WO2020238242A1 - 一种基于安全计算的个人数据服务方法和*** - Google Patents

一种基于安全计算的个人数据服务方法和*** Download PDF

Info

Publication number
WO2020238242A1
WO2020238242A1 PCT/CN2020/071239 CN2020071239W WO2020238242A1 WO 2020238242 A1 WO2020238242 A1 WO 2020238242A1 CN 2020071239 W CN2020071239 W CN 2020071239W WO 2020238242 A1 WO2020238242 A1 WO 2020238242A1
Authority
WO
WIPO (PCT)
Prior art keywords
user data
user
data
party
party service
Prior art date
Application number
PCT/CN2020/071239
Other languages
English (en)
French (fr)
Inventor
应鹏飞
殷山
Original Assignee
创新先进技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 创新先进技术有限公司 filed Critical 创新先进技术有限公司
Priority to US16/841,462 priority Critical patent/US11120160B2/en
Publication of WO2020238242A1 publication Critical patent/WO2020238242A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Definitions

  • the present disclosure relates to privacy data protection and processing, and in particular to a personal data service method and system based on secure computing.
  • the present disclosure provides a user privacy protection solution.
  • This technical solution addresses the defect that most of the user privacy data in the prior art is stored on a server owned by a merchant or enterprise.
  • a user deploys a privacy protection application (App) for proxying personal data or personal information on a local client, and the user transfers his personal data or personal information through the privacy protection application
  • Personal information is stored in the cloud storage associated with the application or other cloud storage designated by the user, instead of being stored on a server associated with a third-party merchant or enterprise.
  • the user has full control over the personal information or personal data in the cloud storage, that is, the user can add, query, change, or delete any personal information or data. Users can encrypt their personal data stored in cloud storage and prevent any unauthorized use or sharing.
  • a third-party merchant or enterprise When a third-party merchant or enterprise requests user data, the user authorizes the third-party merchant or enterprise to query the personal information or personal data stored in the cloud storage through the password or password that the user possesses, and the user authorizes all the information on the client
  • the deployed privacy protection application obtains corresponding user data from cloud storage.
  • the acquired user data may be encrypted by the user, and the privacy protection application decrypts the acquired user data based on user authorization and stores the decrypted user data in the memory of the user device without caching the user data, and then Use the public key provided by the third-party merchant to encrypt the user data stored in the memory, and then transmit the encrypted user data to the third-party merchant.
  • the third-party merchant receives the encrypted user data and decrypts it with its private key to obtain user data or information.
  • the present disclosure also discloses an advanced solution for protecting user privacy.
  • the encrypted user data is also transmitted to the third-party merchant through the data model or rules provided by the third-party merchant.
  • the user data is further processed to output the processed user data, so that third-party merchants cannot learn the details of the user data after decryption, and can only use the user data based on the provided models or rules, thereby further protecting user privacy .
  • a method for privacy data protection includes:
  • a system for privacy data protection including:
  • a device for receiving user data requests from third-party services A device for receiving user data requests from third-party services
  • a device used to obtain user data from cloud storage A device used to obtain user data from cloud storage
  • a device used to transfer encrypted user data to a third-party service for decryption and access to the user data is not limited to, but not limited to, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, Wi-Fi, etc.
  • Another method for privacy data protection includes:
  • system for privacy data protection includes:
  • a device for receiving user data requests from third-party services A device for receiving user data requests from third-party services
  • a device used to obtain user data from cloud storage A device used to obtain user data from cloud storage
  • Devices used to process the acquired user data through data models or rules provided by third-party services are Devices used to process the acquired user data through data models or rules provided by third-party services
  • a device for transmitting processed and encrypted user data to a third-party service for decryption and obtaining processed user data
  • FIGS 1, 2A, 2B, and 3 show various operating environments in which various embodiments of the present disclosure may be implemented.
  • Fig. 4 shows a block diagram of an example of user privacy data protection according to an embodiment of the present disclosure.
  • FIG. 5 shows an example data flow diagram for privacy data protection according to an embodiment of the present disclosure.
  • FIG. 6 shows a flowchart of an example method for privacy data protection according to an embodiment of the present disclosure.
  • Fig. 7 shows a block diagram of another example of user privacy data protection according to another embodiment of the present disclosure.
  • FIG. 8 shows a block diagram of secure multi-party computing according to an embodiment of the present disclosure.
  • FIG. 9 shows a data flow diagram of another example for privacy data protection according to another embodiment of the present disclosure.
  • FIG. 10 shows a flowchart of another example method for privacy data protection according to another embodiment of the present disclosure.
  • FIGS. 1-3 are for the purpose of example and description, and are not a limitation on a large number of computing device configurations that can be used to implement the various embodiments of the present disclosure described herein. .
  • FIG. 1 is a block diagram illustrating example physical components of a desktop computing device 100 that can be used to implement various embodiments of the present disclosure.
  • the computing device components described below are applicable to the above-mentioned computing devices.
  • the desktop computing device 100 may include at least one processing unit 102 and system memory 104.
  • the system memory 104 may include, but is not limited to, volatile memory (for example, random access memory (RAM)), non-volatile memory (for example, read only memory (ROM)) , Flash memory or any combination.
  • the system memory 104 may include an operating system 105, one or more programming modules 106, and may include a web browser application 120.
  • the operating system 105 may be suitable for the operation of the console type computing device 100.
  • the programming module 106 may include a privacy protection application 26 installed on the desktop computing device 100.
  • the various embodiments of the present disclosure can be practiced in combination with graphics libraries, other operating systems, or any other application programs, and are not limited to any specific application program or system. This basic configuration is shown in FIG. 1 by those components within the dashed line 108.
  • the desktop computing device 100 may have additional features or functions.
  • the desktop computing device 100 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape. These additional storage are shown by removable storage 109 and non-removable storage 110.
  • program modules and data files including the operating system 105 can be stored in the system memory 104.
  • the program module 106 can execute various processes, including operations related to the methods described below. The following processes are examples, and the processing unit 102 may perform other processes.
  • Other program modules that can be used according to various embodiments of the present disclosure may include email and contact applications, word processing applications, spreadsheet applications, database applications, slide presentation applications, drawing or computer-aided applications, and the like.
  • program modules may include routines, programs, components, data structures, and other types of structures that can perform specific tasks or can implement specific abstract data types.
  • the various embodiments of the present disclosure can be implemented in other computer system configurations, including handheld devices, multi-processor systems, microprocessor-based systems or programmable consumer electronics products, minicomputers, mainframe computers, and the like.
  • the various embodiments of the present disclosure can also be implemented in a distributed computing environment in which tasks are performed by remote processing devices linked through a communication network.
  • program modules can be located in both local and remote memory storage devices.
  • various embodiments of the present disclosure may be implemented on a circuit including discrete electronic components, a package or integrated electronic chip including logic gates, a circuit using a microprocessor, or on a single chip including electronic components or a microprocessor.
  • various embodiments of the present disclosure may be implemented by a system on a chip (SOC), in which each or many components shown in FIG. 1 may be integrated on a single integrated circuit.
  • SOC devices may include one or more processing units, graphics units, communication units, system virtualization units, and various application functions, all of which are integrated (or "burned") on a chip substrate as a single integrated circuit .
  • the functions of the manager 26 described herein can be operated through application-specific logic integrated on a single integrated circuit (chip) together with other components of the computing device/system 100.
  • the various embodiments of the present disclosure can also be practiced using other technologies that can perform logical operations such as, for example, AND (and), OR (or), and NOT (not), including but not limited to mechanical, optical, fluid, and quantum technology.
  • the various embodiments of the present disclosure may be implemented in a general-purpose computer or any other circuit or system.
  • various embodiments of the present disclosure may be implemented as a computer process (method), a computing system, or an article such as a computer program product or a computer readable medium.
  • the computer program product may be a computer storage medium in which a computer system can read and encode a computer program for instructions for executing a computer process.
  • Computer readable media may include computer storage media.
  • Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information such as computer readable instructions, data structures, program modules, or other data.
  • the system memory 104, the removable storage 109, and the non-removable storage 110 are all examples of computer storage media (ie, memory storage).
  • Computer storage media may include, but are not limited to, RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical storage, tape cartridges, Tape, magnetic disk storage or other magnetic storage devices, or any other media that can be used to store information and that can be accessed by the desktop computing device 100.
  • the desktop computing device 100 may also have an input device 112, such as a keyboard, a mouse, a pen, a sound input device, a touch input device, and so on. It may also include output devices 114 such as displays, speakers, and printers. The above devices are examples and other devices can be used.
  • the camera and/or some other sensing device may be operable to record movements and/or gestures made by one or more users and to capture the users of the computing device.
  • the sensing device is also operable to capture words such as spoken through a microphone and/or to capture other input from the user such as through a keyboard and/or mouse (not depicted).
  • the sensing device may include any motion detection device capable of detecting the movement of the user.
  • the term computer readable media as used herein also includes communication media.
  • the communication medium is embodied by computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and includes any information delivery medium.
  • modulated data signal can describe a signal that has one or more characteristics set or changed in a manner that encodes information in the signal.
  • communication media include wired media such as a wired network or direct wire connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.
  • FIGS. 2A and 2B illustrate suitable mobile computing environments, such as mobile phones, smart phones, tablet personal computers, laptop computers, etc., that can be used to implement various embodiments of the present disclosure.
  • an example mobile computing device 200 for implementing various embodiments is shown.
  • the mobile computing device 200 is a handheld computer with both input elements and output elements.
  • the input elements may include a touch screen display 205 and input buttons 210 that allow the user to input information into the mobile computing device 200.
  • the mobile computing device 200 may also incorporate an optional side input element 215 that allows further user input.
  • the optional side input element 215 may be a rotary switch, button, or any other type of manual input element.
  • the mobile computing device 200 may incorporate more or fewer input elements.
  • the display 205 may not be a touch screen.
  • the mobile computing device is a portable telephone system, such as a cell phone with a display 205 and input buttons 210.
  • the mobile computing device 200 may also include an optional keypad 235.
  • the optional keypad 235 may be a physical keypad or a "soft" keypad generated on a touch screen display.
  • the mobile computing device 200 incorporates output elements, such as a display 205 that can display a graphical user interface (GUI). Other output components include speakers 225 and LED 220.
  • the mobile computing device 200 may include a vibration module (not shown) that causes the mobile computing device 200 to vibrate to notify the user of the event.
  • the mobile computing device 200 may be combined with a headphone jack (not shown) to provide another means to provide an output signal.
  • the present disclosure can also be used in combination with any number of computer systems, such as in a desktop environment, laptop or notebook computer systems, multi-processor systems , Based on microprocessor or programmable consumer electronic products, network PCs, small computers, large computers, etc.
  • the embodiments of the present disclosure can also be practiced in a distributed computing environment, in which tasks are executed by remote processing devices linked through a communication network in the distributed computing environment; programs can be located in local and remote memory storage devices.
  • any computer system having multiple environmental sensors, multiple output elements that provide notifications to users, and multiple notification event types can incorporate embodiments of the present disclosure.
  • FIG 2B is a block diagram showing components of a mobile computing device, such as the computing device shown in Figure 2A, used in one embodiment. That is, the mobile computing device 200 may be combined with the system 202 to implement certain embodiments.
  • the system 202 can be used to implement a "smart phone" that can run one or more applications similar to those of a desktop or notebook computer, such as presentation applications, browsers, emails, scheduling, instant messaging , And media player applications.
  • the system 202 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone.
  • PDA personal digital assistant
  • One or more applications 266 may be loaded into the memory 262 and run on or in association with the operating system 264. Examples of application programs include telephone dialing programs, e-mail programs, PIM (Personal Information Management) programs, word processing programs, spreadsheet programs, Internet browser programs, messaging programs, and so on.
  • the system 202 also includes non-volatile storage 262 in the memory 268.
  • the non-volatile storage 268 may be used to store persistent information that will not be lost when the system 202 is powered off.
  • the application 266 can use the information and store the information in the non-volatile storage 268, such as email or other messages used by the email application.
