WO2024027665A1 - 一种数据融合方法、设备、系统及存储介质 - Google Patents

一种数据融合方法、设备、系统及存储介质 Download PDF

Info

Publication number
WO2024027665A1
WO2024027665A1 PCT/CN2023/110357 CN2023110357W WO2024027665A1 WO 2024027665 A1 WO2024027665 A1 WO 2024027665A1 CN 2023110357 W CN2023110357 W CN 2023110357W WO 2024027665 A1 WO2024027665 A1 WO 2024027665A1
Authority
WO
WIPO (PCT)
Prior art keywords
fusion
service
group
query
behavior control
Prior art date
Application number
PCT/CN2023/110357
Other languages
English (en)
French (fr)
Inventor
汪晟
黎火荣
李亦然
苏乐
张焱山
李飞飞
Original Assignee
阿里云计算有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里云计算有限公司 filed Critical 阿里云计算有限公司
Publication of WO2024027665A1 publication Critical patent/WO2024027665A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine

Definitions

  • This application relates to the field of data processing technology, and in particular to a data fusion method, equipment, system and storage medium.
  • Data fusion technology can physically or logically fuse the data of multiple participants, and can perform data calculation and analysis after data fusion to better explore the value of the data.
  • Various aspects of this application provide a data fusion method, device, system and storage medium to solve the problem of data leakage during the data fusion process.
  • the embodiment of this application provides a data fusion method, including:
  • the fusion service is used to respond to fusion computing requests issued within the fusion group within the scope of the behavior control rules.
  • the embodiment of this application also provides a data fusion method, including:
  • the trusted device For the fusion group with needs, trigger the trusted device to create a dedicated fusion service for the fusion group, and the trusted device provides a trusted execution environment for the fusion service;
  • Embodiments of the present application also provide a data fusion system, including: a control platform, a trusted device, and at least one fusion group;
  • the control platform is used to send services to the trusted device for the target convergence group with convergence requirements. Create a request; provide the behavior control rules issued by each participant in the fusion group to the trusted device;
  • the trusted device is configured to create a dedicated convergence service for the target convergence group according to the service creation request;
  • the fusion service is configured to respond to fusion computing requests issued within the target fusion group within the scope of the behavior control rules in the trusted execution environment provided by the trusted device.
  • Embodiments of the present application also provide a trusted device, including a memory, a processor and a communication component;
  • the memory is used to store one or more computer instructions
  • the processor is coupled to the memory and the communications component for executing the one or more computer instructions for:
  • the fusion service is used to respond to fusion computing requests issued within the fusion group within the scope of the behavior control rules.
  • An embodiment of the present application also provides a control device, including a memory, a processor and a communication component;
  • the memory is used to store one or more computer instructions
  • the processor is coupled to the memory and the communications component for executing the one or more computer instructions for:
  • the trusted device For the fusion group with needs, trigger the trusted device to create a dedicated fusion service for the fusion group, and the trusted device provides a trusted execution environment for the fusion service;
  • Embodiments of the present application also provide a computer-readable storage medium that stores computer instructions. When the computer instructions are executed by one or more processors, they cause the one or more processors to execute the foregoing data fusion method.
  • a dedicated fusion service can be created for the fusion group in a trusted execution environment for the fusion group with needs; and the behavior control rule fusion service issued by each participant in the fusion group can be obtained; based on this, Fusion services can be used in a trusted execution environment to respond to fusion computing requests issued within the fusion group within the scope of behavioral control rules. Accordingly, the fusion computing processes of different fusion groups can be isolated from each other based on different fusion services created for different fusion groups, and the fusion services completely run in a trusted execution environment, cannot be tampered with, and work according to behavior control rules by default. This can completely eliminate the problem of unauthorized leakage of participants' data during the fusion calculation process, ensuring the security and/or privacy of the data.
  • Figure 1 is a schematic structural diagram of a data fusion system provided by an exemplary embodiment of the present application
  • Figure 2 is an interactive logic diagram of a data fusion solution provided by an exemplary embodiment of the present application
  • Figure 3 is a schematic flow chart of a data fusion method provided by another exemplary embodiment of the present application.
  • Figure 4 is a schematic flow chart of another data fusion method provided by another exemplary embodiment of the present application.
  • Figure 5 is a schematic structural diagram of a trusted device provided by another exemplary embodiment of the present application.
  • Figure 6 is a schematic structural diagram of a control device provided by another exemplary embodiment of the present application.
  • a dedicated fusion service can be created for the fusion group in a trusted execution environment for the fusion group with needs; and the behavior control rule fusion service issued by each participant in the fusion group can be obtained Based on this, the fusion service can be used to respond to fusion computing requests issued within the fusion group within the scope of the behavior control rules in a trusted execution environment.
  • the fusion computing processes of different fusion groups can be isolated from each other based on different fusion services created for different fusion groups, and the fusion services completely run in a trusted execution environment, cannot be tampered with, and work according to behavior control rules by default. This can completely eliminate the problem of unauthorized leakage of participants' data during the fusion calculation process, ensuring the security and/or privacy of the data.
  • Figure 1 is a schematic structural diagram of a data fusion system provided by an exemplary embodiment of the present application.
  • Figure 2 is an interactive logic diagram of a data fusion solution provided by an embodiment of the present application.
  • the system includes: a control device, a trusted device and at least one fusion group, where a single fusion group contains multiple participants, and the participants are the owners of the data.
  • the data of the participants can be carried in the database.
  • a fully encrypted database can be used to carry the data of the participants.
  • a fully encrypted database can be understood as a database that processes data in ciphertext throughout the entire process of transmission, use and storage, including but not limited to SQL databases or Gaussian databases. More and more participants are placing their data in the cloud.
  • a fully encrypted database can completely prevent the cloud platform and operation and maintenance personnel from accessing plain text data, ensuring that participants have complete ownership of their data on the cloud, and ensuring that the cloud platform
  • users' plaintext data cannot be obtained throughout the process; authorized users can normally read and write data in the cloud database through existing protocols; unauthorized users cannot obtain protected users' plaintext data.
  • the participants in this embodiment can also use other security forms to organize their own data, and cooperate with the data fusion solution provided in this embodiment to ensure the full-link security of their data. This embodiment is not limited to this.
  • the control device can communicate with the trusted device and at least one fusion group respectively.
  • the trusted device can register in the control device in advance, and each participant in the fusion group can interact with the control device after registration.
  • a trusted channel can be established in advance between the control device and the trusted device based on the trusted interface provided by the trusted device as a secure communication channel between the control device and the trusted device.
  • the requirements here may refer to data fusion requirements.
  • a trusted device refers to a device that can be trusted.
  • a trusted device can usually implement a trusted execution environment based on a TPM/TCM chip or a CPU instruction set.
  • a trusted device can be a physical device equipped with a trusted module such as a TPM/TCM chip; it can also be a trusted virtual machine created in the cloud.
  • the trusted virtual machine can be equipped with a virtual TPM/TCM module.
  • a trusted virtual machine The bottom layer of the machine can adopt a hardware architecture with trusted modules such as TPM/TCM chips.
  • computing resources can be divided within the cloud server instance (as the main VM), and an Enclave VM (can be referred to as EVM for short) is created as a trusted device to provide a trusted execution environment.
  • EVM Enclave VM
  • the security guarantee of EVM is reflected in: the underlying virtualization technology provides security isolation, the EVM is isolated from the main VM, and is also isolated from other cloud server instances; the EVM runs an independent, customized and trusted operating system without persistence. Storage, interactive connections or external network access only allow communication with the main VM through local secure channels (based on vsock or device files, etc.) to minimize the attack surface.
  • the number of trusted devices in the data fusion system may be one or more. Based on this, appropriate trusted devices may be selected as needed for different fusion groups to perform the trusted device integration in this embodiment. Device-related processing logic.
  • fusion group For ease of description, the following will take one of at least one fusion group as an example to illustrate the data fusion scheme within this fusion group. Other fusion groups can implement data fusion in the same manner.
  • the control device can trigger the trusted device to create a dedicated convergence service for the convergence group for which there is a demand.
  • a fusion service creation request can be initiated to the control device, and the control device can forward the fusion service creation request to the trusted device through the aforementioned trusted interface to trigger the trusted device to perform the fusion.
  • Group creates a dedicated Fusion Service.
  • the fusion service creation request can carry the identity information of each participant in the fusion group. In this way, the control device can collect the identity information of all participants in the fusion group.
  • the identity information can include but is not limited to the names and public keys of the participants. , certificates, etc.
  • the control device can forward the identity information of all participants in the fusion group to the trusted device.
  • the control device can be used to coordinate and manage the fusion computing process of each fusion group.
  • the control device can also use other methods to trigger the trusted device to create a dedicated server for the fusion group.
  • the integration service does not need to be triggered by the control device, but the trusted device can independently initiate the creation process of the integration service for different integration groups. This embodiment does not limit this.
  • dedicated convergence services can be created for convergence groups where requirements exist.
  • the preset code logic can be run in the trusted device, and the creation operation (for example, create statement) can be configured in the code logic.
  • the code logic can drive the trusted device.
  • the device performs the creation operation of the fusion service to create a dedicated fusion service for the fusion group that requires it.
  • the trusted device can create a dedicated fusion service for the fusion group according to the fusion service creation request.
  • the trusted device can initialize the fusion service based on the identity information of each participant in the fusion group to ensure the specificity of the fusion service.
  • the trusted device can generate identity information for the fusion service and securely provide the identity information of the fusion service to each participant in the fusion group.
  • the identity information of the integration service may include identity ID, public key, etc.
  • the security authentication (remote attestation) mechanism provided by TEE or based on the public key method can be used to establish an end-to-end secure communication channel, and the identity information can be processed through this secure communication channel. Secure transmission will not be described in detail here.
  • the identity information here is the part of the information generated by the trusted device for the fusion service that can be provided to each participant; the information generated by the trusted device for the fusion service is not limited to this, but also the private key of the fusion service. and other information.
  • the trusted device can establish an association between the fusion service and the fusion group based on the identity information of the fusion service and the identity information of each participant in the fusion group. For example, a hash value can be calculated based on the identity information (such as public key) of each participant in the fusion group, and the identity ID in the identity information of the fusion service created for the fusion group is combined with the hash value corresponding to the fusion group.
  • Correlation is performed, so that when there are multiple convergence services in the trusted device, the dedicated convergence services of different convergence groups can be correctly found based on the association between the convergence service and the convergence group, thereby ensuring the dedicated convergence of the convergence service.
