is stored in the second node, which ensures the separation of storage authority and decryption authority.
  • the feature information does not come out of the client, multiple nodes interact based on the information mapping relationship to achieve efficient information processing and effectively ensure information security.
  • Dynamic logout improves the flexibility of information processing and improves the efficiency of information processing on the basis of ensuring information security.
  • the embodiment of the present application provides another information processing system, see FIG. 12, which is a schematic diagram of the architecture of an information processing system provided in the embodiment of the present application.
  • the information processing system 1200 includes a client 1210, a third node 1220 and The fourth node 1230 .
  • the client 1210 is used to obtain the feature of the object to be identified when the object to be identified is detected, and encrypt the acquired feature of the object to be identified based on the public key 1221 of the third node 1220 to obtain the encrypted feature, and send The third node 1220 sends the encryption feature and the identification request, instructing the third node to identify the client 1210 .
  • the third node 1220 is used to store the file information table and the files where the registered features are located.
  • the third node 1220 is configured to respond to the identification request of the client, based on the file information table, the evaluation key 1222 of the third node 1220, and the stored files, compare the encrypted features received from the client to obtain a comparison result, Send the comparison result to the fourth node 1230 .
  • the fourth node 1230 is configured to decrypt the received comparison result based on the private key 1223 of the third node 1220 , and send the decrypted comparison result to the third node 1220 .
  • the third node 1220 is further configured to determine object information (for example, identity information) of the object to be identified based on the decrypted comparison result, and send the object information to the client 1210 .
  • object information for example, identity information
  • the client 1210, the third node 1220 and the fourth node 1230 are connected through a wired network or a wireless network.
  • the wireless or wired network described above uses standard communication techniques and/or protocols.
  • the network is usually the Internet, but can be any network, including but not limited to local area network (LAN), metropolitan area network (MAN), wide area network (WAN), mobile, wired or wireless Any combination of network, private network, or virtual private network.
  • peer-to-peer (P2P) communication is implemented among the client 1210, the third node 1220 and the fourth node 1230 based on a remote procedure call protocol (remote procedure call protocol, RPC).
  • RPC remote procedure call protocol
  • the client 1210, the third node 1220, and the fourth node 1230 use technologies including hyper text markup language (hyper text markup language, HTML), extensible markup language (extensible markup language, XML) and/or or format to represent data exchanged over a network.
  • hyper text markup language hyper text markup language
  • extensible markup language extensible markup language
  • XML extensible markup language
  • custom and/or dedicated data communication techniques can also be used instead of or in addition to the data communication techniques described above.
  • the client refers to a terminal or server on the user side.
  • a terminal is also called a smart terminal or a mobile smart terminal, which refers to a type of device that has rich human-computer interaction methods, has the ability to access the Internet, is usually equipped with various operating systems, and has strong processing capabilities.
  • the types of mobile smart terminals include, but are not limited to, smart phones, tablet computers, vehicle-mounted terminals, handheld game consoles, and the like.
  • the server may be a server cluster composed of one or more computing devices.
  • the third node and the fourth node can be independent physical servers, or server clusters or distributed systems composed of multiple physical servers, and can also provide cloud services, cloud databases, cloud computing, Cloud servers for basic cloud computing services such as cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.
  • cloud services such as cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.
  • FIG. 12 introduces the architecture of another information processing system provided by the embodiment of the present application from the perspective of system architecture.
  • the following describes the hardware structures of the client, the third node, and the fourth node in the information processing system.
  • FIG. 2 provides a computing device, which can be configured as any one of the client, the second node, or the third node in the information processing system 1200. Refer to FIG. 2 , and details will not be described here.
  • the process of determining a pair of public key, secret key and evaluation key is performed by the third node through the key generation algorithm, and the third node configures the public key to the client, and the public key is used to obtain The characteristics of the received object are encrypted; the private key is sent to the fourth node, and the private key is used to decrypt the encrypted information.
  • the private key is only held by the fourth node, that is, only the fourth node can Decrypt the encrypted information in the information processing system.
  • the fourth node stores the private key in secure hardware, for example, a trusted execution environment (trusted execution environment, TEE), so as to ensure the security of the private key.
  • TEE trusted execution environment
  • the evaluation key is used to perform homomorphic operation on the encrypted feature (ciphertext).
  • the third node can configure the public key and the evaluation key to any node in the information processing system, which is not limited in this embodiment of the present application.
  • Fig. 13 is a schematic flow chart of an information processing method provided by an embodiment of the present application. Referring to Fig. 13, the method includes:
  • the client Based on the object information of the object A to be registered, the client sends a registration request to the third node to obtain the characteristics of the object A.
  • the registration request carries the serial number information of the client and the object information of the object A.
  • step 301 For this step, refer to step 301, which will not be repeated here.
  • the third node determines the file information of the second target file in the third node in response to the registration request, and sends the file information of the second target file to the client.
  • step 302 For this step, refer to step 302, which will not be repeated here.
  • the client After receiving the file information of the second target file sent by the third node, the client encodes the features of the object A to obtain the first feature vector FA of the object A, where FA is an M-dimensional vector, where, M is a positive integer.
  • step 304 For this step, refer to step 304, which will not be repeated here.
  • the client obtains the second feature vector PA of the object A based on the first feature vector FA of the object A and the file information of the second target file, where PA is an N ⁇ M dimensional vector, where M and N are positive integers.
  • step 305 For this step, refer to step 305, which will not be repeated here.
  • the client encrypts the second feature vector PA of the object A based on the public key of the third node to obtain the encrypted feature EPA of the object A.
  • step 306 For this step, refer to step 306, which will not be repeated here.
  • the client sends the EPA and the number information of the client to the third node.
  • the third node adds the received encryption feature EPA of object A to the second target file according to the file information of the second target file and the serial number information of the client.
  • step 309 For this step, refer to step 309, which will not be repeated here.
  • the third node adds the object information of object A to the file information table, and the file information table includes the object information of each registered feature in the file in the third node And the position information of each registered feature in the file in the third node.
  • step 311 For this step, refer to step 311, and details are not described here.
  • the third node sends registration success information to the client.
  • the information based on public key encryption and the object information that can be disclosed is stored in the third node, and the private key is stored in the fourth node, which ensures the separation of storage authority and decryption authority.
  • the client multiple nodes interact based on the information mapping relationship to achieve efficient information processing and effectively ensure information security.
  • the fourth node is only used to provide the decryption service, the process of information exchange between multiple nodes is simplified, and the efficiency of information processing is effectively improved.
  • the registration code is used to ensure that the registration is based on the available location in the second target file corresponding to the object to be registered, and the registration process does not affect other registered features, and the encrypted state is realized.
  • the dynamic registration under the system improves the flexibility of information processing, and improves the efficiency of information processing on the basis of ensuring information security.
  • Fig. 14 is a schematic flow chart of an information processing method provided by an embodiment of the present application. Referring to Fig. 14, the method includes:
  • the client When detecting an object B to be identified, the client sends an identification request to a third node, and extracts features of the object B, where the identification request carries serial number information of the client.
  • step 701 For this step, refer to step 701, and details are not repeated here.
  • the client encodes the features of the object B to obtain a first feature vector FB of the object B, where FB is an M-dimensional vector, where M is a positive integer.
  • step 702 For this step, refer to step 702, which will not be repeated here.
  • the client obtains the second feature vector PB of the object B based on the first feature vector FB of the object B, where PB is an N ⁇ M dimensional vector, where M and N are positive integers.
  • step 703 For this step, refer to step 703, which will not be repeated here.
  • the client encrypts the second feature vector PB of the object B based on the public key of the third node to obtain the encrypted feature EPB of the object B.
  • step 704 For this step, refer to step 704, which will not be repeated here.
  • the client sends the EPB to the third node.
  • the third node loads the evaluation key of the third node into memory in response to the identification request.
  • step 708 and step 709 which will not be repeated here.
  • the third node determines the file information of the first target file in the third node according to the serial number information of the client.
  • step 706 For this step, refer to step 706, which will not be repeated here.
  • step 1406 and step 1407 may be executed synchronously or sequentially, which is not limited in this embodiment of the present application.
  • the third node Based on the evaluation key of the third node, the third node performs an inner product operation on the received encrypted feature EPB of the object B and each registered feature in the first object file to obtain a comparison result.
  • step 711 For the principle of this step, refer to step 711, which will not be repeated here.
  • the third node sends the comparison result to the fourth node.
  • the fourth node After receiving the comparison result, the fourth node decrypts the comparison result based on the private key of the third node, and sends the decrypted comparison result to the third node.
  • step 713 For the principle of this step, refer to step 713, which will not be repeated here.
  • the third node determines the target feature based on the decrypted comparison result, and the target feature is the registered feature with the largest similarity with the feature of the object B.
  • step 713 For the principle of this step, refer to step 713, which will not be repeated here.
  • the third node Based on the position information of the target feature in the first target file, the third node acquires the object information of the target feature from the file information table, and determines the object information of the target feature as the object information of object B,
  • the file information table includes object information of each registered feature in the file in the third node and position information of each registered feature in the file in the third node.
  • step 714 For the principle of this step, refer to step 714, which will not be repeated here.
  • the third node sends the object information of the object B to the client.
  • the information based on public key encryption and the object information that can be disclosed is stored in the third node, and the private key is stored in the fourth node, which ensures the separation of storage authority and decryption authority.
  • the client multiple nodes interact based on the information mapping relationship to achieve efficient information processing and effectively ensure information security.
  • the fourth node is only used to provide the decryption service, the process of information exchange between multiple nodes is simplified, and the efficiency of information processing is effectively improved.
  • one-to-many information identification can be realized based on one set of keys, which effectively solves the problem of occupying a large amount of storage space in order to store multiple sets of keys corresponding to multiple registered features.
  • the features of the object to be identified are encoded into a multi-dimensional vector matching the dimensions of the first target file, and the features of the object to be identified can be combined with multiple registered Object comparison is equivalent to completing the information processing process for multiple registered objects within one processing cycle, which greatly improves the efficiency of information processing.
  • Fig. 15 is a schematic flowchart of an information processing method provided in an embodiment of the present application. Referring to Fig. 15, the method includes:
  • the client sends a deregistration request to a third node based on the object information of the object C to be deregistered, and the deregistration request carries the serial number information of the client and the object information of the object C to be deregistered.
  • step 1001 For this step, refer to step 1001, which will not be repeated here.
  • the third node determines the file information of the third target file where the registered feature corresponding to the object C in the third target node of the third node is located.
  • step 1002 For this step, refer to step 1002, which will not be repeated here.
  • the third node deletes the registered feature EPC corresponding to the object C from the third object file based on the file information of the third object file.
  • step 1005 For this step, refer to step 1005, which will not be repeated here.
  • the third node deletes the object information of the object C and the position information of the registered feature corresponding to the object C in the third target file from the file information table , the file information table includes the object information of each registered feature in the file in the third node and the position information of each registered feature in the file in the third node.
  • step 1007 For this step, refer to step 1007, which will not be repeated here.
  • the third node sends logout success information to the client.
  • the information based on public key encryption and the object information that can be disclosed is stored in the third node, and the private key is stored in the fourth node, which ensures the separation of storage authority and decryption authority.
  • the client multiple nodes interact based on the information mapping relationship to achieve efficient information processing and effectively ensure information security.
  • the fourth node is only used to provide the decryption service, the process of information exchange between multiple nodes is simplified, and the efficiency of information processing is effectively improved.
  • the third node in order to further improve the parallel operation efficiency of the third node, it can be configured based on various aspects of the node, for example, based on software, use OpenMP to implement parallel operation on data through multi-threading.
  • an FPGA accelerator card is deployed in the information processing system to improve the parallel data processing capability of the information processing system.
  • the embodiment of the present application provides a schematic diagram of the architecture of an information processing system, as shown in FIG. 16 , wherein, by deploying an FPGA accelerator card in the third node of the information processing system 1600, the parallelism of data calculation performed by the third node is improved, wherein, For the overall architecture of the information processing system 1600 , refer to the information processing system 1200 corresponding to FIG. 12 , which will not be repeated here.
  • first and second are used to distinguish the same or similar items with basically the same function and function. It should be understood that “first”, “second” and “nth” There are no logical or timing dependencies, nor are there restrictions on quantity or order of execution. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, a first client could be termed a second client, and, similarly, a second client could be termed a first client, without departing from the scope of the various described examples. Both the first client and the second client may be clients, and in some cases, separate and distinct clients.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a program product.
  • the program product includes one or more program instructions. When the program instructions are loaded and executed on the computing device, all or part of the processes or functions according to the embodiments of the present application will be generated.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Bioethics (AREA)
  • Computing Systems (AREA)
  • Human Computer Interaction (AREA)
  • Multimedia (AREA)
  • Oral & Maxillofacial Surgery (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Storage Device Security (AREA)

Abstract

本申请公开了一种信息处理系统、方法、设备及存储介质，属于计算机技术领域。本申请实施例提供的技术方案中，在第一节点中存储私钥以及可公开的对象信息，在第二节点中存储基于第一节点的公钥加密得到的信息，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。