  • a synchronization application may also reside on the system 202 and be programmed to interact with a corresponding synchronization application that resides on the host computer to maintain the information stored in the non-volatile storage 268 with the information stored in the host computer.
  • the corresponding information on the computer is synchronized.
  • other applications may be loaded into the memory 262 and run on the device 200, including the privacy protection application 26.
  • the system 202 has a power source 270 that can be implemented as one or more batteries.
  • the power source 270 may also include an external power source, such as an AC adapter or power-on docking cradle to supplement or recharge the battery.
  • the system 202 may also include a radio 272 that performs the function of transmitting and receiving radio frequency communications.
  • the radio 272 facilitates the wireless connection between the system 202 and the "outside world" through the communication operator or service provider.
  • the transmission to and from the radio 272 is under the control of the operating system 264. In other words, communications received by the radio 272 can be propagated to the application 266 through the operating system 264, and vice versa.
  • the radio 272 allows the system 202 to communicate with other computing devices, such as through a network.
  • the radio 272 is an example of a communication medium.
  • the communication medium is embodied by computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and includes any information delivery medium.
  • modulated data signal refers to a signal that allows one or more of its characteristics to be set or changed in a manner that encodes information in the signal.
  • communication media include wired media such as a wired network or direct wire connection, and wireless media such as acoustic, RF, infrared, and other wireless media.
  • the term computer readable media as used herein includes both storage media and communication media.
  • This embodiment of the system 202 is shown with two types of notification output devices: an LED 220 that can be used to provide visual notifications, and an audio interface 274 that can be used to provide audio notifications by the speaker 225.
  • These devices can be directly coupled to the power source 270 so that when activated, even if the processor 260 and other components may be shut down to save battery power, they remain powered on for a duration indicated by the notification mechanism.
  • the LED 220 can be programmed to remain powered on indefinitely until the user takes action to indicate the power-on status of the device.
  • the audio interface 274 is used to provide audible signals to and receive audible signals from the user.
  • the audio interface 274 may also be coupled to a microphone to receive auditory input, such as to facilitate telephone conversations.
  • the microphone may also serve as an audio sensor to facilitate the control of notifications, as will be described below.
  • the system 202 may further include a video interface 276 that allows the operation of the onboard camera 230 to record still images, video streams, and the like.
  • the mobile computing device implementation system 202 may have additional features or functions.
  • the device may also include additional data storage devices (removable/or non-removable) such as magnetic disks, optical disks, or tape.
  • additional storage is shown by storage 268 in Figure 2B.
  • Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information such as computer readable instructions, data structures, program modules, or other data.
  • the data/information generated or captured by the device 200 and stored by the system 202 can be stored locally on the device 200 as described above, or the data can be stored in a separate device that can be used by the device via radio 272 or via the device 200 and associated with the device 200.
  • such data/information can be accessed via the device 200, via the radio 272, or via a distributed computing network.
  • these data/information can be easily transferred between computing devices for storage and use according to known data/information transfer and storage means, including email and collaborative data/information sharing systems.
  • the third-party service 312 may include, but is not limited to, a directory service 322, a web portal service 324, an email service 326, an instant messaging service 328, and a social network service 330.
  • the server 332 may provide communications and services related to the methods as described herein.
  • the third-party service 312 can communicate with various computing devices on the web through the server 332 and the network 308. Examples of computing devices that may utilize the server 332 include a desktop computing device 302 (the desktop computing device may include any general-purpose personal computer), a tablet computing device 304, and/or a mobile computing device 306, which may include a smart phone.
  • Each computing device specifically the privacy protection application in each computing device, can obtain user information from the cloud storage 310 and encrypt it and transmit it to the third-party service 312 under user authorization.
  • the third-party service 312 decrypts the received encrypted user information and stores it in the storage 316.
  • Fig. 4 shows a block diagram of an example of user privacy data protection according to an embodiment of the present disclosure.
  • the user 402 deploys a privacy protection application (App) 406 for proxying personal data or personal information on a local client.
  • the "client” described herein can refer to a user's personal computing device, including desktop computing devices (such as desktop computers, laptop computers, smart TVs, etc.), tablet computing devices (such as iPad), and mobile computing devices (such as smart Cell phone).
  • the “privacy protection application” described in this article can refer to the applications downloaded by users from various application markets and installed on the local client, including but not limited to Alipay developed by Ant Financial.
  • the privacy protection application 406 is used to proxy the user’s personal data, specifically to receive a data request from a third-party service and forward the request to the user 402; to receive the user 402’s authorization or approval of the request and to authorize information or permissions
  • the information is sent to a third-party service; the requested user data is downloaded from cloud storage based on user authorization and stored in memory instead of caching the data.
  • the user data obtained by the privacy protection application 406 from the cloud storage 404 may be encrypted by the user, and the privacy protection application 406 may obtain the encrypted user data from the cloud storage under the user's authorization to download and based on the user Download authorization to restore user data; use the public key provided by the third-party service to encrypt the user data in the memory; transmit the encrypted user data to the third-party service for decryption and use.
  • the user 402 uses the privacy protection application 406 to store their personal data or personal information in the cloud storage 404 associated with the privacy protection application 406 or other cloud storage designated by the user, instead of storing it on a server associated with a third-party service on.
  • Cloud storage 404 includes, but is not limited to, the Dingpan developed by Ant Financial and Facebook Cloud Storage developed by Facebook.
  • the user 402 can also store his personal data on the local client.
  • the user 402 has full control over the personal information or personal data stored in the cloud storage 404, that is, the user 402 can add, query, modify, or delete any personal information or data.
  • the user's control over his personal data is at least partially realized by a password or a password, and the privacy protection application 406, the third-party service 408, and the cloud storage 404 cannot obtain the password information.
  • the user 402 can encrypt the user data stored in the cloud storage 404 to prevent any unauthorized use or sharing.
  • the third-party service 408 When a third-party service 408, that is, a service provided by a third-party merchant or enterprise, requires user data, the third-party service 408 sends a user data request to the privacy protection application 406.
  • the user data request includes what user data the third-party service 408 needs Instructions.
  • the privacy protection application 406 After receiving the user data request from the third-party service 408, the privacy protection application 406 forwards the request to the user 402 or its local client.
  • the user 402 authorizes or approves the request or otherwise approves the request through the password or password that the user 402 possesses, so as to allow the third-party service 408 to perform processing on the personal information or personal data stored on the cloud storage 404 or the local client. Inquire.
  • the privacy protection application 406 deployed on the client sends the authorization information to the third-party service 408, and when the user is authorized, the corresponding user data is obtained from the cloud storage 404 and stored in the user's personal computing
  • the data is stored in the (volatile) memory of the device without caching the data, and the public key provided by the third-party service 408 is used to encrypt it, and then the encrypted user data is transmitted to the third-party service 408.
  • the third-party service 408 receives the encrypted user data and uses its private key to decrypt it to obtain user data or information.
  • FIG. 5 shows an example data flow diagram for privacy data protection according to an embodiment of the present disclosure.
  • the user uses the privacy protection application 406 to store personal data or personal information in the cloud storage 404 associated with the privacy protection application 406 or other cloud storage designated by the user, instead of storing it in association with a third-party service To avoid misuse of user data by third-party services.
  • the third-party service 408 sends a user data request to the privacy protection application 406.
  • the request indicates what user data the third party service 408 needs.
  • the privacy protection application 406 after receiving the user data request from the third-party service 408, forwards the request to the user 402 or its local client.
  • the forwarding operation may take the form of application notification, but is not limited to this notification form.
  • the user 402 authorizes or approves the user data request via the privacy protection application 406 or otherwise approves the data request through the password or password possessed by the user 402 to allow the third-party service 408 to store it in the cloud storage 404 or Inquire about personal information or personal data on the local client.
  • the password possessed by the user may take a form including but not limited to numbers, letters, or a combination of numbers and letters, and the privacy protection application 406, the third-party service 408, and the cloud storage 404 cannot obtain the password information.
  • the privacy protection application 406 sends authorization information to the third-party service 408 to confirm to it that the user authorizes his data request.
  • the privacy protection application 406 obtains the corresponding user data from the cloud storage 404 and encrypts it under user authorization.
  • the user data obtained by the privacy protection application from the cloud storage may be user-encrypted, and the privacy protection application may obtain the encrypted user data from the cloud storage under the user's authorization to download and based on the user's download authorization To restore user data.
  • the encrypted user data is then transmitted to the third party service 408 at 514.
  • This encryption operation can be accomplished through a third-party public key associated with the third-party service 408.
  • the third-party service 408 may receive the encrypted user data and decrypt it to obtain the corresponding user data.
  • FIG. 6 shows a flowchart of an example method 600 for privacy data protection according to an embodiment of the present disclosure.
  • the privacy protection application deployed on the user's local client receives a user data request from a third-party service, and the user data request indicates what user data the third-party service requires.
  • the privacy protection application forwards the request to the user or its local client.
  • the forwarding operation can take the form of application notification, but is not limited to this notification form.
  • the privacy protection application receives the user's authorization for the user data request through a password.
  • the password owned by the user can take the form of including but not limited to numbers, letters, or a combination of numbers and letters, and the privacy protection application, third party Neither the service nor cloud storage can obtain the password information.
  • the privacy protection application sends authorization information to the third-party service to confirm to it that the user authorizes its data request.
  • the privacy protection application obtains the corresponding user data from the cloud storage under user authorization.
  • the user data obtained by the privacy protection application from the cloud storage may be user-encrypted, and the privacy protection application may obtain the encrypted user data from the cloud storage under the user's authorization to download and based on the user's download authorization To restore user data.
  • the privacy protection application encrypts the acquired user data through the third-party public key associated with the third-party service.
  • the privacy protection application transmits the encrypted user data to the third-party service for decryption and obtain the corresponding user data.
  • Fig. 7 shows a block diagram of another example of user privacy data protection according to another embodiment of the present disclosure.
  • the user 402 deploys a privacy protection application (App) 406 for proxying personal data or personal information on a local client.
  • the privacy protection application 406 includes a data model 410 from a third-party service 408, and the data model 410 is used to further process user data obtained from the cloud storage 404, so that the processed data is available but not visible to the third-party service 408 .
  • the privacy protection application 406 includes a rule (not shown) from the third-party service 408, and the user data is processed through the rule to generate processed data.
  • the privacy protection application 406 is used to proxy the user’s personal data, specifically to receive a data request from the third-party service 408 and forward the request to the user 402; to receive the user’s 402 authorization or approval of the request and to receive authorization information or Permission information is sent to a third-party service; in the case of user authorization, based on the data requirements indicated in the data request from the third service 408, download the corresponding user data from the cloud storage 404 and store it in the memory of the user's personal computing device Do not cache the data.
  • the user data downloaded from the cloud storage by the privacy protection application may be encrypted by the user, and the privacy protection application may obtain the encrypted user data from the cloud storage when the user authorizes the download and based on the user's download authorization To restore user data; process the restored user data downloaded from the cloud storage 404 according to the data query rules or data model 410 from the third-party service 408; encrypt the processed user data and transmit the encrypted user data to the third party Three-party services for decryption and use.
  • the user 402 stores his personal data or personal information in the cloud storage 404 associated with the privacy protection application 406 or other cloud storage designated by the user, instead of storing it on a server associated with a third-party service.
  • Cloud storage 404 includes, but is not limited to, Dianpan developed by Ant Financial and Facebook Cloud Storage developed by Facebook.
  • the user 402 can also store his personal data on the local client.
  • the user 402 has full control over the personal information or personal data stored in the cloud storage 404, that is, the user 402 can add, query, modify, or delete any personal information or data.