  • dedicated means that the convergence service is exclusively used for a certain convergence group and will not be used for other convergence groups. This can effectively isolate the data involved in different fusion groups, thereby avoiding data exchange between previous fusion groups during the fusion calculation process, thereby avoiding data leakage.
  • the trusted device can create dedicated convergence services for different convergence groups.
  • the integration service may be implemented in the form of an application, a process, an instance, etc., which is not limited in this embodiment.
  • Trusted devices can provide a trusted execution environment for converged services, which ensures that converged services are completely black-boxed, the running process cannot be tampered with, and is trustworthy. Therefore, the fusion service can serve as a completely trusted and completely neutral third party to carry out trusted and secure fusion computing work for the fusion group.
  • the control device mainly participated in the control of relevant processes, but did not have the authority to access the internal data of the trusted device. Therefore, the control device was unable to obtain the aforementioned fusion service information. Key information and any intermediate data generated by the fusion service during its work, which ensures that the data of each participant in the fusion group will not be leaked to the control device during the fusion calculation process.
  • the control device does not need to be safe and trustworthy, it only needs to be able to honestly perform relevant operations. Therefore, it can be easily integrated with the management control platform in actual applications (such as enterprise OA systems, public cloud management services, etc. ) combination.
  • conventional honesty monitoring methods such as logs and audits can be used to monitor the honesty of the control device, which is not limited in this embodiment.
  • each participant in the convergence group can also issue behavior control rules and send the behavior control rules to the control device.
  • the control device can provide the behavior control rules issued by each participant in the fusion group to the trusted device.
  • the behavior control rule issued by a single participant is used to record the fusion computing behavior that the participant allows the fusion service to perform on its data.
  • each participant in the integration group can use their own private keys to issue behavior control rules.
  • the public keys of each participant have passed through the control device.
  • the trusted device can use the corresponding public key to verify the signature of each participant on the behavior control rule.
  • Behavior control rules can be used to record the fusion services authorized by participants and the behavioral operations they are allowed to perform. Behavioral operations can include but are not limited to accessing data, performing specified types of calculation logic with designated participants in the current fusion group, etc.
  • calculation logic such as addition calculation, subtraction calculation, multiplication calculation, division calculation, comparison, text calculation, sorting, etc., which will not be exhaustive here.
  • participants can specify the authorized convergence service by recording the identity information of the convergence service (such as the aforementioned identity ID and/or public key) in the behavior control rules, and the identity information can be used to uniquely represent the corresponding convergence service.
  • the behavior control rules issued by different participants in the fusion group may not be exactly the same.
  • each participant in the integration group can complete the issuance of behavior control rules locally without relying on other third parties. This can ensure that the issuance process of behavior control rules is carried out in the controllable environment of the participants. Avoid security issues with the use of private keys of participants.
  • the trusted device can create a dedicated fusion service with a full set of service capabilities for the fusion group, and limit the use of the fusion service based on the behavior control rules issued by each participant in the fusion group.
  • This embodiment is not limited to this.
  • the trusted device can also create a dedicated convergence service with limited service capabilities for the convergence group based on the behavior control rules. Either way, the dedicated fusion service created for the fusion group can provide services strictly within the scope of the behavior control rules corresponding to the fusion group.
  • the trusted device can use the fusion service to verify the behavior control rules issued by each participant in the fusion group; if the verification is successful, the fusion service can be controlled to accept the behavior control rules to transfer the fusion service to the fusion service.
  • Service permissions are limited to the scope of behavior control rules.
  • it is proposed to verify the behavior control rules from the perspective of convergence services. In this way, on the one hand, each participant in the convergence group can limit the interconnected convergence services and the convergence services by issuing behavioral control rules.
  • the fusion service can reversely verify whether the received behavior control rules are valid, and limit the receipt of these behavior control rules only if it is determined that the received behavior control rules are valid.
  • the issuance of malicious behavior control rules can be effectively avoided, ensuring an effective match between the service permissions of the fusion service and the behavior control rules of each participant in the fusion group, and avoiding the occurrence of unauthorized behavior.
  • the verification process of the behavior control rules by the fusion service may include: verifying whether the behavior control rules are issued by the corresponding participants; verifying whether the behavior control rules issued by all participants in the fusion group have been received. Behavior control rules.
  • the fusion service can verify whether the behavior control rules are signed by an impersonator and their integrity.
  • participants can use their own private keys to sign behavior control rules, and as mentioned above, the fusion service has already learned that the behavior control rules in the fusion group
  • the identity information of each participant includes the public key of the participant. Therefore, the fusion service can verify whether the behavior control rule is signed by an impersonator and its integrity based on the public key of the participant.
  • the fusion service can also verify the comprehensiveness of the behavior control rules received.
  • the control device can synchronize the number and identity information of the participants included in the fusion group to the fusion service. In this way, the fusion service can use this as a basis to verify the received behavior.
  • Comprehensiveness of behavioral control rules This can ensure the comprehensiveness of the behavior control rules followed by the fusion service, and prevent the fusion service from overstepping its authority due to the lack of behavior control rules of some participants/participants, and the leakage of data of the participants that cause these missing behavior control rules. question.
  • the trusted device can control the fusion service to sign the behavior control rules; and store the signed behavior control rules. , as the basis for limiting service permissions in subsequent responses to fusion computing requests.
  • the fusion service can use its own private key to sign the verified behavior control rules.
  • the fusion service's signature operation on the behavior control rules can, on the one hand, indicate to the trusted device that the behavior control rules corresponding to the current fusion group have taken effect, so that , the trusted device can subsequently verify these behavior control rules again without controlling the fusion service; on the other hand, it can prompt the fusion service itself that it has completed the verification of these behavior control rules, and can directly follow these behavior control rules in the future.
  • the trusted device determines that the fusion group contains behavior control rules that fail verification, it can refuse to accept the behavior control rules related to the fusion group.
  • the trusted device can send an exception notification back to each participant in the fusion group to remind each participant that a data security incident has occurred, thereby ensuring the data security of each participant.
  • the fusion service accepts the behavior control rules issued by each participant in the fusion group, which means that the fusion service will provide services strictly in accordance with the scope defined by these behavior control rules. Since the fusion service runs in a trusted execution environment, you only need to preset this execution logic in the code logic of the fusion service to ensure that the fusion service can actually provide services within the scope defined by these behavior control rules.
  • the fusion service can be used in a trusted execution environment to respond to fusion computing requests issued within the fusion group within the scope of behavior control rules.
  • the convergence service can provide exclusive services for the convergence group.
  • a fusion computing request can be issued within the fusion group.
  • the fusion computing request can come from some or all participants in the fusion group.
  • the fusion computing request can include the required fusion computing behavior, and the fusion computing behavior can specify at least one of the involved parties.
  • the fusion group can issue a fusion computing request to the control device, and the control device can forward the fusion computing request to the trusted device.
  • a trusted device After receiving a fusion computing request sent from a fusion group, it can determine the fusion service dedicated to the fusion group and determine whether the fusion computing behavior indicated in the fusion computing request is within the behavior control rules corresponding to the fusion group. Within the scope, if yes, use the fusion service dedicated to the fusion group to respond to the fusion computing request.
  • an exemplary solution for determining whether the fusion computing behavior indicated in the fusion computing request is within the scope of the behavior control rules corresponding to the fusion group may be: parsing at least one of the fusion computing behaviors involved in the fusion computing behavior indicated in the fusion computing request.
  • Target participant if the fusion computing behavior complies with the behavior control rules issued by all target participants, it is determined that the fusion computing behavior is within the scope of the behavior control rules. That is, if the behavior control rules of all target participants allow the fusion service to perform the fusion computing behavior indicated in the fusion computing request, it is determined that the fusion computing behavior is within the scope of the behavior control rules.
  • the trusted device can First, parse out the two target participants involved in the fusion calculation request, namely A and B, then query whether the behavior control rules issued by participant A allow the fusion service to perform addition calculations, and query the behavior control rules issued by participant B. Whether the fusion service is allowed to perform addition calculations in the rule.
  • the fusion service can access the data of participants A and B and Perform an addition calculation on both sides of the data.
  • the fusion service After responding to the fusion calculation request, the fusion service can generate fusion calculation results. For a fusion group, participants in it can initiate fusion calculation requests multiple times, and the fusion service can store the fusion calculation results generated by multiple fusion calculation requests. For example, it can build the fusion calculation corresponding to the fusion group. Result collection, so that for repeated fusion calculation requests, there is no need to repeat the fusion calculation operation. Fusion calculation results can only be accessed by the fusion service itself, or encrypted and forwarded to the querying user after authorization.
  • a dedicated fusion service can be created for the fusion group in a trusted execution environment for the fusion group with needs; and the behavior control rules issued by each participant in the fusion group can be obtained; based on this,
  • the fusion service is used to respond to fusion computing requests issued within the fusion group within the scope of behavior control rules.
  • the fusion computing processes of different fusion groups can be isolated from each other based on different fusion services created for different fusion groups, and the fusion services completely run in a trusted execution environment, cannot be tampered with, and work according to behavior control rules by default. This can completely eliminate the problem of unauthorized leakage of participants' data during the fusion calculation process, ensuring the security and/or privacy of the data.
  • the fusion service can also be used to provide query services for fusion calculation results.
  • the query permission range can be configured in advance.
  • the control device may send an authorization request to each participant in the fusion group for the querying user.
  • Each participant in the fusion group can locally issue a query permission range for the query user and send it to the control device.
  • the scope of query permissions can be used to record the query users authorized by the participants and the limited information on their query permissions. These limited information can include but are not limited to the specifications of the query results, the identification of the fusion calculation results that are allowed to be queried, the encryption key and /or the number of queries, etc.