Description

信息处理系统、方法、设备及存储介质
本申请要求于2021年11月25日提交的申请号为202111415970.4、发明名称为“信息保护的方法、装置和系统”的中国专利申请的优先权以及于2022年01月24日提交的申请号为202210080192.6、发明名称为“信息处理系统、方法、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，特别涉及一种信息处理系统、方法、设备及存储介质。
背景技术
随着大数据时代的来临，具有唯一性和隐私性的用户信息，例如，人脸信息，常用于识别用户的身份。为了保护用户信息不被泄露，目前，在基于一对一的信息处理过程进行人脸验证时，通常会在客户端对人脸信息进行加密，使得服务器需要基于客户端生成的密钥，才能将加密后的人脸信息和已知的人脸信息进行比对。
但是，上述技术方案在面对更复杂的信息处理需求时，例如，需要基于一对多的信息处理过程实现人脸识别时，无法保证用户信息的安全。因此，亟需一种信息处理方法，能够在基于用户信息进行信息处理的过程中，有效保障用户的信息安全。
发明内容
本申请提供了一种信息处理系统、方法、设备及存储介质，能够有效保证信息安全。该技术方案如下：
第一方面，提供了一种信息处理系统，该信息处理系统包括：客户端、第一节点和第二节点；
该客户端，用于向该第一节点发送携带有该客户端的编号信息的识别请求，向该第二节点发送待识别的第一对象的加密特征和该客户端的编号信息，该第一对象的加密特征基于该第一节点的公钥和该第一对象的特征得到；
该第一节点，用于响应于该识别请求，确定该第二节点中的第一目标文件，向该第二节点发送识别指示，该识别指示携带该客户端的编号信息和该第一目标文件的文件信息；
该第二节点，用于响应于该识别指示，基于接收到的该第一对象的加密特征、该客户端的编号信息、该第一目标文件的文件信息以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果，向该第一节点发送该比对结果；
该第一节点，还用于在接收到该比对结果的情况下，基于该第一节点的私钥对该比对结果进行解密，基于解密后的比对结果，得到该第一对象的对象信息，向该客户端发送该第一对象的对象信息。
其中，对象信息包括信息处理系统中用于标识对象的信息，例如，在人脸识别的场景下，对象信息是指用户在人脸识别系统中注册时输入的用户名。在另一些实施例中，该对象信息包括对象的身份信息，例如，在人脸识别的场景下，对象信息包括用户在人脸识别系统中注 册时输入的姓名、年龄和身份证号等。
通过上述技术方案，在第一节点中存储私钥以及可公开的对象信息，在第二节点中存储基于第一节点的公钥加密得到的信息，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。并且，通过上述技术方案，基于一套密钥即可实现一对多的信息识别，有效解决了为了存储多个已注册特征对应的多套密钥而占用大量存储空间的问题。
在一种可能实施方式中，该客户端，还用于基于该第一对象的特征进行编码，得到该第一对象的第一特征向量，该第一特征向量为M维向量；
基于该第一对象的第一特征向量，得到该第一对象的第二特征向量，该第一对象的第二特征向量为N×M维向量，且该第一对象的第二特征向量包括N个该第一对象的第一特征向量；
基于该第一节点的公钥，对该第一对象的第二特征向量进行加密，得到该第一对象的加密特征；
其中，M和N为正整数。
在上述技术方案中，在进行信息识别的过程中，将待识别的对象的特征编码为与第一目标文件的维度匹配的多维向量，能够并行地将待识别的对象的特征与多个已注册对象进行比对，等同于在一个处理周期内完成了针对多个已注册对象的信息处理过程，大大提升了信息处理的效率。
在一种可能实施方式中，该第二节点包括调度节点和多个目标节点；
该第一节点，用于基于该识别请求中该客户端的编号信息，从文件信息表中确定该第二节点中该客户端对应的第一目标节点，从该文件信息表中确定该第一目标节点中的该第一目标文件的文件信息，该文件信息表包括客户端的编号信息与该第二节点包括的多个目标节点之间的对应关系，以及，该多个目标节点与文件之间的对应关系。
在一种可能实施方式中，该第二节点中的调度节点，用于响应于该识别指示，指示该第一目标节点将该第一节点的评估密钥加载到内存中。
上述技术方案中，第一目标节点在接收到识别指示的情况下，直接进行评估密钥的加载，使得第一目标节点接收到客户端发送的加密特征时，即可直接基于内存中的评估密钥进行识别，节省了识别过程中评估密钥加载的时间。
通过上述技术方案，充分利用了信息处理系统的多节点架构在物理上对数据的并行处理能力，大大提升了信息处理的效率。
在一种可能实施方式中，该第二节点中的调度节点，用于响应于该识别指示，根据该第一目标文件的文件信息以及该客户端的编号信息，向该第二节点中的第一目标节点发送该识别指示以及该第一对象的加密特征；
该第一目标节点，响应于该识别指示，基于接收到的该第一对象的加密特征、该第一目标文件以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果。
通过上述技术方案，第二节点中的调度节点能够根据第一节点的指示，并行地调度多个目标节点，针对客户端进行识别，通过目标节点与客户端编号之间的对应关系，实现了物理上的并行运算，在提升信息处理效率的同时，保证了信息识别的实时性。
在一种可能实施方式中，该第二节点中的调度节点，用于响应于该识别指示，在从该客 户端接收到的该编号信息和该识别指示携带的客户端的编号信息一致的情况下，根据该第一目标文件的文件信息，向该第二节点中的第一目标节点发送该识别指示以及该第一对象的加密特征。
上述技术方案中，通过对两个不同来源的编号信息进行一致性验证，有效保证了信息安全。
在一种可能实施方式中，该第二节点中的第一目标节点，用于基于该第一节点的评估密钥，对接收到的该第一对象的加密特征和该第一目标文件中各个已注册特征在密文态下进行内积运算，得到比对结果。
在一种可能实施方式中，该第一节点，用于基于该解密后的比对结果，确定目标特征，该目标特征是与该第一对象的特征之间的相似度最大的已注册特征；
基于该目标特征在该第一目标文件中的位置信息，从文件信息表中，获取该目标特征的对象信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息；
将该目标特征的对象信息，确定为该第一对象的对象信息。
在一种可能实施方式中，该客户端，还用于向该第一节点发送注册请求，该注册请求携带该客户端的编号信息和待注册的第二对象的对象信息；
该第一节点，还用于响应于该注册请求，确定该第二节点中第二目标节点中的第二目标文件，向该客户端发送该第二目标文件的文件信息，向该第二节点发送注册指示，该注册指示携带该客户端的编号信息和该第二目标文件的文件信息；
该客户端，还用于向该第二节点发送该第二对象的加密特征和该客户端的编号信息，该第二对象的加密特征基于该第一节点的公钥、该第二对象的特征和该第二目标文件的文件信息得到；
该第二节点，还用于响应于该注册指示，基于接收到的该第二对象的加密特征、该客户端的编号信息、该第二目标文件的文件信息以及该第一节点的评估密钥，通过该第二目标节点，将该第二对象的加密特征添加至该第二目标文件中，向该第一节点发送添加成功信息；
该第一节点，还用于在接收到该添加成功信息的情况下，将该第二对象的对象信息添加至文件信息表，向该客户端发送注册成功信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息。
在一种可能实施方式中，该第二目标文件的文件信息包括第二目标文件的可用位置编号；
该客户端，还用于对该第二对象的特征进行编码，得到该第二对象的第一特征向量，该第二对象的第一特征向量为M维向量；
基于该第二对象的第一特征向量和该可用位置编号，得到该第二对象的第二特征向量，该第二对象的第二特征向量为N×M维向量，且该第二对象的第一特征向量位于该第二对象的第二特征向量中该可用位置编号对应的位置，该第二对象的第二特征向量中该可用位置编号对应的位置以外的位置为0；
基于该第一节点的公钥，对该第二对象的第二特征向量进行加密，得到该第二对象的加密特征；
其中，M和N为正整数。
通过上述技术方案，进行注册的过程中，通过注册编码，保证注册是基于待注册对象对 应的第二目标文件中的可用位置进行的，注册过程不影响其他已注册特征，实现了加密状态下的动态注册，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
在一种可能实施方式中，该客户端，还用于向该第一节点发送注销请求，该注销请求携带该客户端的编号信息和待注销的第三对象的对象信息；
该第一节点，还用于响应于该注销请求，确定该第二节点中的第三目标节点中该第三对象对应的已注册特征所在的第三目标文件，向该第二节点发送注销指示，该注销指示携带该客户端的编号信息和该第三目标文件的文件信息，该第三目标文件的文件信息包括该第三对象对应的已注册特征在该第三目标文件中的位置编号；
该第二节点，还用于响应于该注销指示，基于该客户端的编号信息、该第三目标文件的文件信息以及该第一节点的评估密钥，通过该第三目标节点，将该第三对象对应的已注册特征从该第三目标文件中删除，向该第一节点发送删除成功信息；
该第一节点，还用于在接收到该删除成功信息的情况下，从文件信息表中删除该第三对象的对象信息以及该第三对象对应的已注册特征在该第三目标文件中的位置信息，向该客户端发送注销成功信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息。
通过上述技术方案，在进行信息注销的过程中，基于文件信息表中存储的信息映射关系，保证注销是针对待注销对象的已注册特征进行的，注销过程不影响其他已注册特征，实现了加密状态下的动态注销，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
第二方面，提供了一种信息处理系统，该信息处理系统包括：客户端、第三节点和第四节点；
该客户端，用于向该第三节点发送有携带该客户端的编号信息的识别请求和待识别的第一对象的加密特征，该第一对象的加密特征基于该第三节点的公钥和该第一对象的特征得到；
该第三节点，用于响应于该识别请求，确定该第三节点中的第一目标文件的文件信息，基于接收到的该第一对象的加密特征、该第一目标文件的文件信息以及该第三节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果，向该第四节点发送该比对结果；
该第四节点，用于在接收到该比对结果的情况下，基于该第三节点的私钥对该比对结果进行解密，向该第三节点发送解密后的比对结果；
该第三节点，还用于基于接收到的该解密后的比对结果，得到该第一对象的对象信息，向该客户端发送该第一对象的对象信息。
通过上述技术方案，在第三节点中存储基于公钥加密的信息以及可公开的对象信息，在第四节点中存储私钥，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。进一步地，第四节点仅用于提供解密服务，多个节点之间的信息交互的过程简化，信息处理的效率有效提升。
在一种可能实施方式中，该客户端，还用于基于该第一对象的特征进行编码，得到该第一对象的第一特征向量，该第一特征向量为M维向量；
基于该第一对象的第一特征向量，得到该第一对象的第二特征向量，该第一对象的第二特征向量为N×M维向量，且该第一对象的第二特征向量包括N个该第一对象的第一特征向 量；
基于该第三节点的公钥，对该第二特征向量进行加密，得到该第一对象的加密特征；
其中，M和N为正整数。
在一种可能实施方式中，该第三节点，用于基于该识别请求中该客户端的编号信息，从文件信息表中确定该第一目标文件的文件信息，该文件信息表包括客户端的编号信息与该第三节点中的文件之间的对应关系。
在一种可能实施方式中，该第三节点，用于响应于该识别请求，将第三节点的评估密钥加载到内存中。
在一种可能实施方式中，该第三节点，用于响应于该识别请求，根据该客户端的编号信息，确定第三节点中的第一目标文件的文件信息；
基于接收到的该第一对象的加密特征、该第一目标文件以及该第三节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果。
在一种可能实施方式中，该第三节点，用于基于该第三节点的评估密钥，对接收到的该第一对象的加密特征和该第一目标文件中各个已注册特征进行内积运算，得到比对结果。
在一种可能实施方式中，该第三节点，用于基于该解密后的比对结果，确定目标特征，该目标特征是与该第一对象的特征之间的相似度最大的已注册特征；
基于该目标特征在该第一目标文件中的位置信息，从文件信息表中，获取该目标特征的对象信息，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息；
将该目标特征的对象信息，确定为该第一对象的对象信息。
在一种可能实施方式中，该客户端，还用于向该第三节点发送注册请求，该注册请求携带该客户端的编号信息和待注册的第二对象的对象信息；
该第三节点，还用于响应于该注册请求，基于该客户端的编号信息，确定该第三节点中的第二目标文件，向该客户端发送该第二目标文件的文件信息；
该客户端，还用于向该第三节点发送该第二对象的加密特征，该第二对象的加密特征基于该第三节点的公钥、该第二对象的特征和该第二目标文件的文件信息得到；
该第三节点，还用于基于接收到的该第二对象的加密特征、该第二目标文件的文件信息以及该第三节点的评估密钥，将该第二对象的加密特征添加至该第二目标文件中；
该第三节点，还用于在该第二对象的加密特征添加成功的情况下，将该第二对象的对象信息添加至文件信息表，向该客户端发送注册成功信息，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息。
在一种可能实施方式中，该第二目标文件的文件信息包括第二目标文件的可用位置编号；
该客户端，还用于对该第二对象的特征进行编码，得到该第二对象的第一特征向量，该第二对象的第一特征向量为M维向量；
基于该第二对象的第一特征向量和该可用位置编号，得到该第二对象的第二特征向量，该第二对象的第二特征向量为N×M维向量，且该第二对象的第一特征向量位于该第二对象的第二特征向量中该可用位置编号对应的位置，该第二对象的第二特征向量中该可用位置编号对应的位置以外的位置为0；
基于该第三节点的公钥，对该第二对象的第二特征向量进行加密，得到该第二对象的加密特征；
其中，M和N为正整数。
上述技术方案中，在进行信息注册的过程中，通过注册编码，保证注册是基于待注册对象对应的第二目标文件中的可用位置进行的，注册过程不影响其他已注册特征，实现了加密状态下的动态注册，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
在一种可能实施方式中，该客户端，还用于向该第三节点发送注销请求，该注销请求携带该客户端的编号信息和待注销的第三对象的对象信息；
该第三节点，还用于响应于该注销请求，确定该多个第三节点中该第三对象对应的已注册特征所在的第三目标文件；
该第三节点，还用于基于该第三目标文件的文件信息和该第三节点的评估密钥，将该第三对象对应的已注册特征从该第三目标文件中删除，该第三目标文件的文件信息包括该第三对象对应的已注册特征在该第三目标文件中的位置编号；
该第三节点，还用于在该第三对象对应的已注册特征删除成功的情况下，从文件信息表中删除该第三对象的对象信息以及该第三对象对应的已注册特征在该第三目标文件中的位置信息，向该客户端发送注销成功信息，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息。
通过上述技术方案，在进行信息注销的过程中，基于文件信息表中存储的信息映射关系，保证注销是针对待注销对象的已注册特征进行的，注销过程不影响其他已注册特征，实现了加密状态下的动态注销，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