  • the user's control over his personal data is at least partially realized by a password or a password, and the privacy protection application 406, the third-party service 408, and the cloud storage 404 cannot obtain the password information. Additionally or alternatively, users can encrypt their user data stored in the cloud storage 404 to prevent any unauthorized use or sharing.
  • the third-party service 408 When a third-party service 408, that is, a service provided by a third-party merchant or enterprise, requires user data, the third-party service 408 sends a user data request to the privacy protection application 406, and the user data request indicates what user data the third-party service 408 needs.
  • the privacy protection application 406 After receiving the user data request from the third-party service 408, the privacy protection application 406 forwards the request to the user 402 or its local client.
  • the user 402 authorizes or approves the request or otherwise approves the request through the password or password that the user 402 possesses, so as to allow the third-party service 408 to perform processing on the personal information or personal data stored in the cloud storage 404 or on the local client. Inquire.
  • the privacy protection application 406 deployed on the client sends the authorization information to the third-party service 408, and when the user is authorized, the corresponding encrypted user data is obtained from the cloud storage 404 and stored in The data is not cached in the memory of the user's personal computing device. Additionally or alternatively, the user data obtained by the privacy protection application 406 from the cloud storage 404 may be encrypted by the user, and the privacy protection application 406 may obtain the encrypted user data from the cloud storage 404 when the user authorizes the download and base User’s download authorization to restore user data.
  • the privacy protection application 406 further processes the user data downloaded from the cloud storage 404 according to the data query rules or data model 410 received from the third-party service 408 to generate processed user data and use the public information provided by the third-party service 408.
  • the key is used to encrypt it, and then the encrypted user data is transmitted to the third-party service 408.
  • the third-party service 408 receives the encrypted user data and decrypts it with its private key to obtain processed user data or information.
  • the data model 410 provided by the third-party service 408 uses logistic regression to perform binary classification on user data. Specifically, the data model takes the user data (such as user age, income, occupation, etc.) obtained from the cloud storage 404 as its input, and calculates the corresponding result based on the data (such as whether the credit is high enough, etc.), and then As a result, instead of the user data itself, it is returned to the third-party service as processed data. Or when the privacy protection application receives data query rules (such as whether the user’s age is between 20 and 30 years old, etc.) from the third-party service 408, a determination result is obtained based on the query rules, that is, yes or no, and the result is Return to third-party services as processed data.
  • data query rules such as whether the user’s age is between 20 and 30 years old, etc.
  • the privacy protection application 406 enables the third-party service 408 to obtain the processed user data, that is, whether the user’s age is between 20-30 years old, rather than the actual age of the user, thereby realizing the user data to the third-party service Available but not visible, which further protects user privacy and enhances the privacy of user data.
  • the logistic regression model used in the data model 410 may also be combined with a gradient boosted decision tree (GBDT) and Newton method to further improve classification efficiency and performance.
  • GBDT gradient boosted decision tree
  • FIG. 8 shows a block diagram of secure multi-party computing according to an embodiment of the present disclosure.
  • the privacy protection application 406 includes a security sandbox 802, and the third-party service 408 deploys the multi-party computing model 804 to the privacy protection application 406 for use in the security sandbox 802 to retrieve data from the cloud storage 404.
  • MPC secure multi-party calculation
  • the privacy protection application 406 can distribute user data obtained from cloud storage to multiple locations.
  • the privacy protection application can distribute the acquired user data to cloud storage, local storage, and third-party storage.
  • the cloud storage may be the cloud storage 404 mentioned above
  • the local storage may be the user equipment where the privacy protection application 406 is located
  • the third-party storage may be any storage location or facility for storing data.
  • the above locations or facilities for storing user data are merely exemplary and not restrictive.
  • the privacy protection application 406 may classify the acquired user data.
  • user data can be divided into demographic data, asset data, and vehicle data. Then, the privacy protection application 406 can deploy these three types of data to the cloud storage, local storage, and third-party storage mentioned above in combination with the multi-party computing model.
  • the privacy protection application 406 can deploy more sensitive user asset data to storage with higher security, such as cloud storage.
  • the scope of the present disclosure is not limited to this, but the privacy protection application 406 is based on Corresponding privacy policy to implement specific data distribution. Thus, by distributing user data in different storage locations or storage facilities, the risk of user data leakage, especially sensitive data, is reduced.
  • the privacy protection application 406 may split each type of user data after classifying the user data ( For example, numerical value split), and then the split user data of the same type is deployed to different storage locations or storage facilities.
  • the privacy protection application 406 splits the most sensitive user asset data into three parts after dividing the acquired user data into demographic data, asset data, and vehicle data, such as dividing the user’s deposit data into 2 million Three parts, namely 1 million, 450,000, and 550,000, and store these three deposit data in cloud storage, local storage, and third-party storage (the three storage facilities are just examples and not limitations).
  • Other types of user data can also be split similarly, so each storage location or storage facility can store different types of incomplete user data instead of the same type of complete user data. Therefore, the complete user data cannot be known through any storage facility, thereby further improving the user privacy protection level of the privacy protection application 406.
  • any user data can be divided into any number of parts and deployed to different storage locations or storage facilities according to different user privacy policies.
  • user data deployed to various storage locations or storage facilities are encrypted and are in a secure sandbox environment when used.
  • the privacy protection application 406 After completing the distributed deployment of the data, the privacy protection application 406 performs secure calculations through a multi-party calculation model and according to corresponding rules, and the secure calculations are executed in a sandbox environment.
  • the multi-party calculation model may be a logistic regression (LR) model.
  • the third-party service may provide data query or calculation rules to the privacy protection application 406.
  • the data calculation rules can be scored for different types of user data, such as 1 point for deposits of 0-100 thousand, 2 points for 100,000-500,000, 3 points for 500,000-1 million, 4 points for 1 to 2 million, 200 Score 5 points above 10,000.
  • the data calculation rules can be used to score the value of real estate, such as 1 point for less than 1 million, 2 points for 1 to 3 million, 3 points for 3 to 5 million, 4 points for 5 to 8 million, and 5 for more than 8 million. Minute.
  • Data calculation rules can also score user demographic data, such as 1 point for those under 10 years old, 2 points for 10-18 years old, 3 points for 18-25 years old, 4 points for 25-35 years old, and 35 years old. Score 5 points above.
  • the data calculation rules can set different scoring standards according to the corresponding business requirements of the third-party service 408, and the scope of the present disclosure is not limited to any specific scoring standard or scoring value.
  • the privacy protection application 406 obtains the corresponding data from the corresponding data storage location or facility according to the corresponding query request provided by the third-party service 408, uses the logistic regression model and calculates the compliance based on the data query or calculation rules provided by the third-party service 408 The result of the demand for the third-party service 408.
  • the third-party service 408 if the third-party service 408 needs to know the user’s credit qualifications, the third-party service provides a corresponding data query request to the privacy protection application according to its own business rules.
  • the query request may indicate that the user needs to deposit and real estate Value, monthly income, and user age are scored and the score is requested.
  • the privacy protection application obtains corresponding encrypted user data according to the received data query request, and performs secure calculation on the obtained user data through a multi-party calculation model (for example, a logistic regression model) in a secure sandbox environment. Then, the privacy protection application encrypts the calculated result and transmits it to a third-party application, which decrypts the data after receiving the data and obtains the desired result.
  • the result can be based on the provided The total score calculated by data query or calculation rules.
  • the third-party application determines the user's credit qualification and corresponding limit based on the result. As a result, the privacy protection application based on secure multi-party computing realizes that sensitive data is available but not visible to third-party applications.
  • FIG. 9 shows a data flow diagram of another example for privacy data protection according to another embodiment of the present disclosure.
  • the user uses the privacy protection application 406 to store personal data or personal information in the cloud storage 404 associated with the privacy protection application 406 or other cloud storage designated by the user, instead of storing it on a server associated with a third-party service To avoid misuse of user data by third-party services.
  • users can encrypt their user data stored in cloud storage 404 to prevent any unauthorized use or sharing
  • the third-party service 408 sends a user data request to the privacy protection application 406.
  • the user data request indicates what data the third-party service needs.
  • the privacy protection application 406 after receiving the user data request from the third-party service 408, forwards the request to the user 402 or its local client.
  • the forwarding operation may take the form of application notification, but is not limited to this notification form.
  • the user 402 authorizes or approves the user data request via the privacy protection application 406 or otherwise approves the request through the password or password that the user 402 has, so as to allow the third-party service 408 to store it in the cloud storage 404 or locally. Inquire about personal information or personal data on the client.
  • the password possessed by the user may take a form including but not limited to numbers, letters, or a combination of numbers and letters, and the privacy protection application 406, the third-party service 408, and the cloud storage 404 cannot obtain the password information.
  • the privacy protection application 406 sends the authorization information to the third-party service 408 to confirm that the user authorizes his data request.
  • the privacy protection application 406 obtains the corresponding user data from the cloud storage 404 under user authorization, and based on the data received from the third-party service
  • the data model or data query rules further process the acquired user data to generate processed user data and encrypt it with the public key provided by the third-party service 408.
  • the third-party service 408 may deploy the multi-party calculation model to the privacy protection application 406 and make calculations based on the multi-party calculation model be performed in a security sandbox within the privacy protection application.
  • the secure calculation includes based on the query rules provided by the third-party service 408 and the user data provided by the privacy protection application.
  • the calculation result is provided through a data model such as logistic regression and sent to the third-party service.
  • Third-party services are available but not visible.
  • User data provided by privacy protection applications can be classified and deployed to different data storage facilities based on the category to reduce the risk of user data leakage.
  • the same type of user data can be split and the split of the same type of data can be deployed to different data storage facilities, so that no storage facility can know the complete user data. Further improve the privacy protection level or level of user data.
  • the user data obtained by the privacy protection application from the cloud storage may be user-encrypted, and the privacy protection application may obtain the encrypted user data from the cloud storage under the user's authorization to download and based on the user's download authorization To restore user data.
  • the privacy protection application 406 transmits the processed and encrypted user data to the third-party service 408.
  • the third-party service 408 can receive the encrypted user data and decrypt it with its private key to obtain the processed user data and combine it with the previously provided data model or data query rules to obtain the desired information.
  • FIG. 10 shows a flowchart of another example method 1000 for privacy data protection according to another embodiment of the present disclosure.
  • the privacy protection application deployed on the user's local client receives a user data request from a third-party service, and the user data request indicates what data the third-party service requires.
  • the privacy protection application forwards the request to the user or its local client.
  • the forwarding operation may take the form of application notification, but is not limited to this notification form.
  • the privacy protection application receives the user’s authorization for the user’s data request through a password.
  • the user’s password can take the form of including but not limited to numbers, letters, or a combination of numbers and letters, and the privacy protection application, third party Neither the service nor cloud storage can obtain the password information.
  • the privacy protection application sends authorization information to the third-party service to confirm to it that the user authorizes its data request.
  • the privacy protection application obtains corresponding user data from cloud storage under user authorization.
  • the user data obtained by the privacy protection application from the cloud storage may be user-encrypted, and the privacy protection application may obtain the encrypted user data from the cloud storage under the user's authorization to download and based on the user's download authorization To restore user data
  • the privacy protection application further processes the acquired user data based on user data query rules or data models provided by the third-party service to generate processed user data.
  • the privacy protection application encrypts the processed user data through the third-party public key associated with the third-party service.
  • the privacy protection application transmits the processed and encrypted user data to the third-party service for decryption and access to the processed user data.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • General Engineering & Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Computing Systems (AREA)
  • Storage Device Security (AREA)