  • the control device can receive the query permission range issued by each participant in the fusion group for the query user; and provide the query permission range to the trusted device.
  • the trusted device can limit the query service provided by the fusion service to the query user within the scope of query authority. In this way, the trusted device can limit the query services provided by the fusion group's dedicated fusion services to different query users within the corresponding query permission range. This ensures that the fusion group's dedicated fusion services strictly follow the queries specified by each participant in the fusion group. Inquiry services provided to the outside world within the scope of authority to avoid unauthorized inquiries.
  • the trusted device may configure the query permission range using the same solution as the aforementioned configuration method for behavior control rules.
  • the trusted device can use the fusion service to verify the query permission range issued by each participant in the fusion group for the query user; if the verification is successful, it controls the fusion service to accept the query permission range to use the fusion service to the query user.
  • the query service provided by the query user is limited to the scope of query authority.
  • the verification process of the query permission scope may include: verifying whether the query permission scope is issued by the corresponding participant; verifying whether the query permission scope issued by all participants in the fusion group for the query user has been received.
  • the fusion service can also sign the query permission range and store it permanently when the query permission range passes verification.
  • the control device can receive query requests initiated by query users for the fusion calculation results of the fusion group; and can forward the query requests to the trusted device.
  • the dedicated fusion service of the fusion group can be controlled to process the query request.
  • the trusted device can use the dedicated fusion service of the fusion group to determine whether the current query request complies with the query permission range pre-issued by each participant in the fusion group for the current query user. If it matches, the query request can be extracted from the fusion calculation result.
  • the results are encrypted and output to the querying user.
  • the query permission scope can also specify the encryption key used for the query user.
  • the fusion service can encrypt the query results according to the encryption key specified in the query permission scope, and provide the encrypted query results to the query user.
  • the encryption key specified in the query permission scope can be any one of multiple DEKs owned by the query user (Data Encryption Key is the key used by the user to encrypt data).
  • each participant in the fusion group can issue query permission ranges for different query users, thereby limiting the query service of the dedicated fusion service to the query permission range.
  • the integration computing can be implemented. Security protection of results to avoid unauthorized disclosure of fusion calculation results.
  • FIG 3 is a schematic flowchart of a data fusion method provided by another exemplary embodiment of the present application.
  • the method can be executed by a data processing device, which can be implemented as a combination of software and/or hardware, and the data processing device can be integrated in the trusted device in the foregoing system embodiment.
  • the method includes:
  • Step 300 Create a dedicated fusion service for the fusion group in the trusted execution environment for the fusion group with needs;
  • Step 301 Obtain the behavior control rules issued by each participant in the fusion group
  • Step 302 In the trusted execution environment, use the fusion service to respond to the fusion computing request issued within the fusion group within the scope of the behavior control rules.
  • it also includes:
  • the fusion service is controlled to accept the behavior control rules to limit the service permissions of the fusion service to the scope of the behavior control rules.
  • the verification process of behavior control rules includes:
  • the step of controlling the fusion service to accept behavior control rules includes:
  • the step of using the fusion service to respond to the fusion computing request issued within the fusion group within the scope of the behavior control rules includes:
  • the method further includes:
  • Parse at least one target participant involved in the fusion computing behavior indicated in the fusion computing request
  • the fusion computing behavior complies with the behavior control rules signed by all target participants, it is determined that the fusion computing behavior is within the scope of the behavior control rules.
  • the method further includes:
  • the query results extracted from the fusion calculation results will be encrypted and output to the query user.
  • the query permission scope includes the specifications of the query results, the identification of the fusion calculation results that are allowed to be queried, and/or the number of queries.
  • FIG 4 is a schematic flowchart of another data fusion method provided by another exemplary embodiment of the present application.
  • the method may be executed by a data processing device, which may be implemented as a combination of software and/or hardware, and which may be integrated in the control device in the foregoing system embodiment.
  • the method includes:
  • Step 400 For the fusion group with needs, trigger the trusted device to create a dedicated fusion service for the fusion group, and the trusted device provides a trusted execution environment for the fusion service;
  • Step 401 Provide the behavior control rules issued by each participant in the fusion group to the trusted device to limit the service permissions of the fusion service within the scope of the behavior control rules;
  • Step 402 Forward the fusion computing request issued within the fusion group to the fusion service, so as to use the fusion service to respond to the fusion computing request in a trusted execution environment.
  • the method further includes:
  • the query permission range is provided to the trusted device, so that the trusted device can limit the query service provided by the fusion service to the query user within the query permission range.
  • the method further includes:
  • the trusted device forward the query request to the trusted device, so that the trusted device can use the fusion service to determine whether the query request meets the query permission scope, and if it meets the query request, encrypt the query result extracted from the fusion calculation result and output it to the query user.
  • each step of the method provided in the above embodiments may be the same device, or the method may also be executed by different devices.
  • Some of the processes described in the above embodiments and drawings include multiple operations that appear in a specific order, but it should be clearly understood that these operations may not be performed in the order in which they appear in this article or may be performed in parallel.
  • the operations The serial numbers such as 300, 301, etc. are only used to distinguish different operations. The serial numbers themselves do not represent any execution order.
  • FIG. 5 is a schematic structural diagram of a trusted device provided by another exemplary embodiment of the present application.
  • the computing device includes: a memory 50 , a processor 51 and a communication component 52 .
  • Processor 51 coupled to memory 50 and communication component 52, for executing the computer program in memory 50 for:
  • the fusion service is used to respond to fusion computing requests issued within the fusion group within the scope of behavior control rules.
  • the processor 51 can receive a fusion service creation request issued by the fusion group forwarded by the control device through the communication component 52 to initiate the operation of creating a dedicated fusion service for the fusion group in the trusted execution environment. .
  • processor 51 can also be used to:
  • the fusion service is controlled to accept the behavior control rules to limit the service permissions of the fusion service to the scope of the behavior control rules.
  • the processor 51 may be used to:
  • the processor 51 in the process of controlling the integration service to accept behavior control rules, the processor 51 may be used to:
  • the processor 51 may be used to:
  • processor 51 can also be used to:
  • Parse at least one target participant involved in the fusion computing behavior indicated in the fusion computing request
  • the fusion computing behavior complies with the behavior control rules signed by all target participants, it is determined that the fusion computing behavior is within the scope of the behavior control rules.
  • processor 51 can also be used to:
  • the query results extracted from the fusion calculation results will be encrypted and output to the query user.
  • the query permission scope includes the specifications of the query results, the identification of the fusion calculation results that are allowed to be queried, and/or the number of queries.
  • the trusted device also includes: a power supply component 53 and other components. Only some components are schematically shown in Figure 5, which does not mean that the trusted device only includes the components shown in Figure 5.
  • Figure 6 is a schematic structural diagram of a control device provided by another exemplary embodiment of the present application.
  • the computing device includes: a memory 60 , a processor 61 and a communication component 62 .
  • Processor 61 coupled to memory 60 and communication component 62, for executing the computer program in memory 60 for:
  • the trusted device is triggered to create a dedicated fusion service for the fusion group, and the trusted device provides a trusted execution environment for the fusion service;
  • the processor 61 can forward the fusion service creation request issued within the fusion group to the trusted device through the communication component 62, so as to trigger the trusted device to create a dedicated fusion service for the fusion group.
  • the processor 61 is also used to:
  • the query permission range is provided to the trusted device, so that the trusted device can limit the query service provided by the fusion service to the query user within the query permission range.
  • the processor 61 is also used to:
  • the trusted device forward the query request to the trusted device, so that the trusted device can use the fusion service to determine whether the query request meets the query permission scope, and if it meets the query request, encrypt the query result extracted from the fusion calculation result and output it to the query user.
  • control device also includes: a power supply component 63 and other components. Only some components are schematically shown in FIG. 6 , which does not mean that the control device only includes the components shown in FIG. 6 .
  • embodiments of the present application also provide a computer-readable storage medium storing a computer program.
  • the computer program When executed, it can implement each step that can be executed by the trusted device/control device in the above method embodiment.
  • the memory in Figures 5 and 6 above is used to store computer programs and can be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phonebook data, messages, pictures, videos, etc.
  • Memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable memory Read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disk.
  • SRAM static random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM erasable programmable memory Read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory flash memory
  • flash memory magnetic or optical disk.
  • the communication components in Figures 5 and 6 mentioned above are configured to facilitate wired or wireless communication between the device where the communication component is located and other devices.
  • the device where the communication component is located can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof.
  • the communication component receives broadcast signals or broadcast related information from an external broadcast management system via a broadcast channel.
  • the communication component further includes a near field communication (NFC) module to facilitate short-range communication.
  • the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.
  • RFID radio frequency identification
  • IrDA infrared data association
  • UWB ultra-wideband
  • Bluetooth Bluetooth
  • a power component in Figures 5 and 6 above provides power to various components of the device where the power supply component is located.
  • a power component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power component resides.
  • embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
  • computer-usable storage media including, but not limited to, disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions
  • the device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
  • These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device.
  • Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.
  • a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • Memory may include non-permanent storage in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
  • RAM random access memory
  • ROM read-only memory
  • flash RAM flash random access memory
  • Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information.
  • Information may be computer-readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory.
  • PRAM phase change memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • RAM random access memory
  • read-only memory read-only memory
  • ROM read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • flash memory or other memory technology
  • compact disc read-only memory CD-ROM
  • DVD digital versatile disc
  • Magnetic tape cartridges magnetic tape storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device.
  • computer-readable media does not include transient computer-readable media (transitory media), such as modulated data signals and carrier waves.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)