第三方面，提供了一种信息处理方法，由信息处理系统中的客户端执行，该信息处理系统还包括第一节点和第二节点，该方法包括：
向该第一节点发送携带有该客户端的编号信息的识别请求；
向该第二节点发送待识别的第一对象的加密特征和该客户端的编号信息，该第一对象的加密特征基于该第一节点的公钥和该第一对象的特征得到；
从该第一节点接收到该第一对象的对象信息，该第一对象的对象信息基于该第一对象的加密特征、该第一节点的评估密钥以及该第一节点的私钥得到。
在一种可能实施方式中，该向该第二节点发送待识别的第一对象的加密特征和该客户端的编号信息之前，该方法还包括：
基于该第一对象的特征进行编码，得到该第一对象的第一特征向量，该第一特征向量为M维向量；
基于该第一对象的第一特征向量，得到该第一对象的第二特征向量，该第一对象的第二特征向量为N×M维向量，且该第一对象的第二特征向量包括N个该第一对象的第一特征向量；
基于该第一节点的公钥，对该第一对象的第二特征向量进行加密，得到该第一对象的加密特征；
其中，M和N为正整数。
在一种可能实施方式中，该方法还包括：
向该第一节点发送注册请求，该注册请求携带该客户端的编号信息和待注册的第二对象的对象信息；
向该第二节点发送该第二对象的加密特征和该客户端的编号信息，该第二对象的加密特征基于该第一节点的公钥、该第二对象的特征和该第二节点中的第二目标文件的文件信息得到，该第二目标文件的文件信息由该第一节点响应于该注册请求确定；
从该第一节点接收到注册成功信息。
在一种可能实施方式中，该第二目标文件的文件信息包括第二目标文件的可用位置编号，该向该第二节点发送该第二对象的加密特征和该客户端的编号信息之前，该方法还包括：
基于该第二对象的特征进行编码，得到该第二对象的第一特征向量，该第二对象的第一特征向量为M维向量；
基于该第二对象的第一特征向量和该可用位置编号，得到该第二对象的第二特征向量，该第二对象的第二特征向量为N×M维向量，且该第二对象的第一特征向量位于该第二对象的第二特征向量中该可用位置编号对应的位置，该第二对象的第二特征向量中该可用位置编号对应的位置以外的位置为0；
基于该第一节点的公钥，对该第二对象的第二特征向量进行加密，得到该第二对象的加密特征；
其中，M和N为正整数。
在一种可能实施方式中，该方法还包括：
向该第一节点发送注销请求，该注销请求携带该客户端的编号信息和待注销的第三对象的对象信息；
从该第一节点接收到注销成功信息。
第四方面，提供了一种信息处理方法，由信息处理系统中的第一节点执行，该信息处理系统还包括客户端和第二节点，该方法包括：
响应于从客户端接收到的携带有该客户端的编号信息的识别请求，确定该第二节点中的第一目标文件，向该第二节点发送识别指示，该识别指示携带该客户端的编号信息和该第一目标文件的文件信息；
在从该第二节点接收到比对结果的情况下，基于该第一节点的私钥对该比对结果进行解密，基于解密后的比对结果，得到该第一对象的对象信息，向该客户端发送该第一对象的对象信息；
其中，该比对结果由该第二节点响应于该识别指示，基于该第一对象的加密特征、该客户端的编号信息、该第一目标文件的文件信息以及该第一节点的评估密钥，对该第一对象的加密特征进行比对得到；该第一对象的加密特征由该客户端基于该第一节点的公钥和该第一对象的特征得到。
在一种可能实施方式中，该第二节点包括调度节点和多个目标节点，该响应于从客户端接收到的携带有该客户端的编号信息的识别请求，确定该第二节点中的第一目标文件包括：
基于该识别请求中该客户端的编号信息，从文件信息表中确定该第二节点中该客户端对应的第一目标节点，从该文件信息表中确定该第一目标节点中的该第一目标文件的文件信息，该文件信息表包括客户端的编号信息与该第二节点包括的多个目标节点之间的对应关系，以 及，该多个目标节点与文件之间的对应关系。
在一种可能实施方式中，该基于解密后的比对结果，得到该第一对象的对象信息包括：
该第一节点基于该解密后的比对结果，确定目标特征，该目标特征是与该第一对象的特征之间的相似度最大的已注册特征；
基于该目标特征在该第一目标文件中的位置信息，从文件信息表中，获取该目标特征的对象信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息；
将该目标特征的对象信息，确定为该第一对象的对象信息。
在一种可能实施方式中，该方法还包括：
响应于从该客户端接收到的注册请求，确定该第二节点中第二目标节点中的第二目标文件，向该客户端发送该第二目标文件的文件信息，向该第二节点发送注册指示，该注册请求携带该客户端的编号信息和待注册的第二对象的对象信息，该注册指示携带该客户端的编号信息和该第二目标文件的文件信息；
在从该第二节点接收到添加成功信息的情况下，将该第二对象的对象信息添加至文件信息表，向该客户端发送注册成功信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息，该添加成功信息用于表示该第二对象的加密特征已添加至该第二目标文件中。
在一种可能实施方式中，该方法还包括：
响应于从该客户端接收到的注销请求，确定该第二节点中的第三目标节点中该第三对象对应的已注册特征所在的第三目标文件，向该第二节点发送注销指示，该注销指示携带该客户端的编号信息和该第三目标文件的文件信息，该注销请求携带该客户端的编号信息和待注销的第三对象的对象信息；
在从该第二节点接收到删除成功信息的情况下，从文件信息表中删除该第三对象的对象信息以及该第三对象对应的已注册特征在该第三目标文件中的位置信息，向该客户端发送注销成功信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息，该删除成功信息用于表示该第三对象对应的已注册特征已从该第三目标文件中删除。
第五方面，提供了一种信息处理方法，由信息处理系统中的第二节点执行，该信息处理系统还包括客户端和第一节点，该方法包括：
响应于从该第一节点接收到的识别指示，基于从该客户端接收到的待识别的第一对象的加密特征、该客户端的编号信息、该第二节点中的第一目标文件的文件信息以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果，向该第一节点发送该比对结果；
其中，该识别指示携带该客户端的编号信息和该第一目标文件的文件信息，该第一对象的加密特征基于该第一节点的公钥和该第一对象的特征得到，该比对结果用于确定该第一对象的对象信息。
在一种可能实施方式中，该方法还包括：
该第二节点中的调度节点响应于该识别指示，指示该第一目标节点将该第一节点的评估密钥加载到内存中。
在一种可能实施方式中，该第二节点包括调度节点和多个目标节点，该响应于从该第一节点接收到的识别指示，基于从该客户端接收到的待识别的第一对象的加密特征、该客户端的编号信息、该第二节点中的第一目标文件的文件信息以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果包括：
该调度节点响应于该识别指示，根据该第一目标文件的文件信息以及该客户端的编号信息，向该第二节点中的第一目标节点发送该识别指示以及该第一对象的加密特征；
该第一目标节点，响应于该识别指示，基于接收到的该第一对象的加密特征、该第一目标文件以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果。
在一种可能实施方式中，该响应于该识别指示，向该第二节点中的第一目标节点发送该识别指示以及该第一对象的加密特征包括：
该第二节点中的调度节点响应于该识别指示，在从该客户端接收到的该编号信息和该识别指示携带的客户端的编号信息一致的情况下，根据该第一目标文件的文件信息，向该第二节点中的第一目标节点发送该识别指示以及该第一对象的加密特征。
在一种可能实施方式中，该基于从该客户端接收到的待识别的第一对象的加密特征、该客户端的编号信息、该第二节点中的第一目标文件的文件信息以及该第一节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果包括：
基于该第一节点的评估密钥，对接收到的该第一对象的加密特征和该第一目标文件中各个已注册特征在密文态下进行内积运算，得到比对结果。
在一种可能实施方式中，该方法还包括：
响应于从该第一节点接收到的注册指示，基于从该客户端接收到的待注册的第二对象的加密特征、该客户端的编号信息、该第二节点中第二目标节点中的第二目标文件的文件信息以及该第一节点的评估密钥，将该第二对象的加密特征添加至该第二目标文件中，向该第一节点发送添加成功信息，该第二对象的加密特征基于该第一节点的公钥、该第二对象的特征和该第二目标文件的文件信息得到。
在一种可能实施方式中，该方法还包括：
响应于从该第一节点接收到的注销指示，基于该客户端的编号信息、该第二节点中的第三目标节点中该第三对象对应的已注册特征所在的第三目标文件的文件信息以及该第一节点的评估密钥，将该第三对象对应的已注册特征从该第三目标文件中删除，向该第一节点发送删除成功信息，该注销指示携带该客户端的编号信息和该第三目标文件的文件信息。
第六方面，提供了一种信息处理方法，由信息处理系统中的第三节点执行，该信息处理系统还包括客户端和第四节点，该方法包括：
响应于从该客户端接收到的识别请求，确定该第三节点中的第一目标文件的文件信息，基于从客户端接收到的待识别的第一对象的加密特征、该第一目标文件的文件信息以及该第三节点的评估密钥，对该第一对象的加密特征进行比对，得到比对结果，向该第四节点发送该比对结果，该识别请求携带该客户端的编号信息，该第一对象的加密特征基于该第三节点的公钥和该第一对象的特征得到；
基于从第四节点接收到的解密后的比对结果，得到该第一对象的对象信息，向该客户端发送该第一对象的对象信息，该解密后的比对结果由该第四节点基于该第三节点的私钥对该比对结果进行解密得到。
第七方面，提供了一种计算设备，该计算设备能够包括处理器和存储器，该存储器用于存储至少一段程序代码，该至少一段程序代码由该处理器加载并执行上述第三方面提供的信息处理方法，或者，上述第四方面提供的信息处理方法，或者，上述第五方面提供的信息处理方法，或者，上述第六方面提供的信息处理方法。
第八方面，提供了一种计算机可读存储介质，该计算机可读存储介质用于存储至少一段程序代码，当该计算机可读存储介质中的至少一段程序代码由计算设备的处理器执行时，使得计算设备能够执行上述第三方面提供的信息处理方法，或者，上述第四方面提供的信息处理方法，或者，上述第五方面提供的信息处理方法，或者，上述第六方面提供的信息处理方法。
第九方面，提供了一种计算机程序产品，当该计算机程序产品在计算设备上运行时，使得该计算设备能够执行上述第三方面提供的信息处理方法，或者，上述第四方面提供的信息处理方法，或者，上述第五方面提供的信息处理方法，或者，上述第六方面提供的信息处理方法。
附图说明
图1是本申请实施例提供的一种信息处理系统的架构示意图；
图2是本申请实施例提供的一种计算设备的硬件结构示意图；
图3是本申请实施例提供的一种信息处理方法的流程示意图；
图4是本申请实施例提供的一种文件信息表的示意图；
图5是本申请实施例提供的一种注册过程的示意图；
图6是本申请实施例提供的一种注册过程的示意图；
图7是本申请实施例提供的一种信息处理方法的流程示意图；
图8是本申请实施例提供的一种识别过程的示意图；
图9是本申请实施例提供的一种识别过程的示意图；
图10是本申请实施例提供的一种信息处理方法的流程示意图；
图11是本申请实施例提供的一种注销过程的示意图；
图12是本申请实施例提供的一种信息处理系统的架构示意图；
图13是本申请实施例提供的一种信息处理方法的流程示意图；
图14是本申请实施例提供的一种信息处理方法的流程示意图；
图15是本申请实施例提供的一种信息处理方法的流程示意图；
图16是本申请实施例提供的一种信息处理系统的架构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
在介绍本申请实施例提供的技术方案之前，下面先对本申请涉及的关键术语进行说明。
人脸验证(face verification，FV)：人脸验证是判断两个人脸图像是否对应于同一个人的技术，这是一个两分类问题，通常应用于基于人脸的登录控制、访问控制、身份确认等方面，比如基于人脸的手机解锁，操作系统登录。人脸验证涉及1：1的比对与运算。
人脸识别(face recognition，FR)：识别系统从输入的人脸图像中提取待识别人脸特征，基于待识别人脸特征在人脸库中进行比较与搜索，如果待识别人脸特征和人脸库中与其最接近的已知人脸图像的相似度大于一定阈值，则判断这张输入的人脸图像与该已知人脸图像对应于相同的人脸，否则就认为输入的人脸图像对应于一个未知的人脸。人脸识别通常用于基于人脸的考勤打卡、人员搜索等。人脸识别涉及1：N的比对与运算，相比于人脸验证，人脸识别计算量要大很多，具体取决于识别系统中已注册的人脸数N，其中，N为正整数。
同态加密(homomorphic encryption，HE)：同态加密技术可以实现对数据的密文态的同态运算，对密文态运算结果进行解密后的结果，等同于对明文进行相应的运算的结果，能够实现数据的可用不可见。其中，全同态加密(full homomorphic encryption，FHE)支持对密文进行任意形式的运算(包括加法和乘法)。
密钥(secret key，SK)：在明文转换为密文(加密算法)或将密文转换为明文的算法(解密算法)中输入的参数。在同态加密技术中，通过密钥生成算法得到的密钥包括一对公钥、私钥和评估密钥。其中，公钥(public key，PK)是公开的参数，能够用来对明文进行加密得到密文；私钥(private key，PK)非公开的参数，用于对基于公钥加密后的密文进行解密；评估密钥(evaluation key，EK)也称作辅助计算密钥，用于对密文进行同态运算(例如密文乘法)，包括重线性化密钥与密钥交换密钥，重线性化密钥用于防止密文膨胀，密钥交换密钥用于支持密文旋转操作，评估密钥能够保证对密文进行运算的结果进行解密的结果等同于对明文进行相应运算的结果。
层次型全同态CKKS算法：CKKS(Cheon-Kim-Kim-Song)算法是一种近似计算同态加密算法，支持针对实数或复数的浮点数加法和乘法同态运算，得到的计算结果为近似值，适用于机器学习模型训练等不需要精确结果的场景。
层次型全同态BFV算法：BFV(Brakerski/Fan-Vercauteren)算法是一种支持对密文进行任意形式的运算的同态加密算法，可以基于带错学习(learning with error，LWE)和环上带错学习(ring learning with error，RLWE)构造。在BFV算法中，密文和密钥均以向量表示，而密文的乘积和对应的密钥乘积则为张量，因此密文乘法运算会造成密文维数的爆炸式增长，BFV算法通过密钥交换技术，来控制密文向量的维数膨胀，能够在进行密文计算后通过密钥交换将膨胀的密文维数恢复为原密文的维数。
开放式多处理(Open multi-processing，OpenMP)是一个编译器指令和库函数的集合，为共享式存储计算设备上的并行程序设计。
可编程逻辑器件(field programmable gate array，FPGA)是通过电子设计自动化技术将电子应用系统的既定功能和技术指标具体实现的硬件载体，FPGA作为实现这一途径的主流器件之一，具有直接面向用户、灵活性和通用性极大、使用方便和实现快捷等特点。
FPGA加速卡是针对特定领域和应用的专业板卡，板卡上设计有丰富的高速I/O接口与存储资源，通过部署FPGA加速卡，能够有效提升硬件开发过程中的数据处理效率。
图1是本申请实施例提供的一种信息处理系统的架构示意图。如图1所示，该信息处理系统100包括：客户端110、第一节点120和第二节点130，其中，第二节点130包括调度节点131和多个目标节点132。
客户端110用于在检测到待识别的对象的情况下，获取待识别的对象的特征，基于第一 节点120的公钥121对获取到的待识别的对象的特征进行加密得到加密特征，向第二节点发送该加密特征；向第一节点120发送识别请求，指示第一节点获取对待识别的对象进行识别所需的文件信息。