Abstract

本公开涉及用户信息的隐私保护。本公开提供了一种用户隐私保护方法，该方法包括从第三方服务接收用户数据请求；从用户接收对该用户数据请求的授权；从云存储中获取用户数据；通过与第三方服务相关联的第三方公钥来对所获取的用户数据进行加密；以及将经加密的用户数据传送到第三方服务以供其解密并获取该用户数据。

Description

一种基于安全计算的个人数据服务方法和*** 技术领域
本公开涉及隐私数据保护和处理，尤其涉及用于基于安全计算的个人数据服务方法和***。
背景技术
互联网应用越来越多地渗透进人们的日常生活中，特别是移动互联网的发展形成了全民上网的大趋势，人们的日常习惯正在改变，开始习惯于通过网络方便地处理许多日常事务，诸如购物、缴费、支付等等。由此，在互联网时代，对用户隐私信息的保护显得极其重要。
当前，对诸如证件号码、证件照片、财务数据等敏感的用户数据加以保护的需求正在不断上升，无论此类数据位于何处均是如此。现今，商家或企业会对收集到的用户数据进行大数据分析以用于推荐广告，甚至将用户隐私数据转卖给第三方，从而导致用户遭受电话骚扰等不良后果。
另外，用户的隐私数据通常被存储在企业或商家的自有服务器处，由于绝大部分企业并非是专业的IT公司，因此对其服务器的安全防护级别通常比较薄弱，这为个体黑客对用户隐私数据的恶意侵入和盗取提供了便利。鉴于一系列众所周知且代价惨重的数据盗窃案为受害企业造成的重大法律责任及负面报道，针对此类袭击的防护措施和手段正在快速地变得成熟先进，但攻击者同样也在步步紧逼。
本公开的各实施例正是针对这些技术问题而做出的。而且，尽管讨论了相对具体的问题，但是应当理解，各实施例不应被限于解决本背景技术中所标识的具体问题。
发明内容
提供本公开内容来以简化形式介绍将在以下具体实施方式部分中进一步描述的一些概念。本公开内容并不旨在标识出所要求保护的主题的关键特征或必要特征，也不旨在用于帮助确定所要求保护的主题的范围。
针对本领域中的用户信息或用户数据的隐私保护问题，本公开提供了一种用户隐私保护方案。该技术方案针对现有技术中的用户隐私数据大都被存储在商家或企业自有的 服务器上的缺陷。
一般而言，在本公开的这一方案中，用户在本地的客户端上部署用于代理个人数据或个人信息的隐私保护应用(App)，并且该用户通过该隐私保护应用将其个人数据或个人信息存储在与该应用相关联的云存储或者用户自己指定的其它云存储中，而不是存储在与第三方商家或企业相关联的服务器上。用户对云存储中的个人信息或个人数据具有完全控制权，即用户可添加、查询、更改、删除任何个人信息或数据。用户可以对其存储在云存储中的个人数据进行加密并防止任何非授权使用或共享。
当第三方商家或企业请求用户数据时，用户通过其拥有的口令或密码来授权该第三方商家或企业对其存储在云存储中的个人信息或个人数据进行查询，并且用户授权客户端上所部署的隐私保护应用从云存储中获取相应用户数据。所获取的用户数据可以是经用户加密的，并且该隐私保护应用基于用户授权来解密所获取的用户数据并将经解密的用户数据存储在用户设备的内存中，而不缓存该用户数据，随后用第三方商家提供的公钥来加密存储在内存中的用户数据，然后将经加密的用户数据传送至第三方商家。第三方商家接收该经加密的用户数据并用其私钥对其进行解密以获得用户数据或信息。
由此，相比于现有技术，用户具有对其个人信息或个人数据的完全控制权，第三方商家无法肆无忌惮地搜集用户数据以用于其商业目的，从而能够避免很多隐私泄露问题。
本公开还公开了一种保护用户隐私的进阶方案。在该技术方案中，除了用户具有对其个人信息或个人数据的完全控制权这一优点外，还在向第三方商家传送经加密的用户数据之前通过该第三方商家提供的数据模型或规则对用户数据进行进一步处理以输出经处理的用户数据，以使得第三方商家在解密后也无法获悉用户数据的明细，只能基于所提供的模型或规则来使用该用户数据，从而进一步保护了用户隐私。
在本公开的一方面，提供了一种用于隐私数据保护的方法。该方法包括：
从第三方服务接收用户数据请求；
从用户接收对该用户数据请求的授权；
从云存储中获取用户数据；
通过与第三方服务相关联的第三方公钥来对所获取的用户数据进行加密；以及
将经加密的用户数据传送到第三方服务以供其解密并获取该用户数据。
在本公开的另一方面，提供了一种用于隐私数据保护的***，该***包括：
用于从第三方服务接收用户数据请求的装置；
用于从用户接收对该用户数据请求的授权的装置；
用于从云存储中获取用户数据的装置；
用于通过与第三方服务相关联的第三方公钥来对所获取的用户数据进行加密的装置；以及
用于将经加密的用户数据传送到第三方服务以供其解密并获取该用户数据的装置。
在本公开的另一方面，提供了另一种用于隐私数据保护的方法。该方法包括：
从第三方服务接收用户数据请求；
从用户接收对该用户数据请求的授权；
从云存储中获取用户数据；
通过第三方服务提供的数据模型或规则来处理所获取的用户数据；
通过与第三方服务相关联的第三方公钥来对经处理的用户数据进行加密；以及
将经处理且经加密的用户数据传送到第三方服务以供其解密并获取经处理的用户数据。
在本公开的另一方面，提供了另一种用于隐私数据保护的***，该***包括：
用于从第三方服务接收用户数据请求的装置；
用于从用户接收对该用户数据请求的授权的装置；
用于从云存储中获取用户数据的装置；
用于通过第三方服务提供的数据模型或规则来处理所获取的用户数据的装置；
用于通过与第三方服务相关联的第三方公钥来对经处理的用户数据进行加密的装置；以及
用于将经处理且经加密的用户数据传送到第三方服务以供其解密并获取经处理的用户数据的装置。
本公开的各方面一般包括如基本上在本文参照附图所描述并且通过附图所阐示的方法、装置、***、计算机程序产品。
在结合附图研读了下文对本公开的具体示例性实施例的描述之后，本公开的其他方 面、特征和实施例对于本领域普通技术人员将是明显的。尽管本公开的特征在以下可能是针对某些实施例和附图来讨论的，但本公开的全部实施例可包括本文所讨论的有利特征中的一个或多个。换言之，尽管可能讨论了一个或多个实施例具有某些有利特征，但也可以根据本文讨论的本公开的各种实施例使用此类特征中的一个或多个特征。以类似方式，尽管示例性实施例在下文可能是作为设备、***或方法实施例进行讨论的，但是应当领会，此类示例性实施例可以在各种设备、***、和方法中实现。
附图说明
为了能详细理解本公开的以上陈述的特征所用的方式，可参照各方面来对以上简要概述的内容进行更具体的描述，其中一些方面在附图中阐示。然而应该注意，附图仅解说了本公开的某些典型方面，故不应被认为限定其范围，因为本描述可允许有其他等同有效的方面。
图1、2A、2B和3示出了其中可实施本公开的各实施例的各种操作环境。
图4示出了根据本公开的一个实施例的用户隐私数据保护的一个示例的框图。
图5示出了根据本公开的一个实施例的用于隐私数据保护的一个示例的数据流图。
图6示出了根据本公开的一个实施例的用于隐私数据保护的示例方法的流程图。
图7示出了根据本公开的另一个实施例的用户隐私数据保护的另一个示例的框图。
图8示出了根据本公开的一个实施例的安全多方计算的框图。
图9示出了根据本公开的另一个实施例的用于隐私数据保护的另一个示例的数据流图。
图10示出了根据本公开的另一个实施例的用于隐私数据保护的另一示例方法的流程图。
具体实施方式
以下将参考形成本公开一部分并示出各具体示例性实施例的附图更详尽地描述各个实施例。然而，各实施例可以以许多不同的形式来实现，并且不应将其解释为限制此处所阐述的各实施例；相反地，提供这些实施例以使得本公开变得透彻和完整，并且将这些实施例的范围完全传达给本领域普通技术人员。各实施例可按照方法、***或设备来 实施。因此，这些实施例可采用硬件实现形式、全软件实现形式或者结合软件和硬件方面的实现形式。因此，以下具体实施方式并非是局限性的。
图1、2A、2B、3及相关联的描述提供了其中可实施本公开的各实施例的各种操作环境的讨论。然而，关于图1-3所示出和讨论的设备和***是用于示例和说明的目的，而非对可被用于实施本文所述的本公开的各实施例的大量计算设备配置的限制。
图1是示出可用来实施本公开的各实施例的台式计算设备100的示例物理组件的框图。以下描述的计算设备组件可适用于上述计算设备。在一基本配置中，台式计算设备100可以包括至少一个处理单元102和***存储器104。取决于计算设备的配置和类型，***存储器104可以包括，但不限于，易失性存储器(例如，随机存取存储器(RAM))、非易失性存储器(例如，只读存储器(ROM))、闪存或任何组合。***存储器104可以包括操作***105、一个或多个编程模块106，且可以包括web浏览器应用120。例如，操作***105可适用于控制台式计算设备100的操作。在一个实施例中，编程模块106可包括安装在台式计算设备100上的隐私保护应用26。此外，本公开的各实施方式可以结合图形库、其他操作***、或任何其他应用程序来实践，且不限于任何特定应用程序或***。该基本配置在图1中由虚线108内的那些组件示出。
台式计算设备100可具有附加特征或功能。例如，台式计算设备100还可包括附加数据存储设备(可移动和/或不可移动)，诸如例如，磁盘、光盘、或磁带。这些附加存储由可移动存储109和不可移动存储110示出。
如上所述，可以在***存储器104中存储包括操作***105在内的多个程序模块和数据文件。当在处理单元102上执行时，程序模块106可执行各个过程，包括与如下所述的方法有关的操作。下述过程是示例，且处理单元102可执行其他过程。根据本公开的各实施方式可以使用的其他程序模块可以包括电子邮件和联系人应用、字处理应用、电子数据表应用、数据库应用、幻灯片演示应用、绘图或计算机辅助应用程序等。
一般而言，根据本公开的各实施方式，程序模块可以包括可以执行特定任务或可以实现特定抽象数据类型的例程、程序、组件、数据结构和其他类型的结构。此外，本公开的各实施方式可用其他计算机***配置来实践，包括手持式设备、多处理器***、基于微处理器的***或可编程消费电子产品、小型机、大型计算机等。本公开的各实施方式也可以在其中任务由通过通信网络链接的远程处理设备执行的分布式计算环境中实现。在分布式计算环境中，程序模块可位于本地和远程存储器存储设备两者中。