Abstract

本申请实施例提供一种数据融合方法、设备、系统及存储介质。可针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务（300）；并可获取融合组内各个参与方签发的行为控制规则融合服务；基于此，可在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求（302）。据此，可基于为不同融合组创建的不同融合服务而将不同融合组的融合计算过程相互隔离开，且融合服务完全运行在可信执行环境中，不可篡改且默认遵照行为控制规则进行工作，这可完全杜绝参与方的数据在融合计算过程中的越权泄露问题，保证了数据的安全性和/或隐私性。

Description

一种数据融合方法、设备、系统及存储介质
本申请要求于2022年08月01日提交中国专利局、申请号为202210915575.0、申请名称为“一种数据融合方法、设备、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理技术领域，尤其涉及一种数据融合方法、设备、系统及存储介质。
背景技术
数据融合技术可对多个参与方的数据进行物理上或者逻辑上的融合，并可在数据融合后进行数据计算分析，以更好地挖掘数据价值。
由于在数据融合过程中，需要对多方数据进行计算分析，因此，若缺少有效的安全保护措施，则可能导致参与方的数据泄露问题，给参与方带来损失。
发明内容
本申请的多个方面提供一种数据融合方法、设备、系统及存储介质，用以解决数据融合过程中的数据泄露问题。
本申请实施例提供一种数据融合方法，包括：
针对存在需求的融合组，在可信执行环境中为所述融合组创建专用的融合服务；
获取所述融合组内各个参与方签发的行为控制规则；
在所述可信执行环境中，利用所述融合服务在所述行为控制规则的范围内响应所述融合组内发出的融合计算请求。
本申请实施例还提供一种数据融合方法，包括：
针对存在需求的融合组，触发可信设备为所述融合组创建专用的融合服务，所述可信设备为所述融合服务提供可信执行环境；
将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备，以将所述融合服务的服务权限限定在所述行为控制规则的范围之内；
将所述融合组内发出的融合计算请求转发至所述融合服务，以利用所述融合服务在所述可信执行环境中响应所述融合计算请求。
本申请实施例还提供一种数据融合系统，包括：控制平台、可信设备和至少一个融合组；
所述控制平台，用于针对存在融合需求的目标融合组，向所述可信设备发送服务 创建请求；将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备；
所述可信设备，用于根据所述服务创建请求为所述目标融合组创建专用的融合服务；
所述融合服务，用于在所述可信设备提供的可信执行环境中，在所述行为控制规则的范围内响应所述目标融合组内发出的融合计算请求。
本申请实施例还提供一种可信设备，包括存储器、处理器和通信组件；
所述存储器用于存储一条或多条计算机指令；
所述处理器与所述存储器和所述通信组件耦合，用于执行所述一条或多条计算机指令，以用于：
针对存在需求的融合组，在可信执行环境中为所述融合组创建专用的融合服务；
获取所述融合组内各个参与方签发的行为控制规则；
在所述可信执行环境中，利用所述融合服务在所述行为控制规则的范围内响应所述融合组内发出的融合计算请求。
本申请实施例还提供一种控制设备，包括存储器、处理器和通信组件；
所述存储器用于存储一条或多条计算机指令；
所述处理器与所述存储器和所述通信组件耦合，用于执行所述一条或多条计算机指令，以用于：
针对存在需求的融合组，触发可信设备为所述融合组创建专用的融合服务，所述可信设备为所述融合服务提供可信执行环境；
将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备，以将所述融合服务的服务权限限定在所述行为控制规则的范围之内；
将所述融合组内发出的融合计算请求转发至所述融合服务，以利用所述融合服务在所述可信执行环境中响应所述融合计算请求。
本申请实施例还提供一种存储计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行前述的数据融合方法。
在本申请实施例中，可针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务；并可获取融合组内各个参与方签发的行为控制规则融合服务；基于此，可在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。据此，可基于为不同融合组创建的不同融合服务而将不同融合组的融合计算过程相互隔离开，且融合服务完全运行在可信执行环境中，不可篡改且默认遵照行为控制规则进行工作，这可完全杜绝参与方的数据在融合计算过程中的越权泄露问题，保证了数据的安全性和/或隐私性。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的 示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请一示例性实施例提供的数据融合系统的结构示意图；
图2为本申请一示例性实施例提供的数据融合方案的交互逻辑示意图；
图3为本申请另一示例性实施例提供的一种数据融合方法的流程示意图；
图4为本申请另一示例性实施例提供的另一种数据融合方法的流程示意图；
图5为本申请又一示例性实施例提供的一种可信设备的结构示意图；
图6为本申请又一示例性实施例提供的一种控制设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
目前，在数据融合过程中，经常发生参与方的数据泄露问题，给参与方带来损失。为此，本申请的一些实施例中：可针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务；并可获取融合组内各个参与方签发的行为控制规则融合服务；基于此，可在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。据此，可基于为不同融合组创建的不同融合服务而将不同融合组的融合计算过程相互隔离开，且融合服务完全运行在可信执行环境中，不可篡改且默认遵照行为控制规则进行工作，这可完全杜绝参与方的数据在融合计算过程中的越权泄露问题，保证了数据的安全性和/或隐私性。
以下结合附图，详细说明本申请各实施例提供的技术方案。
图1为本申请一示例性实施例提供的数据融合系统的结构示意图。图2为本申请一实施例提供的数据融合方案的交互逻辑示意图。如图1所示，该系统包括：控制设备、可信设备和至少一个融合组，其中，单个融合组中包含多个参与方，参与方即为数据的拥有者。
参与方的数据可承载在数据库中，优选地，本实施例中，可采用全加密数据库来承载参与方的数据。全加密数据库可理解为在传输、使用和存储全程以密文形式处理数据的数据库，包括但不限于SQL数据库或高斯(Gauss)数据库等。越来越多的参与方将其数据放置到云端，全加密数据库则可完全杜绝云平台以及运维人员接触到明文数据的可能，保证参与方对其云上数据的完全所有权，确保云平台在提供数据库服务的过程中，全程无法获得用户的明文数据；授权用户可以通过现有协议正常读写云端数据库内的数据；未授权用户无法获得被保护用户的明文数据。当然，本实施例中的参与方还可采用其它安全形式来组织自己的数据，并配合本实施例提供的数据融合方案来保证其数据的全链路安全性，本实施例并不限于此。
参考图1和图2，本实施例中，控制设备可分别与可信设备和至少一个融合组进行通 信。对于存在需求的融合组，融合组内的参与方可预先在控制设备中进行注册，融合组内的各个参与方可在注册后与控制设备进行交互。控制设备与可信设备之间可基于可信设备提供的可信接口预先建立可信通道，作为控制设备与可信设备之间的安全通信通道。这里的需求可以是指数据融合需求。
本实施例中，可信设备是指可以信任的设备，可信设备通常可基于TPM/TCM芯片或CPU指令集等来实现可信执行环境，当然，这仅是示例性的，本实施例并不限于此，还可采用现在或将来存在的其它类型的技术来实现可信执行环境。可信设备可以是搭载有TPM/TCM芯片等可信模块的物理设备；也可以是云端创建的可信虚拟机，可信虚拟机可搭载有虚拟的TPM/TCM模块，相应的，可信虚拟机的底层可采用带有TPM/TCM芯片等可信模块的硬件架构。举例来说，可在云服务器实例(作为主VM)内切分计算资源(包括VCPU和内存)，创建一个Enclave VM(可简称为EVM)作为可信设备来提供可信执行环境。EVM的安全性保障体现在：由底层虚拟化技术提供安全隔离，EVM和主VM之间隔离，并且和其他云服务器实例也隔离；EVM运行独立的、定制化的可信操作系统，没有持久化存储、交互式连接或外部网络通路，仅允许通过本地安全信道(基于vsock或设备文件等)与主VM进行通信，最大程度缩小攻击面。
另外，本实施例中，数据融合系统中的可信设备的数量可以是一个或多个，基于此，针对不同的融合组可按需选用合适的可信设备来执行本实施例中与可信设备相关的处理逻辑。
为便于描述，以下将以至少一个融合组中的其中一个融合组为例，来说明在该融合组内进行数据融合的方案，其它融合组可采用同样的方式实现数据融合。
参考图1和图2，控制设备可针对存在需求的融合组，触发可信设备为融合组创建专用的融合服务。在此过程中，对于该融合组来说，可向控制设备发起融合服务创建请求，控制设备可通过前述的可信接口将融合服务创建请求转发至可信设备，以触发可信设备为该融合组创建专用的融合服务。其中，融合服务创建请求中可携带融合组内各参与方的身份信息，这样，控制设备可收集到融合组内所有参与方的身份信息，身份信息可包括但不限于参与方的名称、公钥、证书等。控制设备可将融合组内所有参与方的身份信息转发给可信设备。当然，本实施例中，控制设备可用于统筹管理各个融合组的融合计算流程，控制设备除了可采用融合服务创建请求的方式之外，还可采用其它方式来触发可信设备为融合组创建专用的融合服务，甚至在一些可能的设计中，可无需由控制设备触发，而由可信设备自主为不同融合组启动融合服务的创建流程，本实施例对此不做限定。
对可信设备来说，可为存在需求的融合组创建专用的融合服务。本实施例中，可在可信设备中运行预置的代码逻辑，并可在代码逻辑中配置创建操作(例如，create语句)，这样，在满足触发条件的情况下，代码逻辑可驱动可信设备执行融合服务的创建操作，从而为存在需求的融合组创建专用的融合服务。承接上述由控制设备转发的融合服务创建请求的触发方式，可信设备可根据融合服务创建请求，来为融合组创建专用的融合服务。
在创建过程中，可信设备可基于融合组内各参与方的身份信息来进行融合服务的初始化，以保证融合服务的专用性。可选地，可信设备可为融合服务生成身份信息，并将融合服务的身份信息安全地提供给融合组内的各个参与方。其中，融合服务的身份信息中可包含身份ID和公钥等。融合服务向各个参与方提供身份信息的过程中，可采用TEE提供的安全认证(remote attestation)机制或者基于公钥方式等，建立端到端的安全通信通道，并通过该安全通信通道对身份信息进行安全传输，在此不再详述。应当理解的是，这里的身份信息是可信设备为融合服务生成的信息中可以提供给各个参与方的那一部分；可信设备为融合服务生成的信息并不止这些，还有融合服务的私钥等信息。在此基础上，可信设备可基于融合服务的身份信息和融合组内各个参与方的身份信息，建立融合服务与融合组之间的关联关系。举例来说，可根据融合组内各参与方的身份信息(例如公钥)计算哈希值，将为该融合组创建的融合服务的身份信息中的身份ID与该融合组对应的哈希值进行关联，这样，在可信设备中存在多个融合服务的情况下，可基于融合服务与融合组之间的关联关系而正确地找到不同融合组各自专用的融合服务，从而保证融合服务的专用性。其中，专用即是指融合服务专用于某融合组而不会用于其它融合组。这可有效隔离不同融合组所涉及到的数据，从而避免在融合计算过程中发生融合组之前的数据互访，进而避免数据泄露。