第一节点120用于存储文件信息表，基于接收到的识别请求，获取对待识别的对象进行识别所需文件的文件信息，基于该文件信息向第二节点130发送识别指示，该识别指示用于指示第二节点120中客户端对应的第一目标节点1321针对客户端110进行识别。
第二节点130中的调度节点131，用于响应于接收到第一节点的识别指示，向客户端对应的第一目标节点1321发送识别指示以及从客户端节接收到的加密特征；第二节点130中的第一目标节点1321用于存储已注册特征所在的文件，响应于接收到该识别指示以及该加密特征，基于第一节点120的评估密钥122、所存储的文件对该加密特征进行比对，得到比对结果，向第一节点120发送比对结果。
第一节点120还用于基于第一节点120的私钥123，对接收到的比对结果进行解密，基于解密后的比对结果，确定待识别的对象的对象信息(例如，身份信息)，向客户端110发送对象信息。
其中，客户端110、第一节点120和第二节点130之间通过有线网络或者无线网络方式通信连接。在一些实施例中，上述无线网络或有线网络使用标准通信技术和/或协议。网络通常为因特网、但也能够是任何网络，包括但不限于局域网(local area network，LAN)、城域网(metropolitan area network，MAN)、广域网(wide area network，WAN)、移动、有线或者无线网络、专用网络或者虚拟专用网络的任何组合。在一些实施例中，客户端110、第一节点120和第二节点130之间基于远程调用协议(remote procedure call protocol，RPC)来实现点对点(peer-to-peer，P2P)通讯。在一些实施例中，客户端110、第一节点120和第二节点130使用包括超级文本标记语言(hyper text markup language，HTML)、可扩展标记语言(extensible markup language，XML)等的技术和/或格式来代表通过网络交换的数据。此外还能够使用诸如安全套接字层(secure socket layer，SSL)、传输层安全(transport layer security，TLS)、虚拟专用网络(virtual private network，VPN)、网际协议安全(internet protocol security，IPsec)等常规加密技术来加密所有或者一些链路。在另一些实施例中，还能够使用定制和/或专用数据通信技术取代或者补充上述数据通信技术。
在一些实施例中，该客户端是指用户侧的终端或服务器。其中，终端也被称为智能终端或移动智能终端，是指一类具备丰富人机交互方式、拥有接入互联网能力、通常搭载各种操作系统、具有较强处理能力的设备。在一些实施例中，移动智能终端的类型包括但不限于智能手机、平板电脑、车载终端、掌上游戏主机等。其中，服务器可以是一个或多个计算设备所组成的服务器集群。
在一些实施例中，该第一节点和第二节点可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还能够是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(content delivery network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。
通过上述图1，从系统架构的角度对本申请实施例提供的一种信息处理系统的架构进行了介绍，下面对该信息处理系统中客户端、第一节点和第二节点的硬件结构进行介绍。
本申请实施例提供了一种计算设备，能够配置为上述信息处理系统中的客户端、第一节点或第二节点中的任一种。示意性地，参考图2，图2是本申请实施例提供的一种计算设备的硬件结构示意图。如图2所示，该计算设备200包括存储器201、处理器202、通信接口203以及总线204。其中，存储器201、处理器202、通信接口203通过总线204实现彼此之间的通信连接。
存储器201可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器201可以存储至少一段程序代码，当存储器201中存储的程序代码被处理器202执行时，该计算设备能够实现该信息处理系统中客户端执行的操作。存储器201可以存储对象的特征、公钥等，本申请实施例对此不作限定。
处理器202可以是网络处理器(network processor，NP)、中央处理器(central processing unit，CPU)、特定应用集成电路(application-specific integrated circuit，ASIC)或用于控制本申请方案程序执行的集成电路。该处理器202可以是一个单核(single-CPU)处理器，也可以是一个多核(multi-CPU)处理器。该处理器202的数量可以是一个，也可以是多个。通信接口203使用例如收发器一类的收发模块，来实现计算设备200与其他设备或通信网络之间的通信。例如，可以通过通信接口203获取数据。
其中，存储器201和处理器202可以分离设置，也可以集成在一起。
总线204可包括在计算设备200各个部件(例如，存储器201、处理器202、通信接口203)之间传送信息的通路。
接下来介绍本申请实施例提供的信息处理方法，该方法能够应用于上述信息处理系统中。
在本申请实施例中，部署在信息处理系统中的公钥、私钥和评估密钥，是基于系统中的处理需求参数，通过密钥生成算法确定的。在一些实施例中，该处理需求参数包括：(1)对象的特征的维度信息，基于特征的维度信息所生成的密钥，能够保证基于评估密钥对对象的加密特征所进行的同态运算的准确性；(2)安全强度参数，能够决定加密算法和解密算法的复杂性；(3)识别性能要求，用于构造符合性能要求的加密算法和解密算法以及密钥；(4)最大特征数量，指示信息处理系统中可存储的特征的数量上限。其中，通过密钥生成算法，确定该公钥、私钥和评估密钥的过程由第一节点执行，第一节点将公钥配置给客户端，公钥用于对获取到的对象的特征进行加密，将评估密钥配置给第二节点，评估密钥用于对加密后的特征(密文)进行同态运算。在一些实施例中，第一节点能够将公钥和评估密钥配置给任意节点，本申请实施例对此不做限定。
其中，私钥仅由第一节点持有，也即是，第一节点能够对信息处理系统中加密后的信息进行解密。在一些实施例中，该第一节点将私钥存储在安全硬件中，例如，可信执行环境(trusted execution environment，TEE)，以保证私钥的安全性。
在本申请实施例中，在信息处理系统中已部署有公钥、私钥和评估密钥等参数的情况下，本申请实施例提供的信息处理方法即可基于该信息处理系统实现。接下来，对本申请实施例提供的信息处理方法中，针对待注册对象进行信息注册的过程进行说明。图3是本申请实施例提供的一种信息处理方法的流程示意图，参见图3，该方法包括：
301、客户端基于待注册的对象A的对象信息，向第一节点发送注册请求，获取对象A的特征，该注册请求携带该客户端的编号信息和对象A的对象信息。
其中，客户端的编号信息能够唯一地标识该客户端，在注册请求中携带该编号信息和对象A的对象信息，能够指示该注册请求来自于哪个客户端。
在一些实施例中，对象信息包括信息处理系统中用于标识对象的信息，例如，在人脸识别的场景下，对象信息是指用户在人脸识别系统中注册时输入的用户名。在另一些实施例中，该对象信息包括对象的身份信息，例如，在人脸识别的场景下，对象信息包括用户在人脸识别系统中注册时输入的姓名、年龄和身份证号等。
302、第一节点响应于该注册请求，确定第二节点包括的第二目标节点，确定第二目标节点中的第二目标文件的文件信息，向客户端发送该第二目标文件的文件信息。
在本申请实施例中，第二节点用于存储文件，该文件中包括多个已注册特征，已注册特征对应于已注册对象。可以理解地，存储在第二节点中的已注册特征均为已注册对象的加密特征。
在一些实施例中，该第二节点包括调度节点和多个目标节点。该调度节点用于响应于接收到指示，向指示对应的目标节点转发指示以及相关信息；该多个目标节点分别用于存储已注册对象对应的已注册特征。在一些实施例中，目标节点所存储的文件分别包括不同的已注册对象。例如，在基于人脸识别的场景下，同一企业中的多个部门分别对应于不同的目标节点，每个目标节点用于存储该部门的已注册人脸文件。在这种示例下，第一节点在接收到客户端发起的针对对象A的注册请求时，需要确定第二节点中与客户端对应的第二目标节点，进而通过第二目标节点，获取基于客户端进行注册所需要的第二目标文件。例如，在基于人脸识别的场景下，通过客户端进行注册时，第一节点接收到客户端的注册请求后，基于注册请求所携带的部门信息，确定该部门对应的第二目标节点，进而将该注册请求所携带的人脸特征，存储在部门对应的已注册人脸文件中。
在一些实施例中，第一节点存储有文件信息表，该文件信息表包括客户端的编号信息与该第二节点包括的多个目标节点之间的对应关系，以及，该多个目标节点与文件之间的对应关系。该第一节点基于该注册请求所携带的客户端的编号信息，能够从文件信息表中，查询到客户端对应的目标节点的节点编号，从而确定第二目标节点。进一步地，根据第二目标节点的节点编号查询文件信息表，能够确定该客户端进行注册所需的第二目标文件。
为了直观的描述文件信息表中存储的各种信息，本申请实施例提供了一种文件信息表的示意图，参见图4，该文件信息表包括表1、表2和表3。如图4中表1所示，从表1可查询到：客户端的编号信息(Client-ID)为1的客户端，对应于第二节点中的节点编号(Node-ID)为1的目标节点；节点编号(Node-ID)为1的目标节点，存储有文件标识(PCfile-ID)为2的文件；基于此，客户端的编号信息为1的客户端进行注册所需的第二目标文件，即是节点编号为1的目标节点中存储的、文件标识为2的文件。
在一些实施例中，文件信息表包括：文件的文件标识(PCfile-ID)、文件所在的第二节点的编号(Node-ID)、文件的比特映射图(Bitmap)和文件中已注册特征的编号。参见图4中表2，其中，文件的可用位置编号基于文件的比特映射图(Bitmap)确定，该比特映射图用于指示文件可用位置编号的排列顺序；在一些实施例中，该文件信息表还包括：文件当前的可用位置编号总数(vacant-Number)。其中，该可用位置是指文件中的空闲存储位置。基于此，在基于文件信息表中的表1确定了第二目标文件之后，第一节点根据第二目标节点的编号信息，查询文件信息表中的表2，可以获取第二目标文件的文件信息，该文件信息至少包括文件的文件标识可用位置编号。第一节点向客户端发送该第二目标文件的文件信息，使得该客户端能够基于可用位置编号，对对象A的特征进行处理，保证注册完成后，对象A对应的已注册特征会存储在第二目标文件中的对应位置上。在另一些实施例中，第一节点还向客户端发送基于上述表1查询到的第二目标节点的节点编号。
在一些实施例中，该文件信息表还包括第二节点中的文件中各个已注册特征的对象信息，和已注册特征在文件中的位置信息，例如，对象信息可以是对象的用户名，已注册特征在文件中的位置信息可以是已注册特征在文件中的位置编号。参见图4中的表3，表3中包括：对象的用户名(User-ID)、对象的已注册特征的特征标识(Cfile-ID)、对象的已注册特征所在的文件的文件标识(PCfile-ID)、对象的已注册特征在文件中的位置编号(slot-ID)以及对象的已注册特征所在节点的节点编号(Node-ID)。
在另一些实施例中，该文件信息表还可以包括更多文件的相关信息，例如，文件的存储日期、文件的修改权限等，本申请实施例对此不做限定。
303、第一节点向第二节点发送注册指示，该注册指示携带该客户端的编号信息和该第二目标文件的文件信息。
在一些实施例中，第一节点向第二节点发送注册指示，将从文件信息表中查询到的客户端对应目标节点的节点编号发送给第二节点，以指示该第二节点中该节点编号对应的第二目标节点来进行后续的步骤。
304、客户端在接收到该第一节点发送的第二目标文件的文件信息的情况下，对对象A的特征进行编码，得到对象A的第一特征向量FA，FA为M维向量，其中，M为正整数。
其中，该第一特征向量FA用于表示该对象A的特征，例如，FA是从对象A的人脸图像中，提取出的能够代表该对象A的特征的人脸特征向量。通过本步骤将该对象A的特征编码为固定大小的向量，能够提升后续运算过程的效率。在一些实施例中，M为2的幂。
305、客户端基于对象A的第一特征向量FA和第二目标文件的文件信息，得到对象A的第二特征向量PA，PA为N×M维向量，其中，M和N为正整数。
在一些实施例中，该第二目标文件的文件信息包括该第二目标文件的文件标识和该第二目标文件的可用位置编号。客户端基于接收到的可用位置编号X，构造一个N×M维的向量PA(向量PA包括N个M维大小的向量空间)，并将M维的向量FA，编码到PA中第X个M维大小的向量空间中，其中，X小于等于N。基于此，FA则位于PA中可用位置编号X对应的位置，而PA中可用位置编号X对应的位置以外的位置均为0向量。其中，M和N均为预设的正整数。在一些实施例中，M和N均为2的幂。
本申请实施例提供了一种注册过程的示意图，参见图5，图5包括(a)图和(b)图，其中，图5中(a)图为本申请实施例提供的一种注册编码过程的示意图，图5中(b)图是 本申请实施例提供的一种注册加密过程的示意图。其中，参见图5中(a)图，FA是基于对象A的特征确定的M维的第一特征向量；PA是基于编码算法Encode确定的第二特征向量，大小为N×M；X是第二目标文件中的可用位置编号。
在另一些实施例中，当一个客户端，需要要对多个待注册的对象进行注册，可以通过获取第二目标文件中的多个可用位置编号，通过上述编码方法，将多个待注册对象的第一特征向量，分别编码到同一个第二特征向量中，实现算法上的并行，有效提升了信息处理的效率。
通过上述技术方案，根据第一节点返回的文件信息，客户端将待注册的对象的特征，编码在第二目标文件中的可用位置，使得待注册的加密特征中有效信息的位置与第二目标文件的实际可用位置匹配，在保证信息处理的准确性的基础上，实现算法上的并行，有效提升的信息处理的效率。
306、客户端基于该第一节点的公钥，对对象A的第二特征向量PA进行加密，得到对象A的加密特征EPA。
图5中图(b)是本申请实施例提供的一种注册加密过程的示意图，在本申请实施例中，基于公钥对PA进行加密得到的EPA为N×M维向量，且，基于公钥进行加密后的FA位于EPA的第X个M维大小的密文向量空间中，其中，X是可用位置编号，EPA中除可用位置编号X对应的位置以外的密文，均为对0向量加密后的密文向量V0。参见图5中图(b)，其中，Encrypt为加密算法，PK为公钥，FAx是基于公钥进行加密后的FA。
在一些实施例中，通过将PA和公钥PK作为加密算法的输入，得到加密算法的输出，即为EPA。其中，加密算法可以是多项式的形式，为了保证第二节点能够基于评估密钥进行同态运算，该多项式的次数需要满足的条件包括：(1)多项式次数为2的幂；(2)多项式次数远大于特征维度M；(3)多项式次数为M的倍数。
通过上述技术方案，在客户端侧对对象的特征进行加密，保证用户信息的明文不会出现在客户端以外的设备中，有效保障了信息的安全性。
307、客户端向第二节点发送EPA和该客户端的编号信息。
在一些实施例中，客户端将从第一节点获取到的节点编号，发送给第二节点，用于指示第二节点中的第二目标节点基于该EPA进行注册。
308、第二节点中的调度节点响应于该注册指示，在从该客户端接收到的该编号信息和该注册指示携带的客户端的编号信息一致的情况下，根据该第二目标文件的文件信息，向该第二节点中的第二目标节点发送该注册指示以及EPA。
在一些实施例中，该第二节点对比从第一节点接收到的客户端的编号信息与从客户端接收到的客户端的编号信息是否一致，来确保此次注册指示中携带的文件信息是针对对象A进行注册所需的文件信息。第二节点通过对两个不同来源的编号信息进行一致性验证，有效保证了信息安全。
在一些实施例中，该第二目标文件的文件信息包括该第二目标文件的文件标识、该第二目标文件所在节点的节点编号、该第二目标文件的可用位置编号。该第二节点中的调度节点响应于该注册指示，在确定了此次注册指示与该客户端一致的情况下，向该节点编号对应的第二目标节点发送注册指示以及从客户端接收到的EPA。