此外，本公开的各实施方式可在包括分立电子元件的电路、包含逻辑门的封装或集成电子芯片、利用微处理器的电路、或在包含电子元件或微处理器的单个芯片上实现。例如，可以通过片上***(SOC)来实施本公开的各实施例，其中，可以将图1中示出的每个或许多组件集成到单个集成电路上。这样的SOC设备可包括一个或多个处理单元、图形单元、通信单元、***虚拟化单元以及各种应用功能，所有这些都被集成到(或“烧录到”)芯片基板上作为单个集成电路。当通过SOC操作时，在此所述的关于管理器26的功能可以通过与计算设备/***100的其他组件一起集成在单个集成电路(芯片)上的应用专用逻辑来操作。本公开的各实施方式还可以使用能够执行诸如，例如，AND(与)、OR(或)和NOT(非)等逻辑运算的其他技术来实践，包括但不限于，机械、光学、流体和量子技术。另外，本公开的各实施方式可以在通用计算机或任何其他电路或***中实现。
例如，本公开的各实施方式可被实现为计算机进程(方法)、计算***或诸如计算机程序产品或计算机可读介质等制品。计算机程序产品可以是计算机***可读并编码了用于执行计算机进程的指令的计算机程序的计算机存储介质。
如这里所使用的术语计算机可读介质可以包括计算机存储介质。计算机存储介质可包括以用于存储诸如计算机可读指令、数据结构、程序模块、或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。***存储器104、可移动存储109和不可移动存储110都是计算机存储介质(即，存储器存储)的示例。计算机存储介质可以包括，但不限于，RAM、ROM、电可擦除只读存储器(EEPROM)、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光存储、磁带盒、磁带、磁盘存储或其他磁性存储设备、或可用于存储信息且可以由台式计算设备100访问的任何其他介质。任何这样的计算机存储介质都可以是设备100的一部分。台式计算设备100还可以具有输入设备112，如键盘、鼠标、笔、声音输入设备、触摸输入设备等。还可包括诸如显示器、扬声器、打印机等输出设备114。上述设备是示例且可以使用其他设备。
相机和/或某种其他传感设备可操作来记录一个或多个用户以及捕捉计算设备的用户作出的运动和/或姿势。传感设备还可操作来捕捉诸如通过话筒口述的单词和/或捕捉来自用户的诸如通过键盘和/或鼠标(未描绘)的其他输入。传感设备可包括能够检测用户的移动的任何运动检测设备。
如这里所使用的术语计算机可读介质还包括通信介质。通信介质由诸如载波或其他 传输机制等已调制数据信号中的计算机可读指令、数据结构、程序模块或其他数据来体现，并包括任何信息传递介质。术语“已调制数据信号”可以描述以对该信号中的信息进行编码的方式设定或者改变其一个或多个特征的信号。作为示例而非限制，通信介质包括诸如有线网络或直接线连接等有线介质，以及诸如声学、射频(RF)、红外线和其他无线介质等无线介质。
图2A和2B示出可用来实施本公开的各实施例的合适的移动计算环境，例如移动电话、智能电话、输入板个人计算机、膝上型计算机等。参考图2A，示出了用于实现各实施例的示例移动计算设备200。在一基本配置中，移动计算设备200是具有输入元件和输出元件两者的手持式计算机。输入元件可包括允许用户将信息输入到移动计算设备200中的触摸屏显示器205和输入按钮210。移动计算设备200还可结合允许进一步的用户输入的可选的侧面输入元件215。可选的侧面输入元件215可以是旋转开关、按钮、或任何其他类型的手动输入元件。在替代实施例中，移动计算设备200可结合更多或更少的输入元件。例如，在某些实施例中，显示器205可以不是触摸屏。在又一替代实施例中，移动计算设备是便携式电话***，如具有显示器205和输入按钮210的蜂窝电话。移动计算设备200还可包括可选的小键盘235。可选的小键盘235可以是物理小键盘或者在触摸屏显示器上生成的“软”小键盘。
移动计算设备200结合输出元件，如可显示图形用户界面(GUI)的显示器205。其他输出元件包括扬声器225和LED 220。另外，移动计算设备200可包含振动模块(未示出)，该振动模块使得移动计算设备200振动以将事件通知给用户。在又一实施例中，移动计算设备200可结合耳机插孔(未示出)，用于提供另一手段来提供输出信号。
尽管此处组合移动计算设备200来描述，但在替代实施例中，本公开还可组合任何数量的计算机***来被使用，如在台式环境中、膝上型或笔记本计算机***、多处理器***、基于微处理器或可编程消费电子产品、网络PC、小型计算机、大型计算机等。本公开的实施例也可在分布式计算环境中实践，其中任务由分布式计算环境中通过通信网络链接的远程处理设备来执行；程序可位于本机和远程存储器存储设备中。总而言之，具有多个环境传感器、向用户提供通知的多个输出元件和多个通知事件类型的任何计算机***可结合本公开的实施例。
图2B是示出在一个实施例中使用的诸如图2A中所示的计算设备之类的移动计算设备的组件的框图。即，移动计算设备200可结合***202以实现某些实施例。例如，***202可被用于实现可运行与台式或笔记本计算机的应用类似的一个或多个应用的“智 能电话”，这些应用例如演示文稿应用、浏览器、电子邮件、日程安排、即时消息收发、以及媒体播放器应用。在某些实施例中，***202被集成为计算设备，诸如集成的个人数字助理(PDA)和无线电话。
一个或多个应用266可被加载到存储器262中并在操作***264上或与操作***264相关联地运行。应用程序的示例包括电话拨号程序、电子邮件程序、PIM(个人信息管理)程序、文字处理程序、电子表格程序、因特网浏览器程序、消息通信程序等等。***202还包括存储器268内的非易失性存储262。非易失性存储268可被用于存储在***202断电时不会丢失的持久信息。应用266可使用信息并将信息存储在非易失性存储268中，如电子邮件应用使用的电子邮件或其他消息等。同步应用(未示出)也可驻留在***202上并被编程为与驻留在主机计算机上的对应同步应用进行交互，以保持存储在非易失性存储268中的信息与存储在主机计算机上的对应信息相同步。如应被理解的，其他应用可被加载到存储器262中且在设备200上运行，包括隐私保护应用26。
***202具有可被实现为一个或多个电池的电源270。电源270还可包括外部功率源，如补充电池或对电池重新充电的AC适配器或加电对接托架。
***202还可包括执行发射和接收无线电频率通信的功能的无线电272。无线电272通过通信运营商或服务供应商方便了***202与“外部世界”之间的无线连接。来往无线电272的传输是在操作***264的控制下进行的。换言之，无线电272接收的通信可通过操作***264传播到应用266，反之亦然。
无线电272允许***202例如通过网络与其他计算设备通信。无线电272是通信介质的一个示例。通信介质由诸如载波或其他传输机制等已调制数据信号中的计算机可读指令、数据结构、程序模块或其他数据来体现，并包括任何信息传递介质。术语“已调制数据信号”是指使得以在信号中编码信息的方式来设置或改变其一个或多个特性的信号。作为示例而非限制，通信介质包括诸如有线网络或直接线连接之类的有线介质，以及诸如声学、RF、红外及其他无线介质之类的无线介质。如此处所使用的术语计算机可读介质包括存储介质和通信介质两者。
***202的该实施例是以两种类型的通知输出设备来示出的：可被用于提供视觉通知的LED 220，以及可被用于扬声器225提供音频通知的音频接口274。这些设备可直接耦合到电源270，使得当被激活时，即使为了节省电池功率而可能关闭处理器260和其他组件，它们也在一段由通知机制指示的持续时间保持通电。LED 220可被编程为无限地保持通电，直到用户采取行动指示该设备的通电状态。音频接口274用于向用户提 供听觉信号并从用户接收听觉信号。例如，除被耦合到扬声器225以外，音频接口274还可被耦合到话筒以接收听觉输入，诸如便于电话对话。根据各本公开的各实施例，话筒也可充当音频传感器来便于对通知的控制，如下文将描述的。***202可进一步包括允许板载相机230的操作来记录静止图像、视频流等的视频接口276。
移动计算设备实现***202可具有附加特征或功能。例如，该设备还可包括附加数据存储设备(可移动的/或不可移动的)，诸如磁盘、光盘或磁带。此类附加存储在图2B中由存储268示出。计算机存储介质可包括以用于存储诸如计算机可读指令、数据结构、程序模块、或其他数据等信息的任何方法或技术实现的易失性和非易失性、可移动和不可移动介质。
设备200生成或捕捉的且经***202存储的数据/信息可如上所述本地存储在设备200上，或数据可被存储在可由设备通过无线电272或通过设备200和与设备200相关联的分开的计算设备之间的有线连接访问的任何数量的存储介质上，该分开的计算设备如例如因特网之类的分布式计算网络中的服务器计算机。如应理解的，此类数据/信息可经设备200、经无线电272或经分布式计算网络来被访问。类似地，这些数据/信息可根据已知的数据/信息传送和存储手段来容易地在计算设备之间传送以存储和使用，这些手段包括电子邮件和协作数据/信息共享***。
图3示出了其中可实现本公开的各实施例的联网环境。第三方服务312可包括但不限于目录服务322、web门户服务324、邮箱服务326、即时消息收发服务328以及社交网络服务330。服务器332可提供与如本文描述的方法有关的通信和服务。第三方服务312可通过服务器332和网络308来在web上与各计算设备通信。可利用服务器332的计算设备的示例包括台式计算设备302(该台式计算设备可包括任何通用个人计算机)、平板计算设备304和/或可包括智能电话的移动计算设备306。各计算设备，具体而言是各计算设备中的隐私保护应用可以在用户授权的情况下从云存储310获得用户信息并将其加密传送至第三方服务312。第三方服务312对接收到的加密用户信息进行解密并将其存储在存储316中。