据此，可信设备可为不同融合组分别创建专用的融合服务。本实施例中，融合服务的实现形式可以是应用程序、进程、实例等，本实施例对此不做限定。可信设备可为融合服务提供可信执行环境，这保证了融合服务完全黑盒化，运行过程不可篡改，具备可信性。因此，融合服务可作为完全可信、完全中立的第三方，为融合组开展可信的、安全的融合计算工作。
值得说明的是，在上述创建融合服务的过程中，控制设备主要参与了相关流程的控制，但并不具备访问可信设备内部数据的权限，因此，控制设备并无法获取到前述的融合服务的密钥信息以及融合服务在工作过程中产生的任何中间数据，这保证了融合组内各个参与方的数据在融合计算过程中不会泄露至控制设备。本实施例中，控制设备不需要是安全可信的，只需要能够诚实的执行相关操作即可，因此，可以方便的与实际应用中的管理控制平台(如企业OA系统、公有云管理服务等)结合。可选地，可采用日志、审计等常规的诚实性监测方式来监测控制设备的诚实性，本实施例对此不作限定。
在保证融合服务本身可信性的基础上，参考图1，本实施例中，融合组内的各个参与方还可签发行为控制规则，并将行为控制规则发送至控制设备。而控制设备可将融合组内各个参与方签发的行为控制规则提供给可信设备。本实施例中，单个参与方签发的行为控制规则用于记录该参与方允许融合服务对其数据所执行的融合计算行为。其中，为保证行为控制规则在传输过程中的安全性，融合组内各个参与方可使用自身的私钥来签发行为控制规则，而正如前文提及的，各个参与方的公钥已经通过控制设备转发给可信设备，因此，可信设备可使用对应的公钥来验证各个参与方对行为控制规则的签名。
基于此，对于可信设备来说，可获取融合组内各个参与方签发的行为控制规则。其中， 行为控制规则可用于记录参与方所授权的融合服务以及允许其执行的行为操作，行为操作可包括但不限于访问数据、与当前融合组内的指定参与方之间进行指定类型的计算逻辑等。这里，计算逻辑的类型是多样的，例如，加法计算、减法计算、乘法计算、除法计算、比较大小、文本计算、排序等等，在此不再穷举。其中，参与方可通过在行为控制规则中记录融合服务的身份信息(例如前述的身份ID和/或公钥)来指定所授权的融合服务，身份信息可用于唯一表示对应的融合服务。本实施例中，融合组内不同的参与方签发的行为控制规则可不完全相同。本实施例中，融合组内的各个参与方可在其本地完成行为控制规则的签发，而不依赖于其它第三方，这可保证行为控制规则的签发过程在参与方的可控环境中进行，避免发生参与方的私钥使用安全问题。
本实施例中，在前述的融合服务创建过程中，可信设备可为融合组创建具有全集服务能力的专用融合服务，而基于融合组内各个参与方签发的行为控制规则来限制融合服务可使用的服务权限，当然，本实施例中并不限于此，可信设备也可基于行为控制规则而为融合组创建具有有限服务能力的专用融合服务。无论那种方式，为融合组创建的专用的融合服务均可严格按照融合组对应的行为控制规则的范围提供服务。
在一种优选的实现方式中，可信设备可利用融合服务对融合组内各个参与方签发的行为控制规则进行验证；若验证成功，则可控制融合服务接受行为控制规则，以将融合服务的服务权限限定至行为控制规则的范围内。在该优选的实现方式中，提出从融合服务的维度进行行为控制规则的验证，这样，一方面，融合组内的各参与方可通过签发行为控制规则来限定可对接的融合服务以及该融合服务的服务权限，另一方面，融合服务可反向验证接收到的行为控制规则是否有效，并限定仅在确定接收到的行为控制规则有效的情况下，才接收这些行为控制规则。通过这种双向的限定的实现方式，可有效避免恶意的行为控制规则的签发，保证融合服务的服务权限与融合组内各个参与方的行为控制规则之间切实地匹配，避免发生越权行为。
其中，在该优选的实现方式中，融合服务对对行为控制规则的验证过程，可包括：验证行为控制规则是否为对应的参与方签发的；验证是否已收到融合组内所有参与方签发的行为控制规则。这样，融合服务可验证行为控制规则是否为冒名签发的及完整性实际应用中，参与方可使用自身的私钥来签发行为控制规则，而正如前文提及的，融合服务已经获知了融合组内各参与方的身份信息，其中，包括了参与方的公钥，因此，融合服务可基于参与方的公钥来验证行为控制规则是否为冒名签发的及完整性。这可保证融合计算所遵照的行为控制规则切实符合参与方的真实期望。融合服务还可验证所收到行为控制规则的全面性，控制设备可将融合组内包含的参与方的数量、身份信息等同步至融合服务，这样，融合服务可以此作为依据来验证所收到行为控制规则的全面性。这可保证融合服务所遵照的行为控制规则的全面性，避免因某个/些参与方的行为控制规则缺失而导致融合服务发生越权行为，进行造成这些缺失行为控制规则的参与方的数据的泄露问题。
进一步，在该优选的实现方式中，若确定融合组内各个参与方签发的行为控制规则通过验证，则可信设备可控制融合服务对行为控制规则进行签名；并存储经过签名后的行为控制规则，作为后续响应融合计算请求过程中的服务权限限定依据。融合服务可使用自身的私钥对通过验证的行为控制规则进行签名，这里，融合服务对行为控制规则的签名操作，一方面可向可信设备示意当前融合组对应的行为控制规则已经生效，这样，可信设备后续可无需再控制融合服务再次对这些行为控制规则进行验证；另一方面可提示融合服务本身，其已经完成对这些行为控制规则的验证，后续可直接遵照这些行为控制规则。相反，若可信设备确定融合组存在未通过验证的行为控制规则，则可拒绝接受该融合组相关的行为控制规则。可选地，可信设备可向融合组内各个参与发返回异常通知，以提示各个参与方发生了数据安全事件，从而保证各个参与方的数据安全。
在本实施例中，融合服务接受融合组内各个参与方签发的行为控制规则，则意味着融合服务将严格按照这些行为控制规则所限定的范围来提供服务。由于融合服务运行在可信执行环境中，因此，只需在融合服务的代码逻辑中预置这种执行逻辑，即可保证融合服务能够切实按照这些行为控制规则所限定的范围来提供服务。
在此基础上，参考图1，对可信设备来说，可在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。
在完成上述的融合服务的创建以及服务权限配置后，融合服务可为融合组提供专属服务。融合组内可发出融合计算请求，融合计算请求可来自与融合组内的部分或全部参与方，融合计算请求中可包含所需的融合计算行为，融合计算行为中可指定所涉及到的至少一个目标参与方以及所需的计算逻辑的类型。融合组可向控制设备发出融合计算请求，控制设备则可将融合计算请求转发至可信设备。对可信设备来说，在接收融合组内发出的融合计算请求后，可确定该融合组专用的融合服务，并判断融合计算请求中指示的融合计算行为是否位于该融合组对应的行为控制规则的范围内，如果是，则利用该融合组专用的融合服务响应该融合计算请求。
其中，一种判断融合计算请求中指示的融合计算行为是否位于该融合组对应的行为控制规则的范围内的示例性方案可以是：解析融合计算请求中指示的融合计算行为所涉及到的至少一个目标参与方；若融合计算行为符合全部目标参与方签发的行为控制规则，则确定融合计算行为位于行为控制规则的范围内。也即是，若全部目标参与方的行为控制规则中均允许融合服务执行融合计算请求中指示的融合计算行为，则确定融合计算行为位于行为控制规则的范围内。举例来说，若融合组内包含3个参与方A、B和C，参与方A发起了融合计算请求，并期望与参与方B进行加法计算(即为融合计算行为)，则可信设备可首先解析出融合计算请求所涉及到的两个目标参与方，也即是A和B，然后查询参与方A签发的行为控制规则中是否允许融合服务进行加法计算，查询参与方B签发的行为控制规则中是否允许融合服务进行加法计算，如果对 参与方A和参与方B的行为控制规则的查询结果均为是，则可确定融合计算请求至指示的融合计算行为位于行为控制规则的范围内，融合服务可访问参与方A和B的数据并对双方数据执行加法计算。
融合服务在响应融合计算请求后，可产生融合计算结果。对于一个融合组来说，其内的参与方可多次发起融合计算请求，融合服务可将多次融合计算请求所产生的融合计算结果进行存储，例如，可构建起该融合组对应的融合计算结果集合，这样，对于重复的融合计算请求，将无需再重复执行融合计算操作。融合计算结果仅可被融合服务自身访问，或者在授权后加密转发给查询用户。
据此，本实施例中，可针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务；并可获取融合组内各个参与方签发的行为控制规则；基于此，可在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。据此，可基于为不同融合组创建的不同融合服务而将不同融合组的融合计算过程相互隔离开，且融合服务完全运行在可信执行环境中，不可篡改且默认遵照行为控制规则进行工作，这可完全杜绝参与方的数据在融合计算过程中的越权泄露问题，保证了数据的安全性和/或隐私性。
在上述或下述实施例中，融合服务还可用于提供融合计算结果的查询服务。
参考图2，本实施例中，针对需要对融合组的融合计算结果进行查询的查询用户，可预先为其配置查询权限范围。为此，本实施例中，控制设备可为查询用户向融合组内各个参与方发送授权请求。融合组内各个参与方可在本地分别针对该查询用户签发查询权限范围，并发送至控制设备。其中，查询权限范围可用于记录参与方所授权的查询用户以及对其查询权限的限定信息，这些限定信息可包括但不限于查询结果的规格、允许查询的融合计算结果的标识、加密密钥和/或查询次数等。控制设备则可接收融合组内各个参与方针对查询用户签发的查询权限范围；并将查询权限范围提供给可信设备。而可信设备则可将融合服务对该查询用户提供的查询服务限定在查询权限范围内。这样，可信设备可将融合组专用的融合服务对不同查询用户提供的查询服务限定在相应的查询权限范围内，这保证了融合组专用的融合服务严格按照融合组内各个参与方指定的查询权限范围对外提供的查询服务，避免越权查询。
本实施例中，可信设备可采用与前述对行为控制规则的配置方式相同的方案来进行查询权限范围的配置。在此仅简述：可信设备可利用融合服务对融合组内各个参与方为查询用户签发的查询权限范围进行验证；若验证成功，则控制融合服务接受查询权限范围，以将融合服务对该查询用户提供的查询服务限定在查询权限范围内。其中，对查询权限范围的验证过程可包括：验证查询权限范围的是否在对应的参与方签发的；验证是否已收到融合组内所有参与方针对查询用户签发的查询权限范围。具体细节可参考前文中对行为控制规则的配置过程，在此不再详述。同样，融合服务也可在查询权限范围通过验证的情况下，对查询权限范围进行签名，并长久化存储。