在另一些实施例中，第二节点中的调度节点接收到第一节点发送的节点编号以及客户端发送的节点编号，在向第二目标节点发送注册指示以及从客户端接收到的EPA之前，该调度 节点通过对比两个不同来源的节点编号是否一致，进一步保障信息安全。
通过上述技术方案，第二节点中的调度节点能够根据第一节点的指示，并行地调度多个目标节点，针对客户端进行信息注册，通过目标节点与客户端编号之间的对应关系，实现了物理上的并行运算，大大提升了信息处理的效率。
309、第二节点中的第二目标节点将接收到的对象A的加密特征EPA添加至该第二目标文件中。
其中，第二目标文件包括多个已注册特征，该多个已注册特征均为基于公钥加密后的密文，因此，第二目标节点将基于公钥加密后的加密特征，在密文状态下添加至第二目标文件中，例如，第二目标节点将基于公钥加密后的加密特征与第二目标文件相加，以得到更新后的第二目标文件，由于新注册的加密特征除了可用位置以外的部分均为0，因此，不会对第二目标文件中其他已注册特征造成影响，达到了在一个文件中并行存储多个特征的目的。
在一些实施例中，EPA为N×M维向量，且，基于公钥进行加密后的FA位于EPA的第X个M维大小的密文向量空间中；第二目标文件为N×M维向量EREP2，第二目标文件中的N个已注册特征均以M维向量的形式，分别位于N个M维大小的密文向量空间。其中，X为EREP2的可用位置编号，也即是，EREP2的第X个M维大小的密文向量空间可用于存放新的已注册特征。通过将EPA和EREP2在密文向量空间中相加，即可将加密后的FA存放至EREP2的第X个M维大小的密文向量空间中。基于此，第二节点保存EPA以及添加EPA后的EREP2，此时，EREP2中包括对象A的已注册特征。可以理解地，由于EPA中除第X个M维大小的密文向量空间以外的密文均为加密后的0向量，因此，在相加过程中，并不会对EREP2中可用位置以外的已注册特征造成影响。
为了直观地描述上述添加过程，本申请实施例提供了一种注册过程的示意图，参见图6，其中，EPA是对象A的加密特征，大小为N×M；EREP2是第二目标文件，大小为N×M，包括N个已注册特征RV；CAdd为密文相加算法。
310、第二节点向该第一节点发送添加成功信息。
在一些实施例中，第二节点中的第二目标节点向第二节点中的调度节点返回添加成功信息，由调度节点向第一节点发送该添加成功信息。
311、第一节点在接收到该添加成功信息的情况下，将该对象A的对象信息添加至文件信息表，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息。
其中，第一节点在第二节点已存储对象A的已注册特征的情况下，将对象A的对象信息和对象A的已注册特征在第二目标文件中的位置信息添加至文件信息表中。在一些实施例中，该位置信息包括第二目标文件中对象A的已注册特征的位置编号。在一些实施例中，第一节点在文件信息表中，添加该对象A的对象信息，例如，在图4的表2中，第一节点在第二目标文件对应的表2中可用位置编号X对应的位置，写入对象A的用户名，在图4的表3中新增一列，用于记录对象A的用户名、对象A的已注册特征的特征标识、对象A的已注册特征所在的第二目标文件的文件标识、对象A的已注册特征在第二目标文件中的位置编号以及对象A的已注册特征所在节点的编号。
312、第一节点向该客户端发送注册成功信息。
通过上述技术方案，在第一节点中存储私钥以及可公开的对象信息，在第二节点中存储 基于第一节点的公钥加密得到的信息，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。
进一步，在进行信息注册的过程中，通过注册编码，保证注册是基于待注册对象对应的第二目标文件中的可用位置进行的，注册过程不影响其他已注册特征，实现了加密状态下的动态注册，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
在介绍了本申请实施例提供的信息处理方法中信息注册过程之后，接下来，对本申请实施例提供的信息处理方法中信息识别的过程进行说明。图7是本申请实施例提供的一种信息处理方法的流程示意图，参见图7，该方法包括：
701、客户端在检测到待识别的对象B的情况下，向第一节点发送识别请求，获取对象B的特征，该识别请求携带该客户端的编号信息。
本步骤参考步骤301。示例性地，在基于人脸识别的场景下，客户端检测到人脸，触发基于人脸的识别请求，向第一节点发送识别请求，并对检测到的人脸进行处理，获取人脸特征。
702、客户端对对象B的特征进行编码，得到对象B的第一特征向量FB，FB为M维向量，其中，M为正整数。
本步骤参考步骤304，在此不作赘述。在一些实施例中，M为2的幂。
需要说明的是，上述步骤701中，向第一节点发送识别请求的步骤以及获取对象B的特征的步骤，可以同步执行，也可以先后执行，本申请实施例对此不做限定。
703、客户端基于对象B的第一特征向量FB，得到对象B的第二特征向量PB，PB为N×M维向量，其中，M和N为正整数。
在一些实施例中，客户端通过构造一个N×M维的向量PB(向量PB包括N个M维大小的向量空间)，并将M维的向量FB，编码到PB中每一个M维大小的向量空间中，基于此，该PB包括N个FB，其中，M和N均为预设的正整数。在一些实施例中，M和N均为2的幂。
本申请实施例提供了一种识别过程的示意图，参见图8，图8包括(a)图和(b)图，其中，图8中(a)图为本申请实施例提供的一种识别编码过程的示意图，图8中(b)图是本申请实施例提供的一种识别加密过程的示意图。其中，参见图8中(a)图，FB是基于对象B的特征确定的M维的第一特征向量；PB是基于编码算法Encode确定的第二特征向量，大小为N×M。
704、客户端基于该第一节点的公钥，对对象B的第二特征向量PB进行加密，得到对象B的加密特征EPB。
本步骤参考步骤306，在此不作赘述。
参见图8中(b)图，图8中(b)图是本申请实施例提供的一种识别加密过程的示意图，其中，Encrypt为加密算法，PK为公钥，基于公钥对PB进行加密得到的EPB为N×M维向量，FBx是基于公钥进行加密后的FB。
705、客户端向第二节点发送EPB和该客户端的编号信息。
706、第一节点响应于该识别请求，确定该第二节点中的第一目标节点中的第一目标文件。
本步骤中，第一节点基于识别请求中的客户端的编号信息，查询第一节点中存储的文件信息表，来确定该第一目标文件，原理参考步骤302，在此不作赘述。
可以理解地，在一些实施例中，由于第二节点包括的多个目标节点中的文件对应的已注册对象是不同的，需要基于客户端的编号信息，确定第二节点中客户端对应的第一目标节点，进而通过第一目标节点，才能获取基于客户端进行识别所需要的第一目标文件。例如，在基于人脸识别场景下，通过客户端进行识别时，第一节点接收到客户端的识别请求后，基于识别请求所携带的部门信息，确定用于该部门对应的第一目标节点，从而在部门的已注册人脸文件中进行识别。
707、第一节点向第二节点发送识别指示，该识别指示携带该客户端的编号信息和该第一目标文件的文件信息。
本步骤参考步骤303，在此不作赘述。
708、第二节点中的调度节点响应于该识别指示，指示第一目标节点将第一节点的评估密钥加载到内存中。
其中，第二节点中的各个目标节点都存储有第一节点的评估密钥，由于评估密钥的数据量通常较大，节点会在使用时将评估密钥加载至内存中，避免评估密钥在其他情况下占用运行内存。在一些实施例中，该第二节点中的调度节点响应于从第一节点接收到的识别指示，基于识别指示中的文件信息包括的节点编号，指示节点编号对应的第一目标节点将第一节点的评估密钥加载到内存中。基于此，第一目标节点在接收到识别指示的情况下，直接进行评估密钥的加载，使得第一目标节点接收到客户端发送的加密特征时，即可直接基于内存中的评估密钥进行识别，节省了识别过程中评估密钥加载的时间。
通过上述技术方案，充分利用了信息处理系统的多节点架构在物理上对数据的并行处理能力，大大提升了信息处理的效率。
709、第一目标节点将第一节点的评估密钥加载到内存中。
在一些实施例中，上述调度节点能够通过向第一目标节点发送通知信息的方式，指示第一目标节点进行加载。相应地，第一目标节点响应于接收到通知信息，将第一节点的评估密钥加载到内存中。
710、第二节点中的调度节点在从该客户端接收到的该编号信息和该识别指示携带的客户端的编号信息一致的情况下，根据该第一目标文件的文件信息，向该第二节点中的第一目标节点发送该识别指示以及EPB。
本步骤参考步骤308，在此不作赘述。
通过上述技术方案，第二节点中的调度节点能够根据第一节点的指示，并行地调度多个目标节点，针对客户端进行识别，通过目标节点与客户端编号之间的对应关系，实现了物理上的并行运算，在提升信息处理效率的同时，保证了信息识别的实时性。
711、第二节点中的第一目标节点基于该第一节点的评估密钥，对接收到的该对象B的加密特征EPB和该第一目标文件中各个已注册特征进行内积运算，得到比对结果。
本步骤原理参考步骤309，在此不作赘述。
本步骤中使用的第一节点的评估密钥即是在步骤709中预先加载至内存中的。在一些实施例中，第一目标节点不预先加载第一节点的评估密钥，而是在接收到客户端的EPB以及识别指示之后，开始加载第一节点的评估密钥。
在一些实施例中，EPB为N×M维向量，且，基于公钥进行加密后的FB位于EPB的每一个M维大小的密文向量空间中；第一目标文件为N×M维向量EREP1，第一目标文件中的N个已注册特征均以M维向量的形式，分别位于N个M维大小的密文向量空间。第二节点基于评估密钥，在密文向量空间中对EPB和EREP1进行密文内积运算，得到比对结果EIPR。可以理解地，由于EPB中的每一个M维大小的密文向量空间均存储有基于公钥进行加密后的FB，因此，基于密文内积运算，能够并行地得出EREP1中N个已注册特征分别与加密后的FB进行内积运算的结果。内积运算本质上在比较向量之间的相似度，因此，该EIPR包括N个已注册特征分别和加密后的FB进行比较，得出的N个加密状态下的相似度。
为了直观地描述得到比对结果的过程，本申请实施例提供了一种识别过程的示意图，参见图9，其中，EPB是对象B的加密特征，为N×M维向量；EREP1是第一目标文件，为N×M维向量；CinnerProduct为密文内积算法；EIPR为比对结果，为N×M维向量。
可以理解地，本申请实施例中的密文内积运算是多维向量相乘的过程，在一些实施例中，基于评估密钥，来控制向量相乘导致的密文向量的维数膨胀，在进行密文计算后，通过密钥交换，将膨胀的密文特征维数恢复为原密文的特征维数，以减小在密文状态下进行计算带来的误差，提升信息处理的准确性，例如，层次型全同态CKKS算法以及层次型全同态BFV算法。
在一些实施例中，该内积运算是计算欧氏距离，在另一些实施例中，该内积运算是计算余弦距离，本申请实施例对此不做限定。
在另一些实施例中，信息识别过程涉及到的第一目标节点包括多个，则第二节点能够调度该多个第一目标节点基于各自存储的第一目标文件，并行地基于接收到的该对象B的加密特征EPB进行运算，并获取多个第一目标节点确定的多个比对结果。
712、第二节点向该第一节点发送比对结果。
在一些实施例中，第二节点中的第一目标节点向第二节点中的调度节点返回比对结果，由调度节点将接收到的多个比对结果发送给第一节点。
713、第一节点在接收到该比对结果的情况下，基于该第一节点的私钥对该比对结果进行解密，基于解密后的比对结果，确定目标特征，该目标特征是与该对象B的特征之间的相似度最大的已注册特征。
在本申请实施例中，第一节点持有私钥，根据同态加密的原理，对比对结果进行解密后的结果，等同于未加密状态下，对象B的特征和各个已注册对象的特征之间的相似度。可以理解地，解密后得到的多个相似度中，数值最大的相似度所对应的已注册对象可以被认为与该对象B是同一个对象。
在一些实施例中，解密后的比对结果为N个M维的结果向量R，参见图9，每个结果向量R中，目标维度上的数值，用于表示其对应的已注册特征的相似度，例如，比对结果为N个128维的结果向量R，每个R的第1维的数值为相似度。基于此，第一节点从解密后的比对结果中，获取相似度的数值最大的结果向量的编号，将第一目标文件中，该编号对应的已注册特征确定为目标特征。
在一些实施例中，设置有相似阈值，在确定了最大的相似度之后，在该相似度大于相似阈值的情况下，将该相似度对应的已注册特征确定为目标特征，以进一步保证比对结果的准确性。
714、第一节点基于该目标特征在该第一目标文件中的位置信息，从文件信息表中，获取该目标特征的对象信息，将该目标特征的对象信息，确定为对象B的对象信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息。
本申请实施例中，文件信息表参考步骤302中的描述，在此不作赘述。
在一些实施例中，该目标特征在该第一目标文件中的位置信息包括该目标特征在第一目标文件中的位置编号。第一节点基于该第一目标文件的文件标识以及该目标特征的位置编号，即可从文件信息表中查询到该目标特征的对象信息，例如，该对象信息可以为该目标特征对应的已注册对象的用户名。基于此，即确定了对象B的对象信息。可选地，该对象信息包括目标特征对应的已注册对象的身份信息，例如，姓名、年龄和身份证号等，本申请实施例对此不做限定。
715、第一节点向该客户端发送对象B的对象信息。
通过上述技术方案，在第一节点中存储私钥以及可公开的对象信息，在第二节点中存储基于第一节点的公钥加密得到的信息，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。
并且，通过上述技术方案，基于一套密钥即可实现一对多的信息识别，有效解决了为了存储多个已注册特征对应的多套密钥而占用大量存储空间的问题。
进一步地，在进行信息识别的过程中，将待识别的对象的特征编码为与第一目标文件的维度匹配的多维向量，能够并行地将待识别的对象的特征与多个已注册对象进行比对，等同于在一个处理周期内，完成了针对多个已注册对象的信息处理过程，大大提升了信息处理的效率。
接下来，对本申请实施例提供的信息处理方法中信息注销的过程进行说明。图10是本申请实施例提供的一种信息处理方法的流程示意图，参见图10，该方法包括：
1001、客户端基于待注销的对象C的对象信息，向第一节点发送注销请求，该注销请求携带该客户端的编号信息和待注销的对象C的对象信息。
本步骤参考步骤301，在此不作赘述。
1002、第一节点响应于该注销请求，确定该第二节点中第三目标节点中该对象C对应的已注册特征所在的第三目标文件。
在本申请实施例中，对象C为已注册、待注销的对象，因此，文件信息表中存储有该对象C的对象信息以及对象C对应的已注册特征在该第二节点中的文件中的位置信息。
在一些实施例中，第一节点响应于注销请求基于待注册请求中携带的客户端的信息编号查询文件信息表，即可确定该第三目标节点。基于对象C的对象信息，查询文件信息表，即可直接确定该对象C对应的已注册特征所在的第三目标文件，本步骤原理参考步骤302，在此不作赘述。
1003、第一节点向该第二节点发送注销指示，该注销指示携带该客户端的编号信息和该第三目标文件的文件信息。
本步骤参考步骤303，在此不作赘述。
1004、第二节点中的调度节点响应于该注销指示，在从该客户端接收到的编号信息和注销指示携带的客户端的编号信息一致的情况下，根据该第三目标文件的文件信息，向该第二节点中的第三目标节点发送该注销指示。
本步骤参考步骤308，在此不做赘述。
1005、第二节点中的第三目标节点响应于该注销指示，基于该第三目标文件的文件信息，将该对象C对应的已注册特征EPC从该第三目标文件中删除。
在一些实施例中，在对对象C进行信息注册的过程中，保存了对象C的已注册特征EPC，(参考步骤309中添加EPA的过程)，因此，第二节点根据第三目标文件的文件信息，基于第三目标文件EREP3的文件标识以及该对象C的已注册特征EPC的特征标识，获取EREP3和EPC，将EPC和EREP3在密文向量空间中相减，保存删除EPC后的EREP3。本步骤原理参考步骤309，在此不作赘述。