图4示出了根据本公开的一个实施例的用户隐私数据保护的一个示例的框图。在该示例中，用户402在本地的客户端上部署用于代理个人数据或个人信息的隐私保护应用(App)406。本文描述的“客户端”可以指代用户的个人计算设备，包括台式计算设备(诸如台式计算机、膝上型计算机、智能电视机等)、平板计算设备(诸如iPad)以及移动计算设备(诸如智能手机)。本文描述的“隐私保护应用”可以指代用户从各种应 用市场下载并安装在本地客户端上的应用，包括但不限于由蚂蚁金服公司开发的支付宝等。
该隐私保护应用406用于代理用户的个人数据，具体而言用于接收第三方服务的数据请求并将该请求转发给用户402；接收用户402对该请求的授权或批准并将授权信息或权限信息发送给第三方服务；基于用户授权从云存储下载所请求的用户数据并将其存储在内存中而不是缓存该数据。附加地或替换地，隐私保护应用406从云存储404获取的用户数据可以是经用户加密的，并且隐私保护应用406可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数据；使用第三方服务提供的公钥对内存中的用户数据进行加密；将加密的用户数据传送到第三方服务以供其解密和使用。
用户402使用隐私保护应用406将其个人数据或个人信息存储在与该隐私保护应用406相关联的云存储404或者用户自己指定的其他云存储中，而不是存储在与第三方服务相关联的服务器上。云存储404包括但不限于由蚂蚁金服开发的钉盘以及由阿里巴巴公司开发的阿里云存储。另外，用户402也可以将其个人数据存储在本地客户端上。
用户402对云存储404中所存储的个人信息或个人数据具有完全控制权，即用户402可添加、查询、更改、删除任何个人信息或数据。用户对其个人数据的控制权至少部分地通过口令或密码来实现并且隐私保护应用406、第三方服务408和云存储404都无法获取该密码信息。而且，用户402可以对其存储在云存储404中的用户数据进行加密以防止任何非授权使用或分享。
当第三方服务408，即第三方商家或企业提供的服务需要用户数据时，该第三方服务408向隐私保护应用406发送用户数据请求，该用户数据请求包括该第三方服务408需要什么用户数据的指示。隐私保护应用406在接收到来自第三方服务408的用户数据请求后将该请求转发通知给用户402或其本地客户端。用户402通过其拥有的口令或密码来对该请求进行授权或批准或以其他方式准许该请求，以准许第三方服务408对其存储在云存储404或本地客户端上的个人信息或个人数据进行查询。在用户授权后，客户端上所部署的隐私保护应用406将授权信息发送到第三方服务408，并且在用户授权的情况下从云存储404中获取相应用户数据并将其存储在用户的个人计算设备的(易失性)内存中，而不缓存该数据，并且使用第三方服务408提供的公钥对其加密，然后将经加密的用户数据传送至第三方服务408。第三方服务408接收该经加密的用户数据并且使用其私钥来对其进行解密以获得用户数据或信息。
图5示出了根据本公开的一个实施例的用于隐私数据保护的一个示例的数据流图。
在502，用户使用隐私保护应用406来将个人数据或个人信息存储在与该隐私保护应用406相关联的云存储404或者用户自己指定的其他云存储中，而不是存储在与第三方服务相关联的服务器上，以避免第三方服务对用户数据的滥用。
在504，当第三方服务408需要用户数据时，该第三方服务408向隐私保护应用406发送用户数据请求。该请求指示第三方服务408需要什么用户数据。
在506，隐私保护应用406在接收到来自第三方服务408的用户数据请求后将该请求转发给用户402或其本地客户端。该转发操作可采取应用通知的形式，但不限于该通知形式。
在508，用户402通过其拥有的口令或密码来经由隐私保护应用406对该用户数据请求进行授权或批准或者以其他形式准许该数据请求，以准许第三方服务408对其存储在云存储404或本地客户端上的个人信息或个人数据进行查询。用户拥有的密码可采取包括但不限于数字、或字母、或数字与字母的组合的形式，并且隐私保护应用406、第三方服务408和云存储404都无法获取该密码信息。
在510，在用户授权后，隐私保护应用406将授权信息发送到第三方服务408，以向其确认用户授权其数据请求。
在512，基于第三方服务408所发送的用户数据请求中所指示的该第三方服务需要什么用户数据，隐私保护应用406在用户授权的情况下从云存储404中获取相应用户数据并对其加密。附加地或替换地，隐私保护应用从云存储获取的用户数据可以是经用户加密的，并且隐私保护应用可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数据。
然后在514将经加密的用户数据传送至第三方服务408。该加密操作可通过与第三方服务408相关联的第三方公钥来完成。
然后，第三方服务408可接收到经加密的用户数据并对其解密以获取相应用户数据。
图6示出了根据本公开的一个实施例的用于隐私数据保护的示例方法600的流程图。
在框602，部署在用户本地客户端上的隐私保护应用从第三方服务接收用户数据请求，该用户数据请求指示该第三方服务需要什么用户数据。
在框604，隐私保护应用将该请求转发给用户或其本地客户端。该转发操作可采取 应用通知的形式，但不限于该通知形式。
在框606，隐私保护应用接收用户通过密码对该用户数据请求的授权，用户拥有的密码可采取包括但不限于数字、或字母、或数字与字母的组合的形式，并且隐私保护应用、第三方服务和云存储都无法获取该密码信息。
在框608，隐私保护应用将授权信息发送到第三方服务，以向其确认用户授权其数据请求。
在框610，基于第三方服务所发送的用户数据请求中的该第三方服务需要什么用户数据的指示，隐私保护应用在用户授权的情况下从云存储中获取相应用户数据。附加地或替换地，隐私保护应用从云存储获取的用户数据可以是经用户加密的，并且隐私保护应用可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数据。
在框612，隐私保护应用通过与第三方服务相关联的第三方公钥来对所获取的用户数据进行加密。
在框614，隐私保护应用将经加密的用户数据传送到第三方服务以供其解密并获取该相应用户数据。
图7示出了根据本公开的另一个实施例的用户隐私数据保护的另一个示例的框图。
在该示例中，用户402在本地的客户端上部署用于代理个人数据或个人信息的隐私保护应用(App)406。该隐私保护应用406包括来自第三方服务408的数据模型410，该数据模型410用于对从云存储404获取的用户数据进行进一步处理，以使得经处理的数据对第三方服务408可用但不可见。或者，隐私保护应用406包括来自第三方服务408的规则(未示出)，并且通过该规则来处理用户数据以产生经处理的数据。
该隐私保护应用406用于代理用户的个人数据，具体而言用于接收第三方服务408的数据请求并将该请求转发给用户402；接收用户402对该请求的授权或批准并将授权信息或权限信息发送给第三方服务；在用户授权的情况下基于来自第三服务408的数据请求中所指示的数据需求来从云存储404下载相应的用户数据并将其存储在用户个人计算设备的内存中而不缓存该数据。附加地或替换地，隐私保护应用从云存储下载的用户数据可以是经用户加密的，并且隐私保护应用可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数据；根据来自第三方服务408的数据查询规则或数据模型410来处理从云存储404下载的经还原的用户数据；对经处 理的用户数据进行加密并将加密的用户数据传送到第三方服务以供其解密和使用。
用户402将其个人数据或个人信息存储在与该隐私保护应用406相关联的云存储404或者用户指定的其他云存储中，而不是存储在与第三方服务相关联的服务器上。云存储404包括但不限于由蚂蚁金服开发的盯盘以及由阿里巴巴公司开发的阿里云存储。另外，用户402也可以将其个人数据存储在本地客户端上。
用户402对云存储404中所存储的个人信息或个人数据具有完全控制权，即用户402可添加、查询、更改、删除任何个人信息或数据。用户对其个人数据的控制权至少部分地通过口令或密码来实现并且隐私保护应用406、第三方服务408和云存储404都无法获取该密码信息。附加地或替换地，用户可以加密其存储在云存储404中的用户数据以防止任何非授权使用或分享。
当第三方服务408，即第三方商家或企业提供的服务需要用户数据时，该第三方服务408向隐私保护应用406发送用户数据请求，该用户数据请求指示第三方服务408需要什么用户数据。隐私保护应用406在接收到来自第三方服务408的用户数据请求后将该请求转发通知给用户402或其本地客户端。用户402通过其拥有的口令或密码来对该请求进行授权或批准或者以其他方式准许该请求，以准许第三方服务408对其存储在云存储404或本地客户端上的个人信息或个人数据进行查询。在用户授权后，客户端上所部署的隐私保护应用406将授权信息发送到第三方服务408，并且在用户授权的情况下从云存储404中获取相应的经加密的用户数据并将其存储在用户的个人计算设备的内存中，而不是缓存该数据。附加地或替换地，隐私保护应用406从云存储404获取的用户数据可以是经用户加密的，并且隐私保护应用406可以在用户授权下载的情况下从云存储404获取经加密的用户数据并基于用户的下载授权来还原用户数据。然后，隐私保护应用406根据从第三方服务408接收到的数据查询规则或者数据模型410来对从云存储404下载的用户数据进行进一步处理以产生经处理的用户数据并用第三方服务408提供的公钥来对其加密，随后将经加密的用户数据传送至第三方服务408。第三方服务408接收该经加密的用户数据并用其私钥对其进行解密以获得经处理的用户数据或信息。
在本公开的一个实施例中，第三方服务408提供的数据模型410使用逻辑回归来对用户数据进行二元分类。具体而言，数据模型将从云存储404获取的用户数据(诸如用户年龄、收入、职业等数据)作为其输入，并基于该数据计算出相应的结果(诸如是否信用足够高等)，然后将该结果，而不是用户数据本身，作为经处理的数据返回给第三方服务。或者当隐私保护应用从第三方服务408接收到数据查询规则(诸如用户的 年龄是否在20到30岁之间等)时，基于该查询规则得出判定结果，即是或否，并将该结果作为经处理的数据返回给第三方服务。由此，隐私保护应用406使得第三方服务408将获得经处理的用户数据，即用户年龄是否在20-30岁之间的判定，而非用户实际年龄，从而实现了用户数据对第三方服务的可用但不可见，进一步保护了用户隐私，提升了用户数据的私密性。