在此基础上，控制设备可接收查询用户针对融合组的融合计算结果发起的查询请求；并可将查询请求转发至可信设备。对可信设备来说，则可控制该融合组专用的融合服务来处理该查询请求。可信设备可利用该融合组专用的融合服务判断当前查询请求是否符合该融合组内各个参与方预先为当前查询用户签发的查询权限范围，若符合，则可将从融合计算结果中提取的查询结果加密输出给查询用户。可选地，查询权限范围中还可为查询用户指定所使用的加密密钥，融合服务可按照查询权限范围中指定的加密密钥对查询结果进行加密，并将加密后的查询结果提供给查询用户。例如，查询权限范围中指定的加密密钥可以是查询用户所拥有的多个DEK(Data Encryption Key为用户用于加密数据所使用的密钥)中任意一个。
据此，本实施例中，融合组内的各个参与方可针对不同的查询用户分别签发查询权限范围，从而将专用的融合服务的查询服务限定在查询权限范围内，这样，可实现对融合计算结果的安全保护，避免融合计算结果的越权透出。
图3为本申请另一示例性实施例提供的一种数据融合方法的流程示意图。该方法可由数据处理装置执行，该数据处理装置可实现为软件和/或硬件的结合，该数据处理装置可集成在前述系统实施例中的可信设备中。参考图3，该方法包括：
步骤300、针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务；
步骤301、获取融合组内各个参与方签发的行为控制规则；
步骤302、在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。
在一可选实施例中，还包括：
利用融合服务对融合组内各个参与方签发的行为控制规则进行验证；
若验证成功，则控制融合服务接受行为控制规则，以将融合服务的服务权限限定至行为控制规则的范围内。
在一可选实施例中，对行为控制规则的验证过程包括：
验证行为控制规则的是否在对应的参与方签发的；
验证是否已收到融合组内所有参与方签发的行为控制规则。
在一可选实施例中，步骤控制融合服务接受行为控制规则，包括：
控制融合服务对行为控制规则进行签名；
存储经过签名后的行为控制规则，作为后续响应融合计算请求过程中的服务权限限定依据。
在一可选实施例中，步骤利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求，包括：
接收融合组内发出的融合计算请求；
若确定融合计算请求中指示的融合计算行为位于行为控制规则的范围内，则响应 融合计算请求。
在一可选实施例中，该方法还包括：
解析融合计算请求中指示的融合计算行为所涉及到的至少一个目标参与方；
若融合计算行为符合全部目标参与方签发的行为控制规则，则确定融合计算行为位于行为控制规则的范围内。
在一可选实施例中，该方法还包括：
接收查询用户针对融合组的融合计算结果发起的查询请求；
若查询请求符合融合组内各个参与方预先为查询用户签发的查询权限范围，则将从融合计算结果中提取的查询结果加密输出给查询用户。
在一可选实施例中，查询权限范围中包括查询结果的规格、允许查询的融合计算结果的标识和/或查询次数。
值得说明的是，上述关于数据融合方法各实施例中的技术细节，可参考前述的系统实施例中关于可信设备的相关描述，为节省篇幅，在此不再赘述，但这不应造成本申请保护范围的损失。
图4为本申请另一示例性实施例提供的另一种数据融合方法的流程示意图。该方法可由数据处理装置执行，该数据处理装置可实现为软件和/或硬件的结合，该数据处理装置可集成在前述系统实施例中的控制设备中。参考图4，该方法包括：
步骤400、针对存在需求的融合组，触发可信设备为融合组创建专用的融合服务，可信设备为融合服务提供可信执行环境；
步骤401、将融合组内各个参与方签发的行为控制规则提供给可信设备，以将融合服务的服务权限限定在行为控制规则的范围之内；
步骤402、将融合组内发出的融合计算请求转发至融合服务，以利用融合服务在可信执行环境中响应融合计算请求。
在一可选实施例中，该方法还包括：
针对需要对融合组的融合计算结果进行查询的查询用户，向融合组内各个参与方发送授权请求；
接收融合组内各个参与方针对查询用户签发的查询权限范围；
将查询权限范围提供给可信设备，以供可信设备将融合服务对查询用户提供的查询服务限定在查询权限范围内。
在一可选实施例中，该方法还包括：
接收查询用户针对融合组的融合计算结果发起的查询请求；
将查询请求转发至可信设备，以供可信设备利用融合服务判断查询请求是否符合查询权限范围，并在符合的情况下将从融合计算结果中提取的查询结果加密输出给查询用户。
值得说明的是，上述关于数据融合方法各实施例中的技术细节，可参考前述的系 统实施例中关于控制设备的相关描述，为节省篇幅，在此不再赘述，但这不应造成本申请保护范围的损失。
另外，上述实施例所提供方法的各步骤的执行主体均可以是同一设备，或者，该方法也由不同设备作为执行主体。在上述实施例及附图中的描述的一些流程中，包含了按照特定顺序出现的多个操作，但是应该清楚了解，这些操作可以不按照其在本文中出现的顺序来执行或并行执行，操作的序号如300、301等，仅仅是用于区分开各个不同的操作，序号本身不代表任何的执行顺序。
图5为本申请又一示例性实施例提供的一种可信设备的结构示意图。如图5所示，该计算设备包括：存储器50、处理器51以及通信组件52。
处理器51，与存储器50和通信组件52耦合，用于执行存储器50中的计算机程序，以用于：
针对存在需求的融合组，在可信执行环境中为融合组创建专用的融合服务；
获取融合组内各个参与方签发的行为控制规则；
在可信执行环境中，利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求。
在一可选实施例中，处理器51可通过通信组件52接收控制设备转发的由融合组内发出的融合服务创建请求，以启动在可信执行环境中为融合组创建专用的融合服务的操作。
在一可选实施例中，处理器51还可用于：
利用融合服务对融合组内各个参与方签发的行为控制规则进行验证；
若验证成功，则控制融合服务接受行为控制规则，以将融合服务的服务权限限定至行为控制规则的范围内。
在一可选实施例中，处理器51在对行为控制规则的验证过程中，可用于：
验证行为控制规则的是否在对应的参与方签发的；
验证是否已收到融合组内所有参与方签发的行为控制规则。
在一可选实施例中，处理器51在控制融合服务接受行为控制规则的过程中，可用于：
控制融合服务对行为控制规则进行签名；
存储经过签名后的行为控制规则，作为后续响应融合计算请求过程中的服务权限限定依据。
在一可选实施例中，处理器51在利用融合服务在行为控制规则的范围内响应融合组内发出的融合计算请求的过程中，可用于：
接收融合组内发出的融合计算请求；
若确定融合计算请求中指示的融合计算行为位于行为控制规则的范围内，则响应融合计算请求。
在一可选实施例中，处理器51还可用于：
解析融合计算请求中指示的融合计算行为所涉及到的至少一个目标参与方；
若融合计算行为符合全部目标参与方签发的行为控制规则，则确定融合计算行为位于行为控制规则的范围内。
在一可选实施例中，处理器51还可用于：
接收查询用户针对融合组的融合计算结果发起的查询请求；
若查询请求符合融合组内各个参与方预先为查询用户签发的查询权限范围，则将从融合计算结果中提取的查询结果加密输出给查询用户。
在一可选实施例中，查询权限范围中包括查询结果的规格、允许查询的融合计算结果的标识和/或查询次数。
进一步，如图5所示，该可信设备还包括：电源组件53等其它组件。图5中仅示意性给出部分组件，并不意味着可信设备只包括图5所示组件。
值得说明的是，上述关于可信设备各实施例中的技术细节，可参考前述的系统实施例中关于可信设备的相关描述，为节省篇幅，在此不再赘述，但这不应造成本申请保护范围的损失。
图6为本申请又一示例性实施例提供的一种控制设备的结构示意图。如图6所示，该计算设备包括：存储器60、处理器61以及通信组件62。
处理器61，与存储器60和通信组件62耦合，用于执行存储器60中的计算机程序，以用于：
针对存在需求的融合组，触发可信设备为融合组创建专用的融合服务，可信设备为融合服务提供可信执行环境；
将融合组内各个参与方签发的行为控制规则提供给可信设备，以将融合服务的服务权限限定在行为控制规则的范围之内；
将融合组内发出的融合计算请求转发至融合服务，以利用融合服务在可信执行环境中响应融合计算请求。
在一可选实施例中，处理器61可通过通信组件62将融合组内发出的融合服务创建请求转发至可信设备，以触发可信设备为融合组创建专用的融合服务。
在一可选实施例中，处理器61还用于：
针对需要对融合组的融合计算结果进行查询的查询用户，向融合组内各个参与方发送授权请求；
接收融合组内各个参与方针对查询用户签发的查询权限范围；
将查询权限范围提供给可信设备，以供可信设备将融合服务对查询用户提供的查询服务限定在查询权限范围内。
在一可选实施例中，处理器61还用于：
接收查询用户针对融合组的融合计算结果发起的查询请求；
将查询请求转发至可信设备，以供可信设备利用融合服务判断查询请求是否符合查询权限范围，并在符合的情况下将从融合计算结果中提取的查询结果加密输出给查询用户。
进一步，如图6所示，该控制设备还包括：电源组件63等其它组件。图6中仅示意性给出部分组件，并不意味着控制设备只包括图6所示组件。
值得说明的是，上述关于控制设备各实施例中的技术细节，可参考前述的系统实施例中关于控制设备的相关描述，为节省篇幅，在此不再赘述，但这不应造成本申请保护范围的损失。
相应地，本申请实施例还提供一种存储有计算机程序的计算机可读存储介质，计算机程序被执行时能够实现上述方法实施例中可由可信设备/控制设备执行的各步骤。
上述图5和6中的存储器，用于存储计算机程序，并可被配置为存储其它各种数据以支持在计算平台上的操作。这些数据的示例包括用于在计算平台上操作的任何应用程序或方法的指令，联系人数据，电话簿数据，消息，图片，视频等。存储器可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(SRAM)，电可擦除可编程只读存储器(EEPROM)，可擦除可编程只读存储器(EPROM)，可编程只读存储器(PROM)，只读存储器(ROM)，磁存储器，快闪存储器，磁盘或光盘。
上述图5和6中的通信组件，被配置为便于通信组件所在设备和其他设备之间有线或无线方式的通信。通信组件所在设备可以接入基于通信标准的无线网络，如WiFi，2G、3G、4G/LTE、5G等移动通信网络，或它们的组合。在一个示例性实施例中，通信组件经由广播信道接收来自外部广播管理系统的广播信号或广播相关信息。在一个示例性实施例中，通信组件还包括近场通信(NFC)模块，以促进短程通信。例如，在NFC模块可基于射频识别(RFID)技术，红外数据协会(IrDA)技术，超宽带(UWB)技术，蓝牙(BT)技术和其他技术来实现。
上述图5和6中的电源组件，为电源组件所在设备的各种组件提供电力。电源组件可以包括电源管理系统，一个或多个电源，及其他与为电源组件所在设备生成、管理和分配电力相关联的组件。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机 程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
在一个典型的配置中，计算设备包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带式磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括要素的过程、方法、商品或者设备中还存在另外的相同要素。
以上仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (15)