为了直观地描述上述删除过程，本申请实施例提供了一种注销过程的示意图，参见图11，其中，EPC是对象C的已注册特征，大小为N×M；FCx在对象C注册的过程中基于对象C的特征进行注册编码后加密得到(参考步骤304至步骤306)；EREP3是第三目标文件，大小为N×M；X为对象C的已注册特征在EREP3中的位置编号；Csubtract为密文相减算法。
1006、第二节点向该第一节点发送删除成功信息。
本步骤参考步骤310，在此不做赘述。
1007、第一节点在接收到该删除成功信息的情况下，从文件信息表中删除该对象C的对象信息以及该对象C对应的已注册特征在该第三目标文件中的位置信息，该文件信息表包括该第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第二节点中的文件中的位置信息。
其中，第一节点在第二节点已删除对象C的已注册特征的情况下，将对象C的对象信息和对象C的已注册特征在第二目标文件中的位置信息从文件信息表中删除。本步骤与步骤311同理，在此不作赘述。
1008、第一节点向该客户端发送注销成功信息。
通过上述技术方案，在第一节点中存储私钥以及可公开的对象信息，在第二节点中存储基于第一节点的公钥加密的信息，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。
进一步，在进行信息注销的过程中，基于文件信息表中存储的信息映射关系，保证注销是针对待注销对象的已注册特征进行的，注销过程不影响其他已注册特征，实现了加密状态下的动态注销，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
本申请实施例提供了另一种信息处理系统，参见图12，图12是本申请实施例提供的一种信息处理系统的架构示意图，该信息处理系统1200包括客户端1210、第三节点1220和第四节点1230。
客户端1210用于在检测到待识别的对象的情况下，获取待识别的对象的特征，基于第三节点1220的公钥1221对获取到的待识别的对象的特征进行加密得到加密特征，向第三节点 1220发送该加密特征以及识别请求，指示第三节点针对客户端1210进行识别。
第三节点1220用于存储文件信息表以及已注册特征所在的文件。第三节点1220用于响应于客户端的识别请求，基于文件信息表、第三节点1220的评估密钥1222、所存储的文件对从客户端接收到的加密特征进行比对，得到比对结果，向第四节点1230发送比对结果。
第四节点1230用于基于第三节点1220的私钥1223，对接收到的比对结果进行解密，向第三节点1220发送解密后的比对结果。
第三节点1220还用于基于解密后的比对结果，确定待识别的对象的对象信息(例如，身份信息)，向客户端1210发送对象信息。
其中，客户端1210、第三节点1220和第四节点1230之间通过有线网络或者无线网络方式通信连接。在一些实施例中，上述无线网络或有线网络使用标准通信技术和/或协议。网络通常为因特网、但也能够是任何网络，包括但不限于局域网(local area network，LAN)、城域网(metropolitan area network，MAN)、广域网(wide area network，WAN)、移动、有线或者无线网络、专用网络或者虚拟专用网络的任何组合。在一些实施例中，客户端1210、第三节点1220和第四节点1230之间基于远程调用协议(remote procedure call protocol，RPC)来实现点对点(peer-to-peer，P2P)通讯。在一些实施例中，客户端1210、第三节点1220和第四节点1230使用包括超级文本标记语言(hyper text markup language，HTML)、可扩展标记语言(extensible markup language，XML)等的技术和/或格式来代表通过网络交换的数据。此外还能够使用诸如安全套接字层(secure socket layer，SSL)、传输层安全(transport layer security，TLS)、虚拟专用网络(virtual private network，VPN)、网际协议安全(internet protocol security，IPsec)等常规加密技术来加密所有或者一些链路。在另一些实施例中，还能够使用定制和/或专用数据通信技术取代或者补充上述数据通信技术。
在一些实施例中，该客户端是指用户侧的终端或服务器。其中，终端也被称为智能终端或移动智能终端，是指一类具备丰富人机交互方式、拥有接入互联网能力、通常搭载各种操作系统、具有较强处理能力的设备。在一些实施例中，移动智能终端的类型包括但不限于智能手机、平板电脑、车载终端、掌上游戏主机等。其中，服务器可以是一个或多个计算设备所组成的服务器集群。
在一些实施例中，该第三节点和第四节点可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还能够是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(content delivery network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。
上述图12从系统架构的角度对本申请实施例提供的另一种信息处理系统的架构进行了介绍，下面对该信息处理系统中客户端、第三节点和第四节点的硬件结构进行介绍。
上述图2提供了一种计算设备，能够配置为信息处理系统1200中的客户端、第二节点或第三节点中的任一种，参考图2，在此不作赘述。
接下来介绍本申请实施例提供的信息处理方法，该方法能够应用于上述信息处理系统1200中。
在本申请实施例中，在基于信息处理系统进行信息处理之前，需要基于系统中的处理需求参数，通过密钥生成算法，确定部署在信息处理系统中的一对公钥、密钥和评估密钥。原 理参考图1对应的信息处理系统，在此不作赘述。在本申请实施例中，通过密钥生成算法，确定一对公钥、密钥和评估密钥的过程由第三节点执行，第三节点将公钥配置给客户端，公钥用于对获取到的对象的特征进行加密；将私钥发送给第四节点，私钥用于对加密后的信息进行解密，其中，私钥仅由第四节点持有，也即是，只有第四节点能够对信息处理系统中加密后的信息进行解密。在一些实施例中，该第四节点将私钥存储在安全硬件中，例如，可信执行环境(trusted execution environment，TEE)，以保证私钥的安全性。
其中，评估密钥用于对加密后的特征(密文)进行同态运算。在一些实施例中，第三节点能够将公钥和评估密钥配置给信息处理系统中的任意节点，本申请实施例对此不做限定。
在本申请实施例中，在信息处理系统中已部署有公钥、私钥和评估密钥等参数的情况下，本申请实施例提供的信息处理方法即可基于该信息处理系统实现。接下来，对本申请实施例提供的信息处理方法中，针对待注册对象进行信息注册的过程进行说明。图13是本申请实施例提供的一种信息处理方法的流程示意图，参见图13，该方法包括：
1301、客户端基于待注册的对象A的对象信息，向第三节点发送注册请求，获取对象A的特征，该注册请求携带该客户端的编号信息和对象A的对象信息。
本步骤参考步骤301，在此不作赘述。
1302、第三节点响应于该注册请求，确定第三节点中的第二目标文件的文件信息，向客户端发送该第二目标文件的文件信息。
本步骤参考步骤302，在此不作赘述。
1303、客户端在接收到该第三节点发送的第二目标文件的文件信息的情况下，对对象A的特征进行编码，得到对象A的第一特征向量FA，FA为M维向量，其中，M为正整数。
本步骤参考步骤304，在此不作赘述。
1304、客户端基于对象A的第一特征向量FA和第二目标文件的文件信息，得到对象A的第二特征向量PA，PA为N×M维向量，其中，M和N为正整数。
本步骤参考步骤305，在此不作赘述。
1305、客户端基于该第三节点的公钥，对对象A的第二特征向量PA进行加密，得到对象A的加密特征EPA。
本步骤参考步骤306，在此不作赘述。
1306、客户端向第三节点发送EPA和该客户端的编号信息。
1307、第三节点根据该第二目标文件的文件信息以及该客户端的编号信息，将接收到的对象A的加密特征EPA添加至该第二目标文件中。
本步骤参考步骤309，在此不作赘述。
1308、第三节点在对象A的加密特征添加成功的情况下，将该对象A的对象信息添加至文件信息表，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息。
本步骤参考步骤311，在此不作赘述。
1309、第三节点向该客户端发送注册成功信息。
通过上述技术方案，在第三节点中存储基于公钥加密的信息以及可公开的对象信息，在第四节点中存储私钥，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了 信息安全。进一步地，第四节点仅用于提供解密服务，多个节点之间的信息交互的过程简化，信息处理的效率有效提升。
上述技术方案中，在进行信息注册的过程中，通过注册编码，保证注册是基于待注册对象对应的第二目标文件中的可用位置进行的，注册过程不影响其他已注册特征，实现了加密状态下的动态注册，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
在介绍了本申请实施例提供的信息处理方法中信息注册过程之后，接下来，对本申请实施例提供的信息处理方法中信息识别的过程进行说明。图14是本申请实施例提供的一种信息处理方法的流程示意图，参见图14，该方法包括：
1401、客户端在检测到待识别的对象B的情况下，向第三节点发送识别请求，并提取对象B的特征，该识别请求携带该客户端的编号信息。
本步骤参考步骤701，在此不作赘述。
1402、客户端对对象B的特征进行编码，得到对象B的第一特征向量FB，FB为M维向量，其中，M为正整数。
本步骤参考步骤702，在此不作赘述。
1403、客户端基于对象B的第一特征向量FB，得到对象B的第二特征向量PB，PB为N×M维向量，其中，M和N为正整数。
本步骤参考步骤703，在此不作赘述。
1404、客户端基于该第三节点的公钥，对对象B的第二特征向量PB进行加密，得到对象B的加密特征EPB。
本步骤参考步骤704，在此不作赘述。
1405、客户端向第三节点发送EPB。
1406、第三节点响应于该识别请求，将第三节点的评估密钥加载到内存中。
本步骤参考步骤708和步骤709，在此不作赘述。
1407、第三节点基于响应于该识别请求，根据该客户端的编号信息，确定该第三节点中的第一目标文件的文件信息。
本步骤参考步骤706，在此不作赘述。
需要说明的是，上述步骤1406和步骤1407可以同步执行，也可以先后执行，本申请实施例对此不作限定。
1408、第三节点基于该第三节点的评估密钥，对接收到的该对象B的加密特征EPB和该第一目标文件中各个已注册特征进行内积运算，得到比对结果。
本步骤原理参考步骤711，在此不作赘述。
1409、第三节点向第四节点发送比对结果。
1410、第四节点在接收到该比对结果的情况下，基于该第三节点的私钥对该比对结果进行解密，向该第三节点发送解密后的比对结果。
本步骤原理参考步骤713，在此不作赘述。
1411、第三节点基于解密后的比对结果，确定目标特征，该目标特征是与该对象B的特征之间的相似度最大的已注册特征。
本步骤原理参考步骤713，在此不作赘述。
1412、第三节点基于该目标特征在该第一目标文件中的位置信息，从文件信息表中，获取该目标特征的对象信息，将该目标特征的对象信息，确定为对象B的对象信息，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息。
本步骤原理参考步骤714，在此不作赘述。
1413、第三节点向该客户端发送对象B的对象信息。
通过上述技术方案，在第三节点中存储基于公钥加密的信息以及可公开的对象信息，在第四节点中存储私钥，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了信息安全。进一步地，第四节点仅用于提供解密服务，多个节点之间的信息交互的过程简化，信息处理的效率有效提升。
并且，通过上述技术方案，基于一套密钥即可实现一对多的信息识别，有效解决了为了存储多个已注册特征对应的多套密钥而占用大量存储空间的问题。
在上述技术方案中，在进行信息识别的过程中，将待识别的对象的特征编码为与第一目标文件的维度匹配的多维向量，能够并行地将待识别的对象的特征与多个已注册对象进行比对，等同于在一个处理周期内完成了针对多个已注册对象的信息处理过程，大大提升了信息处理的效率。
接下来，对本申请实施例提供的信息处理方法中信息注销的过程进行说明。图15是本申请实施例提供的一种信息处理方法的流程示意图，参见图15，该方法包括：
1501、客户端基于待注销的对象C的对象信息，向第三节点发送注销请求，该注销请求携带该客户端的编号信息和待注销的对象C的对象信息。
本步骤参考步骤1001，在此不作赘述。
1502、第三节点响应于该注销请求，确定该第三节点中第三目标节点中该对象C对应的已注册特征所在的第三目标文件的文件信息。
本步骤参考步骤1002，在此不作赘述。
1503、第三节点基于该第三目标文件的文件信息，将该对象C对应的已注册特征EPC从该第三目标文件中删除。
本步骤参考步骤1005，在此不作赘述。
1504、第三节点在对象C对应的已注册特征删除成功的情况下，从文件信息表中删除该对象C的对象信息以及该对象C对应的已注册特征在该第三目标文件中的位置信息，该文件信息表包括该第三节点中的文件中各个已注册特征的对象信息以及各个已注册特征在该第三节点中的文件中的位置信息。
本步骤参考步骤1007，在此不作赘述。
1505、第三节点向该客户端发送注销成功信息。
通过上述技术方案，在第三节点中存储基于公钥加密的信息以及可公开的对象信息，在第四节点中存储私钥，保证了存储权限和解密权限的分离，在对象的特征信息不出客户端的情况下，多个节点之间基于信息映射关系进行交互，即可实现高效的信息处理，有效保证了 信息安全。进一步地，第四节点仅用于提供解密服务，多个节点之间的信息交互的过程简化，信息处理的效率有效提升。
在上述技术方案中，在进行信息注销的过程中，基于文件信息表中存储的信息映射关系，保证注销是针对待注销对象的已注册特征进行的，注销过程不影响其他已注册特征，实现了加密状态下的动态注销，提升了信息处理的灵活性，在保障信息安全的基础上，提升了信息处理效率。
可选地，为了进一步提升第三节点进行并行运算的效率，可以基于节点的各个方面进行配置，例如，基于软件方面，使用OpenMP，通过多线程实现针对数据的并行运算。又例如，基于硬件方面，在信息处理系统中部署FPGA加速卡，以提升信息处理系统对数据的并行处理能力。本申请实施例提供了一种信息处理系统的架构示意图，参见图16，其中，通过在信息处理系统1600的第三节点中部署FPGA加速卡，提升第三节点进行数据计算的并行度，其中，信息处理系统1600的整体架构参考图12对应的信息处理系统1200，在此不做赘述。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”、“第n”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。例如，在不脱离各种所述示例的范围的情况下，第一客户端可以被称为第二客户端，并且类似地，第二客户端可以被称为第一客户端。第一客户端和第二客户端都可以是客户端，并且在某些情况下，可以是单独且不同的客户端。
本申请中术语“至少一个”的含义是指一个或多个，本申请中术语“多个”的含义是指两个或两个以上，例如，多个客户端是指两个或两个以上的客户端。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以程序产品的形式实现。该程序产品包括一个或多个程序指令。在计算设备上加载和执行该程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (32)