在本公开的另一实施例中，数据模型410中所使用的逻辑回归模型还可结合梯度提升决策树(GBDT)和牛顿法，以进一步提升分类效率和性能。
图8示出了根据本公开的一个实施例的安全多方计算的框图。
在本公开的这一实施例中，隐私保护应用406包括安全沙箱802，第三方服务408将多方计算模型804部署到隐私保护应用406以用于在安全沙箱802中对从云存储404获取的用户数据进行安全多方计算(MPC)，以使得计算出的数据对第三方服务408可用但不可见。
具体而言，通过该多方计算模型，隐私保护应用406可将从云存储中获取的用户数据分布到多个地点。在本公开的一个实施例中，隐私保护应用可将所获取的用户数据分布到云端存储、本地存储、以及第三方存储。例如，云端存储可以是上文中提及的云存储404，本地存储可以是隐私保护应用406所在的用户设备，第三方存储可以是用于存储数据的任何存储地点或设施。如本领域技术人员可以理解的，以上用于存储用户数据的地点或设施仅仅是示例性的，而非限制性的。
在本公开的一个实施例中，隐私保护应用406可以对所获取的用户数据进行分类。作为示例而非限制，可将用户数据分成人口统计数据、资产数据和车辆数据。然后，隐私保护应用406可结合多方计算模型将这三类数据分别部署到上文提及的云端存储、本地存储、以及第三方存储。在本公开的一个实施例中，隐私保护应用406可将较为敏感的用户资产数据部署到安全性较高的存储，例如云端存储，但本公开的范围不限于此，而是隐私保护应用406根据相应的隐私政策来执行的具体的数据分布。由此，通过将用户数据分布在不同的存储地点或存储设施，降低了用户数据泄露的风险，尤其是敏感数据。
在本发明的另一实施例中，为了实现更高级别的安全性并取得更高水平的用户隐私保护，隐私保护应用406可以在对用户数据进行分类后对每一类用户数据进行拆分(例如，数值拆分)，然后将经拆分的同一类用户数据分别部署到不同的存储地点或存 储设施。
作为示例而非限制，隐私保护应用406在将所获取的用户数据分成人口统计数据、资产数据和车辆数据后将最敏感的用户资产数据拆分成三部分，例如将用户的存款数据200万分成三部分，即100万、45万、和55万，并将这三个存款数据分别存储在云端存储、本地存储、以及第三方存储(这三个存储设施仅仅是示例而非限制)中。其他类型的用户数据也可进行类似拆分，因此每个存储地点或存储设施可存储不同种类的不完整用户数据，而不是同一类型的完整用户数据。由此，无法通过任何一个存储设施来知晓完整的用户数据，由此进一步提升了隐私保护应用406的用户隐私保护级别。
如本领域技术人员容易理解的，可根据不同的用户隐私政策来将任何用户数据分成任何数量的各个部分并将其部署到不同的存储地点或存储设施。而且，被部署到各个存储地点或存储设施的用户数据都是加密的并且在被使用时都处于安全沙箱环境中。
在完成数据的分布式部署后，隐私保护应用406通过多方计算模型并根据相应的规则来进行安全计算，该安全计算在沙箱环境中执行。在本公开的一个实施例中，作为示例而非限制，多方计算模型可以是逻辑回归(LR)模型。在该实施例中，第三方服务可以向隐私保护应用406提供数据查询或计算规则。
数据计算规则可以针对不同类型的用户数据进行打分，如存款在0-10万的打1分、10-50万打2分、50-100万打3分、100-200万打4分、200万以上打5分。同理，数据计算规则可以对房产价值进行打分，如100万以下打1分、100-300万打2分、300-500万打3分、500-800万打4分、800万以上打5分。数据计算规则还可以对用户的人口统计数据进行打分，例如年龄在10岁以下打1分、10-18岁打2分、18-25岁打3分、25-35岁打4分、35岁以上打5分。如本领域技术人员可以理解的，数据计算规则可根据第三方服务408的相应业务需求来设置不同的评分标准，且本公开的范围不限于任何特定评分标准或打分数值。
然后，隐私保护应用406根据第三方服务408提供的相应查询请求从相应的数据存储地点或设施获取相应的数据，使用逻辑回归模型并基于第三方服务408提供的数据查询或计算规则来计算出符合第三方服务408的需求的结果。
作为示例而非限制，如果第三方服务408需要知晓用户的授信资质如何，该第三方服务根据自己的业务规则向隐私保护应用提供相应的数据查询请求，该查询请求可指示需要对用户存款、房产价值、月收入和用户年龄进行打分并请求返回分值。
隐私保护应用根据接收到的数据查询请求来获取相应的加密用户数据，并在安全沙箱环境中通过多方计算模型(例如，逻辑回归模型)对所获取的用户数据进行安全计算。然后，隐私保护应用将计算出的结果加密传送至第三方应用，该第三方应用在接收到数据后对其解密并得到想要的结果，作为示例而非限制，该结果可以是基于所提供的数据查询或计算规则计算出的总分值。第三方应用基于该结果来确定用户的授信资格和相应额度。由此，通过隐私保护应用基于安全多方计算实现了敏感数据对第三方应用的可用但不可见。
图9示出了根据本公开的另一个实施例的用于隐私数据保护的另一个示例的数据流图。
在902，用户使用隐私保护应用406将个人数据或个人信息存储在与该隐私保护应用406相关联的云存储404或者用户指定的其他云存储中，而不是存储在与第三方服务相关联的服务器上，以避免第三方服务对用户数据的滥用。另外，用户可以加密其存储在云存储404中的用户数据以防止任何非授权使用或分享
在904，当第三方服务408需要用户数据时，该第三方服务408向隐私保护应用406发送用户数据请求。该用户数据请求指示第三方服务需要什么数据。
在906，隐私保护应用406在接收到来自第三方服务408的用户数据请求后将该请求转发给用户402或其本地客户端。该转发操作可采取应用通知的形式，但不限于该通知形式。
在908，用户402通过其拥有的口令或密码来经由隐私保护应用406对该用户数据请求进行授权或批准或以其他方式准许该请求，以准许第三方服务408对其存储在云存储404或本地客户端上的个人信息或个人数据进行查询。用户拥有的密码可采取包括但不限于数字、或字母、或数字与字母的组合的形式，并且隐私保护应用406、第三方服务408和云存储404都无法获取该密码信息。
在910，在用户授权后，隐私保护应用406将授权信息发送到第三方服务408，以向其确认用户授权其数据请求。
在912，基于第三方服务408所发送的用户数据请求中所指示的数据需求，隐私保护应用406在用户授权的情况下从云存储404中获取相应用户数据，并且基于从第三方服务接收到的数据模型或数据查询规则进一步处理所获取的用户数据以产生经处理的用户数据并用第三方服务408提供的公钥对其加密。
具体而言，第三方服务408可以将多方计算模型部署到隐私保护应用406并且使得基于该多方计算模型的计算在隐私保护应用内的安全沙箱中进行。该安全计算包括基于第三方服务408提供的查询规则以及隐私保护应用提供的用户数据，通过诸如逻辑回归之类的数据模型来提供计算结果并将其发送到第三方服务，这使得用户数据对该第三方服务可用但不可见。隐私保护应用提供的用户数据可被分类并基于类别来部署到不同的数据存储设施以降低用户数据泄露的风险。在本公开的另一实施例中，同一类用户数据可被拆分并将经拆分的同一类数据部署到不同的数据存储设施，由此使得没有一处存储设施能够知晓完整的用户数据以进一步提升用户数据的隐私保护水平或级别。
附加地或替换地，隐私保护应用从云存储获取的用户数据可以是经用户加密的，并且隐私保护应用可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数据。
然后在914，隐私保护应用406将经处理且经加密的用户数据传送至第三方服务408。然后，第三方服务408可接收到经加密的用户数据并用其私钥对其解密以获取经处理的用户数据并结合其先前提供的数据模型或数据查询规则来获得想要的信息。
图10示出了根据本公开的另一个实施例的用于隐私数据保护的另一示例方法1000的流程图。
在框1002，部署在用户本地客户端上的隐私保护应用从第三方服务接收用户数据请求，该用户数据请求指示该第三方服务需要什么数据。
在框1004，隐私保护应用将该请求转发给用户或其本地客户端。该转发操作可采取应用通知的形式，但不限于该通知形式。
在框1006，隐私保护应用接收用户通过密码对该用户数据请求的授权，用户拥有的密码可采取包括但不限于数字、或字母、或数字与字母的组合的形式，并且隐私保护应用、第三方服务和云存储都无法获取该密码信息。
在框1008，隐私保护应用将授权信息发送到第三方服务，以向其确认用户授权其数据请求。
在框1010，基于第三方服务所发送的用户数据请求中所指示的数据需求，隐私保护应用在用户授权的情况下从云存储中获取相应用户数据。附加地或替换地，隐私保护应用从云存储获取的用户数据可以是经用户加密的，并且隐私保护应用可以在用户授权下载的情况下从云存储获取经加密的用户数据并基于用户的下载授权来还原用户数 据
在框1012，隐私保护应用基于第三方服务提供的用户数据查询规则或数据模型来对所获取的用户数据进行进一步处理以产生经处理的用户数据。
在1014，隐私保护应用通过与第三方服务相关联的第三方公钥来对经处理的用户数据进行加密。
在框1016，隐私保护应用将经处理且经加密的用户数据传送到第三方服务以供其解密并获取经处理的用户数据。
以上参考根据本公开的实施例的方法、***和计算机程序产品的框图和/或操作说明描述了本公开的实施例。框中所注明的各功能/动作可以按不同于任何流程图所示的次序出现。例如，取决于所涉及的功能/动作，连续示出的两个框实际上可以基本上同时执行，或者这些框有时可以按相反的次序来执行。
以上说明、示例和数据提供了对本公开的组成部分的制造和使用的全面描述。因为可以在不背离本公开的精神和范围的情况下做出本公开的许多实施例，所以本公开落在所附权利要求的范围内。