  1. 一种数据融合方法，包括：
    针对存在需求的融合组，在可信执行环境中为所述融合组创建专用的融合服务；
    获取所述融合组内各个参与方签发的行为控制规则；
    在所述可信执行环境中，利用所述融合服务在所述行为控制规则的范围内响应所述融合组内发出的融合计算请求。
  2. 根据权利要求1所述的方法，还包括：
    利用所述融合服务对所述融合组内各个参与方签发的行为控制规则进行验证；
    若验证成功，则控制所述融合服务接受所述行为控制规则，以将所述融合服务的服务权限限定至所述行为控制规则的范围内。
  3. 根据权利要求2所述的方法，对所述行为控制规则的验证过程包括：
    验证所述行为控制规则的是否在对应的参与方签发的；
    验证是否已收到所述融合组内所有参与方签发的行为控制规则。
  4. 根据权利要求2所述的方法，所述控制所述融合服务接受所述行为控制规则，包括：
    控制所述融合服务对所述行为控制规则进行签名；
    存储经过签名后的行为控制规则，作为后续响应融合计算请求过程中的服务权限限定依据。
  5. 根据权利要求1所述的方法，所述利用所述融合服务在所述行为控制规则的范围内响应所述融合组内发出的融合计算请求，包括：
    接收所述融合组内发出的融合计算请求；
    若确定所述融合计算请求中指示的融合计算行为位于所述行为控制规则的范围内，则响应所述融合计算请求。
  6. 根据权利要求5所述的方法，还包括：
    解析所述融合计算请求中指示的融合计算行为所涉及到的至少一个目标参与方；
    若所述融合计算行为符合全部目标参与方签发的行为控制规则，则确定所述融合计算行为位于所述行为控制规则的范围内。
  7. 根据权利要求1所述的方法，还包括：
    接收查询用户针对所述融合组的融合计算结果发起的查询请求；
    若所述查询请求符合所述融合组内各个参与方预先为所述查询用户签发的查询权限范围，则将从所述融合计算结果中提取的查询结果加密输出给所述查询用户。
  8. 根据权利要求7所述的方法，所述查询权限范围中包括查询结果的规格、允许查询的融合计算结果的标识和/或查询次数。
  9. 一种数据融合方法，包括：
    针对存在需求的融合组，触发可信设备为所述融合组创建专用的融合服务，所述可信设备为所述融合服务提供可信执行环境；
    将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备，以将所述融合服务的服务权限限定在所述行为控制规则的范围之内；
    将所述融合组内发出的融合计算请求转发至所述融合服务，以利用所述融合服务在所述可信执行环境中响应所述融合计算请求。
  10. 根据权利要求9所述的方法，还包括：
    针对需要对所述融合组的融合计算结果进行查询的查询用户，向所述融合组内各个参与方发送授权请求；
    接收所述融合组内各个参与方针对所述查询用户签发的查询权限范围；
    将所述查询权限范围提供给所述可信设备，以供所述可信设备将所述融合服务对所述查询用户提供的查询服务限定在所述查询权限范围内。
  11. 根据权利要求10所述的方法，还包括：
    接收所述查询用户针对所述融合组的融合计算结果发起的查询请求；
    将所述查询请求转发至所述可信设备，以供所述可信设备利用所述融合服务判断所述查询请求是否符合所述查询权限范围，并在符合的情况下将从所述融合计算结果中提取的查询结果加密输出给所述查询用户。
  12. 一种数据融合系统，包括：控制平台、可信设备和至少一个融合组；
    所述控制平台，用于针对存在融合需求的目标融合组，向所述可信设备发送服务创建请求；将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备；
    所述可信设备，用于根据所述服务创建请求为所述目标融合组创建专用的融合服务；
    所述融合服务，用于在所述可信设备提供的可信执行环境中，在所述行为控制规则的范围内响应所述目标融合组内发出的融合计算请求。
  13. 一种可信设备，包括存储器、处理器和通信组件；
    所述存储器用于存储一条或多条计算机指令；
    所述处理器与所述存储器和所述通信组件耦合，用于执行所述一条或多条计算机指令，以用于：
    针对存在需求的融合组，在可信执行环境中为所述融合组创建专用的融合服务；
    获取所述融合组内各个参与方签发的行为控制规则；
    在所述可信执行环境中，利用所述融合服务在所述行为控制规则的范围内响应所述融合组内发出的融合计算请求。
  14. 一种控制设备，包括存储器、处理器和通信组件；
    所述存储器用于存储一条或多条计算机指令；
    所述处理器与所述存储器和所述通信组件耦合，用于执行所述一条或多条计算机指令，以用于：
    针对存在需求的融合组，触发可信设备为所述融合组创建专用的融合服务，所述可信设备为所述融合服务提供可信执行环境；
    将所述融合组内各个参与方签发的行为控制规则提供给所述可信设备，以将所述融合服务的服务权限限定在所述行为控制规则的范围之内；
    将所述融合组内发出的融合计算请求转发至所述融合服务，以利用所述融合服务在所述可信执行环境中响应所述融合计算请求。
  15. 一种存储计算机指令的计算机可读存储介质，当所述计算机指令被一个或多个处理器执行时，致使所述一个或多个处理器执行权利要求1-11任一项所述的数据融合方法。
PCT/CN2023/110357 2022-08-01 2023-07-31 一种数据融合方法、设备、系统及存储介质 WO2024027665A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210915575.0 2022-08-01
CN202210915575.0A CN114996694B (zh) 2022-08-01 2022-08-01 一种数据融合方法、设备、系统及存储介质