  1. 一种信息处理系统，其特征在于，所述信息处理系统包括：客户端、第一节点和第二节点；
    所述客户端，用于向所述第一节点发送携带有所述客户端的编号信息的识别请求，向所述第二节点发送待识别的第一对象的加密特征和所述客户端的编号信息，所述第一对象的加密特征基于所述第一节点的公钥和所述第一对象的特征得到；
    所述第一节点，用于响应于所述识别请求，确定所述第二节点中的第一目标文件，向所述第二节点发送识别指示，所述识别指示携带所述客户端的编号信息和所述第一目标文件的文件信息；
    所述第二节点，用于响应于所述识别指示，基于接收到的所述第一对象的加密特征、所述客户端的编号信息、所述第一目标文件的文件信息以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果，向所述第一节点发送所述比对结果；
    所述第一节点，还用于在接收到所述比对结果的情况下，基于所述第一节点的私钥对所述比对结果进行解密，基于解密后的比对结果，得到所述第一对象的对象信息，向所述客户端发送所述第一对象的对象信息。
  2. 根据权利要求1所述的系统，其特征在于，
    所述客户端，还用于基于所述第一对象的特征进行编码，得到所述第一对象的第一特征向量，所述第一特征向量为M维向量；
    基于所述第一对象的第一特征向量，得到所述第一对象的第二特征向量，所述第一对象的第二特征向量为N×M维向量，且所述第一对象的第二特征向量包括N个所述第一对象的第一特征向量；
    基于所述第一节点的公钥，对所述第一对象的第二特征向量进行加密，得到所述第一对象的加密特征；
    其中，M和N为正整数。
  3. 根据权利要求1或2所述的系统，其特征在于，所述第二节点包括调度节点和多个目标节点；
    所述第一节点，用于基于所述识别请求中所述客户端的编号信息，从文件信息表中确定所述第二节点中所述客户端对应的第一目标节点，从所述文件信息表中确定所述第一目标节点中的所述第一目标文件的文件信息，所述文件信息表包括客户端的编号信息与所述第二节点包括的多个目标节点之间的对应关系，以及，所述多个目标节点与文件之间的对应关系。
  4. 根据权利要求3所述的系统，其特征在于，
    所述第二节点中的调度节点，用于响应于所述识别指示，指示所述第一目标节点将所述第一节点的评估密钥加载到内存中。
  5. 根据权利要求3或4所述的系统，其特征在于，
    所述第二节点中的调度节点，用于响应于所述识别指示，在从所述客户端接收到的所述编号信息和所述识别指示携带的客户端的编号信息一致的情况下，根据所述第一目标文件的文件信息，向所述第二节点中的第一目标节点发送所述识别指示以及所述第一对象的加密特征。
  6. 根据权利要求4或5所述的系统，其特征在于，
    所述第二节点中的第一目标节点，用于基于所述第一节点的评估密钥，对接收到的所述第一对象的加密特征和所述第一目标文件中各个已注册特征在密文态下进行内积运算，得到比对结果。
  7. 根据权利要求1至6任一项所述的系统，其特征在于，
    所述第一节点，用于基于所述解密后的比对结果，确定目标特征，所述目标特征是与所述第一对象的特征之间的相似度最大的已注册特征；
    基于所述目标特征在所述第一目标文件中的位置信息，从文件信息表中，获取所述目标特征的对象信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息；
    将所述目标特征的对象信息，确定为所述第一对象的对象信息。
  8. 根据权利要求1至7任一项所述的系统，其特征在于，
    所述客户端，还用于向所述第一节点发送注册请求，所述注册请求携带所述客户端的编号信息和待注册的第二对象的对象信息；
    所述第一节点，还用于响应于所述注册请求，确定所述第二节点中第二目标节点中的第二目标文件，向所述客户端发送所述第二目标文件的文件信息，向所述第二节点发送注册指示，所述注册指示携带所述客户端的编号信息和所述第二目标文件的文件信息；
    所述客户端，还用于向所述第二节点发送所述第二对象的加密特征和所述客户端的编号信息，所述第二对象的加密特征基于所述第一节点的公钥、所述第二对象的特征和所述第二目标文件的文件信息得到；
    所述第二节点，还用于响应于所述注册指示，基于接收到的所述第二对象的加密特征、所述客户端的编号信息、所述第二目标文件的文件信息以及所述第一节点的评估密钥，通过所述第二目标节点，将所述第二对象的加密特征添加至所述第二目标文件中，向所述第一节点发送添加成功信息；
    所述第一节点，还用于在接收到所述添加成功信息的情况下，将所述第二对象的对象信息添加至文件信息表，向所述客户端发送注册成功信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息。
  9. 根据权利要求8所述的系统，其特征在于，所述第二目标文件的文件信息包括第二目标文件的可用位置编号；
    所述客户端，还用于对所述第二对象的特征进行编码，得到所述第二对象的第一特征向量，所述第二对象的第一特征向量为M维向量；
    基于所述第二对象的第一特征向量和所述可用位置编号，得到所述第二对象的第二特征向量，所述第二对象的第二特征向量为N×M维向量，且所述第二对象的第一特征向量位于所述第二对象的第二特征向量中所述可用位置编号对应的位置，所述第二对象的第二特征向量中所述可用位置编号对应的位置以外的位置为0；
    基于所述第一节点的公钥，对所述第二对象的第二特征向量进行加密，得到所述第二对象的加密特征；
    其中，M和N为正整数。
  10. 根据权利要求1至9任一项所述的系统，其特征在于，
    所述客户端，还用于向所述第一节点发送注销请求，所述注销请求携带所述客户端的编号信息和待注销的第三对象的对象信息；
    所述第一节点，还用于响应于所述注销请求，确定所述第二节点中的第三目标节点中所述第三对象对应的已注册特征所在的第三目标文件，向所述第二节点发送注销指示，所述注销指示携带所述客户端的编号信息和所述第三目标文件的文件信息，所述第三目标文件的文件信息包括所述第三对象对应的已注册特征在所述第三目标文件中的位置编号；
    所述第二节点，还用于响应于所述注销指示，基于所述客户端的编号信息、所述第三目标文件的文件信息以及所述第一节点的评估密钥，通过所述第三目标节点，将所述第三对象对应的已注册特征从所述第三目标文件中删除，向所述第一节点发送删除成功信息；
    所述第一节点，还用于在接收到所述删除成功信息的情况下，从文件信息表中删除所述第三对象的对象信息以及所述第三对象对应的已注册特征在所述第三目标文件中的位置信息，向所述客户端发送注销成功信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息。
  11. 一种信息处理系统，其特征在于，所述信息处理系统包括：客户端、第三节点和第四节点；
    所述客户端，用于向所述第三节点发送有携带所述客户端的编号信息的识别请求和待识别的第一对象的加密特征，所述第一对象的加密特征基于所述第三节点的公钥和所述第一对象的特征得到；
    所述第三节点，用于响应于所述识别请求，确定所述第三节点中的第一目标文件的文件信息，基于接收到的所述第一对象的加密特征、所述第一目标文件的文件信息以及所述第三节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果，向所述第四节点发送所述比对结果；
    所述第四节点，用于在接收到所述比对结果的情况下，基于所述第三节点的私钥对所述比对结果进行解密，向所述第三节点发送解密后的比对结果；
    所述第三节点，还用于基于接收到的所述解密后的比对结果，得到所述第一对象的对象信息，向所述客户端发送所述第一对象的对象信息。
  12. 一种信息处理方法，其特征在于，由信息处理系统中的客户端执行，所述信息处理系统还包括第一节点和第二节点，所述方法包括：
    向所述第一节点发送携带有所述客户端的编号信息的识别请求；
    向所述第二节点发送待识别的第一对象的加密特征和所述客户端的编号信息，所述第一对象的加密特征基于所述第一节点的公钥和所述第一对象的特征得到；
    从所述第一节点接收到所述第一对象的对象信息，所述第一对象的对象信息基于所述第一对象的加密特征、所述第一节点的评估密钥以及所述第一节点的私钥得到。
  13. 根据权利要求12所述的方法，其特征在于，所述向所述第二节点发送待识别的第一对象的加密特征和所述客户端的编号信息之前，所述方法还包括：
    基于所述第一对象的特征进行编码，得到所述第一对象的第一特征向量，所述第一特征向量为M维向量；
    基于所述第一对象的第一特征向量，得到所述第一对象的第二特征向量，所述第一对象的第二特征向量为N×M维向量，且所述第一对象的第二特征向量包括N个所述第一对象的第一特征向量；
    基于所述第一节点的公钥，对所述第一对象的第二特征向量进行加密，得到所述第一对象的加密特征；
    其中，M和N为正整数。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送注册请求，所述注册请求携带所述客户端的编号信息和待注册的第二对象的对象信息；
    向所述第二节点发送所述第二对象的加密特征和所述客户端的编号信息，所述第二对象的加密特征基于所述第一节点的公钥、所述第二对象的特征和所述第二节点中的第二目标文件的文件信息得到，所述第二目标文件的文件信息由所述第一节点响应于所述注册请求确定；
    从所述第一节点接收到注册成功信息。
  15. 根据权利要求14所述的方法，其特征在于，所述第二目标文件的文件信息包括第二目标文件的可用位置编号，所述向所述第二节点发送所述第二对象的加密特征和所述客户端的编号信息之前，所述方法还包括：
    基于所述第二对象的特征进行编码，得到所述第二对象的第一特征向量，所述第二对象的第一特征向量为M维向量；
    基于所述第二对象的第一特征向量和所述可用位置编号，得到所述第二对象的第二特征向量，所述第二对象的第二特征向量为N×M维向量，且所述第二对象的第一特征向量位于所述第二对象的第二特征向量中所述可用位置编号对应的位置，所述第二对象的第二特征向量中所述可用位置编号对应的位置以外的位置为0；
    基于所述第一节点的公钥，对所述第二对象的第二特征向量进行加密，得到所述第二对象的加密特征；
    其中，M和N为正整数。
  16. 根据权利要求12至15任一项所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送注销请求，所述注销请求携带所述客户端的编号信息和待注销的第三对象的对象信息；
    从所述第一节点接收到注销成功信息。
  17. 一种信息处理方法，其特征在于，由信息处理系统中的第一节点执行，所述信息处理系统还包括客户端和第二节点，所述方法包括：
    响应于从客户端接收到的携带有所述客户端的编号信息的识别请求，确定所述第二节点中的第一目标文件，向所述第二节点发送识别指示，所述识别指示携带所述客户端的编号信息和所述第一目标文件的文件信息；
    在从所述第二节点接收到比对结果的情况下，基于所述第一节点的私钥对所述比对结果进行解密，基于解密后的比对结果，得到所述第一对象的对象信息，向所述客户端发送所述第一对象的对象信息；
    其中，所述比对结果由所述第二节点响应于所述识别指示，基于所述第一对象的加密特征、所述客户端的编号信息、所述第一目标文件的文件信息以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对得到；所述第一对象的加密特征由所述客户端基于所述第一节点的公钥和所述第一对象的特征得到。
  18. 根据权利要求17所述的方法，其特征在于，所述第二节点包括调度节点和多个目标节点，所述响应于从客户端接收到的携带有所述客户端的编号信息的识别请求，确定所述第二节点中的第一目标文件包括：
    基于所述识别请求中所述客户端的编号信息，从文件信息表中确定所述第二节点中所述客户端对应的第一目标节点，从所述文件信息表中确定所述第一目标节点中的所述第一目标文件的文件信息，所述文件信息表包括客户端的编号信息与所述第二节点包括的多个目标节点之间的对应关系，以及，所述多个目标节点与文件之间的对应关系。
  19. 根据权利要求17或18所述的方法，其特征在于，所述基于解密后的比对结果，得到所述第一对象的对象信息包括：
    所述第一节点基于所述解密后的比对结果，确定目标特征，所述目标特征是与所述第一对象的特征之间的相似度最大的已注册特征；
    基于所述目标特征在所述第一目标文件中的位置信息，从文件信息表中，获取所述目标特征的对象信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息；
    将所述目标特征的对象信息，确定为所述第一对象的对象信息。
  20. 根据权利要求17至19任一项所述的方法，其特征在于，所述方法还包括：
    响应于从所述客户端接收到的注册请求，确定所述第二节点中第二目标节点中的第二目标文件，向所述客户端发送所述第二目标文件的文件信息，向所述第二节点发送注册指示， 所述注册请求携带所述客户端的编号信息和待注册的第二对象的对象信息，所述注册指示携带所述客户端的编号信息和所述第二目标文件的文件信息；
    在从所述第二节点接收到添加成功信息的情况下，将所述第二对象的对象信息添加至文件信息表，向所述客户端发送注册成功信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息，所述添加成功信息用于表示所述第二对象的加密特征已添加至所述第二目标文件中。
  21. 根据权利要求17至20任一项所述的方法，其特征在于，所述方法还包括：
    响应于从所述客户端接收到的注销请求，确定所述第二节点中的第三目标节点中所述第三对象对应的已注册特征所在的第三目标文件，向所述第二节点发送注销指示，所述注销指示携带所述客户端的编号信息和所述第三目标文件的文件信息，所述注销请求携带所述客户端的编号信息和待注销的第三对象的对象信息；
    在从所述第二节点接收到删除成功信息的情况下，从文件信息表中删除所述第三对象的对象信息以及所述第三对象对应的已注册特征在所述第三目标文件中的位置信息，向所述客户端发送注销成功信息，所述文件信息表包括所述第二节点中的文件中各个已注册特征的对象信息以及各个已注册特征在所述第二节点中的文件中的位置信息，所述删除成功信息用于表示所述第三对象对应的已注册特征已从所述第三目标文件中删除。
  22. 一种信息处理方法，其特征在于，由信息处理系统中的第二节点执行，所述信息处理系统还包括客户端和第一节点，所述方法包括：
    响应于从所述第一节点接收到的识别指示，基于从所述客户端接收到的待识别的第一对象的加密特征、所述客户端的编号信息、所述第二节点中的第一目标文件的文件信息以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果，向所述第一节点发送所述比对结果；
    其中，所述识别指示携带所述客户端的编号信息和所述第一目标文件的文件信息，所述第一对象的加密特征基于所述第一节点的公钥和所述第一对象的特征得到，所述比对结果用于确定所述第一对象的对象信息。
  23. 根据权利要求22所述的方法，其特征在于，所述方法还包括：
    所述第二节点中的调度节点响应于所述识别指示，指示所述第一目标节点将所述第一节点的评估密钥加载到内存中。
  24. 根据权利要求22或23所述的方法，其特征在于，所述第二节点包括调度节点和多个目标节点，所述响应于从所述第一节点接收到的识别指示，基于从所述客户端接收到的待识别的第一对象的加密特征、所述客户端的编号信息、所述第二节点中的第一目标文件的文件信息以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果包括：
    所述调度节点响应于所述识别指示，根据所述第一目标文件的文件信息以及所述客户端的编号信息，向所述第二节点中的第一目标节点发送所述识别指示以及所述第一对象的加密 特征；
    所述第一目标节点，响应于所述识别指示，基于接收到的所述第一对象的加密特征、所述第一目标文件以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果。
  25. 根据权利要求24所述的方法，其特征在于，所述响应于所述识别指示，根据所述第一目标文件的文件信息以及所述客户端的编号信息，向所述第二节点中的第一目标节点发送所述识别指示以及所述第一对象的加密特征包括：
    所述第二节点中的调度节点响应于所述识别指示，在从所述客户端接收到的所述编号信息和所述识别指示携带的客户端的编号信息一致的情况下，根据所述第一目标文件的文件信息，向所述第二节点中的第一目标节点发送所述识别指示以及所述第一对象的加密特征。
  26. 根据权利要求22至25任一项所述的方法，其特征在于，所述基于从所述客户端接收到的待识别的第一对象的加密特征、所述客户端的编号信息、所述第二节点中的第一目标文件的文件信息以及所述第一节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果包括：
    基于所述第一节点的评估密钥，对接收到的所述第一对象的加密特征和所述第一目标文件中各个已注册特征在密文态下进行内积运算，得到比对结果。
  27. 根据权利要求22至26任一项所述的方法，其特征在于，所述方法还包括：
    响应于从所述第一节点接收到的注册指示，基于从所述客户端接收到的待注册的第二对象的加密特征、所述客户端的编号信息、所述第二节点中第二目标节点中的第二目标文件的文件信息以及所述第一节点的评估密钥，将所述第二对象的加密特征添加至所述第二目标文件中，向所述第一节点发送添加成功信息，所述第二对象的加密特征基于所述第一节点的公钥、所述第二对象的特征和所述第二目标文件的文件信息得到。
  28. 根据权利要求22至27任一项所述的方法，其特征在于，所述方法还包括：
    响应于从所述第一节点接收到的注销指示，基于所述客户端的编号信息、所述第二节点中的第三目标节点中所述第三对象对应的已注册特征所在的第三目标文件的文件信息以及所述第一节点的评估密钥，将所述第三对象对应的已注册特征从所述第三目标文件中删除，向所述第一节点发送删除成功信息，所述注销指示携带所述客户端的编号信息和所述第三目标文件的文件信息。
  29. 一种信息处理方法，其特征在于，由信息处理系统中的第三节点执行，所述信息处理系统还包括客户端和第四节点，所述方法包括：
    响应于从所述客户端接收到的识别请求，确定所述第三节点中的第一目标文件的文件信息，基于从客户端接收到的待识别的第一对象的加密特征、所述第一目标文件的文件信息以及所述第三节点的评估密钥，对所述第一对象的加密特征进行比对，得到比对结果，向所述第四节点发送所述比对结果，所述识别请求携带所述客户端的编号信息，所述第一对象的加 密特征基于所述第三节点的公钥和所述第一对象的特征得到；
    基于从第四节点接收到的解密后的比对结果，得到所述第一对象的对象信息，向所述客户端发送所述第一对象的对象信息，所述解密后的比对结果由所述第四节点基于所述第三节点的私钥对所述比对结果进行解密得到。
  30. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器，所述存储器用于存储至少一段程序代码，所述至少一段程序代码由所述处理器加载并执行如权利要求12至权利要求16中任一项所述的信息处理方法，或者，如权利要求17至权利要求21中任一项所述的信息处理方法，或者，如权利要求22至权利要求28中任一项所述的信息处理方法，或者，如权利要求29所述的信息处理方法。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质用于存储至少一段程序代码，所述至少一段程序代码用于执行如权利要求12至权利要求16中任一项所述的信息处理方法，或者，如权利要求17至权利要求21中任一项所述的信息处理方法，或者，如权利要求22至权利要求28中任一项所述的信息处理方法，或者，如权利要求29所述的信息处理方法。
  32. 一种计算机程序产品，其特征在于，当所述计算机程序产品在计算机上运行时，使得所述计算机执行如权利要求12至权利要求16中任一项所述的信息处理方法，或者，如权利要求17至权利要求21中任一项所述的信息处理方法，或者，如权利要求22至权利要求28中任一项所述的信息处理方法，或者，如权利要求29所述的信息处理方法。
PCT/CN2022/123841 2021-11-25 2022-10-08 信息处理系统、方法、设备及存储介质 WO2023093312A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202111415970.4 2021-11-25
CN202111415970 2021-11-25
CN202210080192.6 2022-01-24
CN202210080192.6A CN116167030A (zh) 2021-11-25 2022-01-24 信息处理系统、方法、设备及存储介质