Publications (1)

Publication Number Publication Date
WO2024027665A1 true WO2024027665A1 (zh) 2024-02-08

Family

ID=83022351

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/110357 WO2024027665A1 (zh) 2022-08-01 2023-07-31 一种数据融合方法、设备、系统及存储介质

Country Status (2)

Country Link
CN (1) CN114996694B (zh)
WO (1) WO2024027665A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114996694B (zh) * 2022-08-01 2023-01-24 阿里云计算有限公司 一种数据融合方法、设备、系统及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111027086A (zh) * 2019-12-16 2020-04-17 支付宝(杭州)信息技术有限公司 一种私有数据保护方法和系统
CN111049825A (zh) * 2019-12-12 2020-04-21 支付宝(杭州)信息技术有限公司 一种基于可信执行环境的安全多方计算方法和系统
CN112733179A (zh) * 2021-04-01 2021-04-30 武汉大学 一种轻量级非交互隐私保护数据聚合方法
WO2021083179A1 (zh) * 2019-10-30 2021-05-06 阿里巴巴集团控股有限公司 一种安全多方计算方法、设备、系统及存储介质
WO2021159684A1 (zh) * 2020-02-14 2021-08-19 云从科技集团股份有限公司 数据处理方法、系统、平台、设备及机器可读介质
CN114996694A (zh) * 2022-08-01 2022-09-02 阿里云计算有限公司 一种数据融合方法、设备、系统及存储介质

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8881289B2 (en) * 2011-10-18 2014-11-04 Mcafee, Inc. User behavioral risk assessment
CN111082934B (zh) * 2019-12-31 2021-04-06 支付宝(杭州)信息技术有限公司 基于可信执行环境的跨域安全多方计算的方法及装置
CN116340955A (zh) * 2020-07-31 2023-06-27 支付宝(杭州)信息技术有限公司 一种基于区块链的数据处理方法、装置及设备
CN113328854B (zh) * 2021-05-24 2022-09-16 杭州溪塔科技有限公司 基于区块链的业务处理方法及系统
CN113688899A (zh) * 2021-08-23 2021-11-23 北京明略昭辉科技有限公司 一种数据融合方法、装置、存储介质及电子设备
CN114255037A (zh) * 2021-12-22 2022-03-29 上海阵方科技有限公司 隐私保护下的多方联合排序方法和数据处理方法
CN114417287B (zh) * 2022-03-25 2022-09-06 阿里云计算有限公司 数据处理方法、系统、设备及存储介质
CN114817982A (zh) * 2022-04-15 2022-07-29 支付宝(杭州)信息技术有限公司 一种提供隐私保护的多方计算控制方法、装置以及设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021083179A1 (zh) * 2019-10-30 2021-05-06 阿里巴巴集团控股有限公司 一种安全多方计算方法、设备、系统及存储介质
CN111049825A (zh) * 2019-12-12 2020-04-21 支付宝(杭州)信息技术有限公司 一种基于可信执行环境的安全多方计算方法和系统
CN111027086A (zh) * 2019-12-16 2020-04-17 支付宝(杭州)信息技术有限公司 一种私有数据保护方法和系统
WO2021159684A1 (zh) * 2020-02-14 2021-08-19 云从科技集团股份有限公司 数据处理方法、系统、平台、设备及机器可读介质
CN112733179A (zh) * 2021-04-01 2021-04-30 武汉大学 一种轻量级非交互隐私保护数据聚合方法
CN114996694A (zh) * 2022-08-01 2022-09-02 阿里云计算有限公司 一种数据融合方法、设备、系统及存储介质

Also Published As

Publication number Publication date
CN114996694B (zh) 2023-01-24
CN114996694A (zh) 2022-09-02

Similar Documents

Publication Publication Date Title
US20230224167A1 (en) Access control method based on zero-trust security, device, and storage medium
CN111783075B (zh) 基于密钥的权限管理方法、装置、介质及电子设备
US9626497B2 (en) Sharing USB key by multiple virtual machines located at different hosts
WO2020042822A1 (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
US9846778B1 (en) Encrypted boot volume access in resource-on-demand environments
US9219722B2 (en) Unclonable ID based chip-to-chip communication
KR20170060004A (ko) 두 장치 간의 신뢰 확립 기법
US10250613B2 (en) Data access method based on cloud computing platform, and user terminal
US20210067326A1 (en) Cryptographic operation method, method for creating working key, cryptographic service platform, and cryptographic service device
US10887085B2 (en) System and method for controlling usage of cryptographic keys
US20120072972A1 (en) Secondary credentials for batch system
KR20200087327A (ko) IoT 서비스를 위한 블록체인 기반 데이터 신뢰성 제공 시스템 및 방법
US10142100B2 (en) Managing user-controlled security keys in cloud-based scenarios
Rui et al. Research on secure transmission and storage of energy IoT information based on Blockchain
WO2024027665A1 (zh) 一种数据融合方法、设备、系统及存储介质
US20200304310A1 (en) System and method for pre-authentication of customer support calls
JP2020535530A (ja) リソース処理方法、装置、システムおよびコンピュータ読み取り可能な媒体
US9509503B1 (en) Encrypted boot volume access in resource-on-demand environments
WO2023239849A1 (en) Internet protocol (ip) whitelisting for signed uniform resource locators (urls)
CN113901507B (zh) 一种多参与方的资源处理方法及隐私计算系统
CN113987475A (zh) 分布式资源管理系统及方法、凭证信息的管理系统、介质
Hammami et al. Security issues in cloud computing and associated alleviation approaches
TWM585941U (zh) 帳戶資料處理系統
CN117879819B (zh) 密钥管理方法、装置、存储介质、设备及算力服务系统
US11804969B2 (en) Establishing trust between two devices for secure peer-to-peer communication

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23849372

Country of ref document: EP

Kind code of ref document: A1