Publications (1)

Publication Number Publication Date
WO2023093312A1 true WO2023093312A1 (zh) 2023-06-01

Family

ID=86416986

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/123841 WO2023093312A1 (zh) 2021-11-25 2022-10-08 信息处理系统、方法、设备及存储介质

Country Status (2)

Country Link
CN (1) CN116167030A (zh)
WO (1) WO2023093312A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107612910A (zh) * 2017-09-19 2018-01-19 北京邮电大学 一种分布式文件数据访问方法及系统
CN107995147A (zh) * 2016-10-27 2018-05-04 中国电信股份有限公司 基于分布式文件系统的元数据加解密方法和系统
CN109886026A (zh) * 2019-01-11 2019-06-14 平安科技（深圳）有限公司 数据保存查询方法、装置、计算机系统及可读存储介质
CN110290149A (zh) * 2019-07-17 2019-09-27 暨南大学 一种基于c/s多级缓存的位置隐私保护方法
CN110493220A (zh) * 2019-08-16 2019-11-22 腾讯科技（深圳）有限公司 一种基于区块链的数据共享方法、设备及存储介质
US20210194863A1 (en) * 2017-02-22 2021-06-24 Network Next Inc. Methods of bidirectional packet exchange over nodal pathways

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107995147A (zh) * 2016-10-27 2018-05-04 中国电信股份有限公司 基于分布式文件系统的元数据加解密方法和系统
US20210194863A1 (en) * 2017-02-22 2021-06-24 Network Next Inc. Methods of bidirectional packet exchange over nodal pathways
CN107612910A (zh) * 2017-09-19 2018-01-19 北京邮电大学 一种分布式文件数据访问方法及系统
CN109886026A (zh) * 2019-01-11 2019-06-14 平安科技（深圳）有限公司 数据保存查询方法、装置、计算机系统及可读存储介质
CN110290149A (zh) * 2019-07-17 2019-09-27 暨南大学 一种基于c/s多级缓存的位置隐私保护方法
CN110493220A (zh) * 2019-08-16 2019-11-22 腾讯科技（深圳）有限公司 一种基于区块链的数据共享方法、设备及存储介质

Also Published As

Publication number Publication date
CN116167030A (zh) 2023-05-26

Similar Documents

Publication Publication Date Title
Zhang et al. PIC: Enable large-scale privacy preserving content-based image search on cloud
US8539231B1 (en) Encryption key management
CN117692170A (zh) 通信方法和设备、折叠数据的方法和系统以及计算机
US8848922B1 (en) Distributed encryption key management
Varri et al. A scoping review of searchable encryption schemes in cloud computing: taxonomy, methods, and recent developments
US20230379158A1 (en) Snapshot transfer for cloud-based storage across accounts
EP4020265A1 (en) Method and device for storing encrypted data
KR102008101B1 (ko) 함수 암호를 이용한 안전한 바이오 인증 방법
US9344407B1 (en) Centrally managed use case-specific entity identifiers
Abd Elminaam et al. SMCACC: developing an efficient dynamic secure framework for mobile capabilities augmentation using cloud computing
CN114398623A (zh) 一种安全策略的确定方法
CN107133517B (zh) 一种基于内存中数据加密和计算的数据还原方法
Fan et al. Deploying parallelised ciphertext-policy attributed-based encryption in clouds
US9251375B1 (en) Use case-specific entity identifiers
Ke et al. Parallel incremental attribute-based encryption for mobile cloud data storage and sharing
WO2023093312A1 (zh) 信息处理系统、方法、设备及存储介质
Ahmad et al. Parallel query execution over encrypted data in database-as-a-service (DaaS)
US11449372B1 (en) System for enforcing use of schemas and interfaces
Patel et al. A survey: Secure cloud data storage and access control system using blockchain
Yang Application of wireless security in mobile office automation system based on big data
Attri et al. Enhancing Cloud Security Using Secured Binary-DNA Approach with Impingement Resolution and Complex Key Generation
Gupta et al. Hybrid Multi-User Based Cloud Data Security for Medical Decision Learning Patterns
Nisha et al. Blockchain-enabled privacy and homomorphic encryption with voting classifier in iiot
US20240177018A1 (en) Systems and Methods for Differentially Private Federated Machine Learning for Large Models and a Strong Adversary
Zhang et al. Achieving proof of shared ownership for the shared file in collaborative cloud applications

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897397

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2022897397

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022897397

Country of ref document: EP

Effective date: 20240603