Claims (15)

  1. 一种隐私保护应用处的用于保护用户隐私的方法，包括：
    从第三方服务接收用户数据请求；
    从用户接收对所述用户数据请求的授权；
    从云存储中获取用户数据；
    通过与所述第三方服务相关联的第三方公钥来对所获取的用户数据进行加密；以及
    将经加密的用户数据传送到所述第三方服务以供其解密并获取所述用户数据。
  2. 如权利要求1所述的方法，其特征在于，所述用户数据请求指示所述第三方服务所需要的用户数据，并且所述用户数据在被获取后被存储在用户的个人计算设备的内存中，而不被缓存。
  3. 如权利要求1所述的方法，其特征在于，所述授权基于所述用户拥有的密码，并且所述密码无法被所述第三方服务、所述云存储、以及所述隐私保护应用获取。
  4. 如权利要求1所述的方法，其特征在于，所述用户数据被存储在所述云存储中并且经用户加密，并且所述用户能添加、查询、更改、删除所述云存储中的任何用户数据。
  5. 一种隐私保护应用处的用于保护用户隐私的方法，包括：
    从第三方服务接收用户数据请求；
    从用户接收对所述用户数据请求的授权；
    从云存储中获取用户数据；
    通过所述第三方服务提供的数据模型或规则来处理所获取的用户数据，其中所述数据模型包括多方计算模型，并且处理所获取的用户数据包括通过所述多方计算模型基于被部署到多个不同的存储设施的所述用户数据来提供计算结果；
    通过与所述第三方服务相关联的第三方公钥来对经处理的用户数据进行加密；以及
    将经处理且经加密的用户数据传送到所述第三方服务以供其解密并获取所述经处理的用户数据。
  6. 如权利要求5所述的方法，其特征在于，所述用户数据请求指示所述第三方服务所需要的用户数据，并且所述用户数据在被获取后被存储在用户的个人计算设备的内存中，而不被缓存。
  7. 如权利要求5所述的方法，其特征在于，所述授权基于所述用户拥有的密码，并且所述密码无法被所述第三方服务、所述云存储、以及所述隐私保护应用获取。
  8. 如权利要求5所述的方法，其特征在于，所述用户数据被存储在所述云存储中并且经用户加密，并且所述用户能添加、查询、更改、删除所述云存储中的任何用户数据。
  9. 如权利要求5所述的方法，其特征在于，所述数据模型使用逻辑回归来产生所述经处理的数据。
  10. 如权利要求5所述的方法，其特征在于，还包括对所述用户数据进行分类并将经分类的用户数据部署到所述多个不同的存储设施。
  11. 如权利要求5所述的方法，其特征在于，还包括：
    对所述用户数据进行分类；以及
    对所述经分类的用户数据进行拆分并将经拆分的同一类用户数据部署到所述多个不同的存储设施。
  12. 一种用于保护用户隐私的***，所述***包括：
    用于从第三方服务接收用户数据请求的装置；
    用于从用户接收对所述用户数据请求的授权的装置；
    用于从云存储中获取用户数据的装置；
    用于通过与所述第三方服务相关联的第三方公钥来对所获取的用户数据进行加密的装置；以及
    用于将经加密的用户数据传送到所述第三方服务以供其解密并获取所述用户数据的装置。
  13. 一种用于保护用户隐私的***，所述***包括：
    用于从第三方服务接收用户数据请求的装置；
    用于从用户接收对所述用户数据请求的授权的装置；
    用于从云存储中获取用户数据的装置；
    用于通过所述第三方服务提供的数据模型或规则来处理所获取的用户数据的装置，其中所述数据模型包括多方计算模型，并且所述用于处理所获取的用户数据的装置包括用于通过所述多方计算模型基于被部署到多个不同的存储设施的所述用户数据来提供计算结果的装置；
    用于通过与所述第三方服务相关联的第三方公钥来对经处理的用户数据进行加密的装置；以及
    用于将经处理且经加密的用户数据传送到所述第三方服务以供其解密并获取所述经处理的用户数据的装置。
  14. 一种具有指令的计算机可读存储介质，所述指令在被执行时使机器执行如权利要求1所述的方法。
  15. 一种具有指令的计算机可读存储介质，所述指令在被执行时使机器执行如权利要求5所述的方法。
PCT/CN2020/071239 2019-05-31 2020-01-09 一种基于安全计算的个人数据服务方法和*** WO2020238242A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/841,462 US11120160B2 (en) 2019-05-31 2020-04-06 Distributed personal data storage and encrypted personal data service based on secure computation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910475649.1 2019-05-31
CN201910475649.1A CN110210246B (zh) 2019-05-31 2019-05-31 一种基于安全计算的个人数据服务方法和***

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/841,462 Continuation US11120160B2 (en) 2019-05-31 2020-04-06 Distributed personal data storage and encrypted personal data service based on secure computation

Publications (1)

Publication Number Publication Date
WO2020238242A1 true WO2020238242A1 (zh) 2020-12-03

Family

ID=67790421

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/071239 WO2020238242A1 (zh) 2019-05-31 2020-01-09 一种基于安全计算的个人数据服务方法和***

Country Status (2)

Country Link
CN (1) CN110210246B (zh)
WO (1) WO2020238242A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114143000A (zh) * 2021-11-29 2022-03-04 百保(上海)科技有限公司 基于不经意传输协议与秘密分享的匿踪查询方法及装置
WO2022267770A1 (zh) * 2021-06-24 2022-12-29 支付宝(杭州)信息技术有限公司 隐私计算数据资源发布、发现的方法、装置和***
WO2023241503A1 (zh) * 2022-06-17 2023-12-21 维沃移动通信有限公司 隐私保护方法、装置、终端、节点及存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110210246B (zh) * 2019-05-31 2022-01-07 创新先进技术有限公司 一种基于安全计算的个人数据服务方法和***
US11120160B2 (en) 2019-05-31 2021-09-14 Advanced New Technologies Co., Ltd. Distributed personal data storage and encrypted personal data service based on secure computation
CN110826053A (zh) * 2019-10-11 2020-02-21 北京市天元网络技术股份有限公司 基于容器的数据沙箱运算结果安全输出方法以及装置
CN111090879B (zh) * 2019-12-05 2023-07-21 达闼机器人股份有限公司 数据处理方法、装置、可读存储介质、电子设备和***
CN111125753A (zh) * 2019-12-09 2020-05-08 支付宝(杭州)信息技术有限公司 一种信用数据的确定方法和装置
CN111368338B (zh) * 2020-05-27 2020-12-22 支付宝(杭州)信息技术有限公司 基于多方隐私保护的数据处理方法及数据处理***
CN111818047B (zh) * 2020-07-07 2022-08-12 德能森智能科技(无锡)有限公司 一种云环境下的云主机监控管理***及方法
CN112235261B (zh) * 2020-09-26 2023-04-07 建信金融科技有限责任公司 报文加密与解密方法、装置、电子设备及可读存储介质
CN113206758A (zh) * 2021-04-27 2021-08-03 北京极智数仓科技有限公司 跨云平台的终端数据服务方法及***
CN116090019B (zh) * 2023-04-12 2023-06-16 北京数力聚科技有限公司 一种基于分布式协作的隐私计算方法及***

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101599188A (zh) * 2009-07-10 2009-12-09 广东南方信息安全产业基地有限公司 一种基于ipa安全认证的门禁***
CN105072255A (zh) * 2015-07-10 2015-11-18 北京奇虎科技有限公司 移动设备隐私权限控制方法、装置及相应的手机设备
CN108573168A (zh) * 2018-04-10 2018-09-25 Oppo广东移动通信有限公司 隐私空间启动方法和装置、存储介质、电子设备
CN110210246A (zh) * 2019-05-31 2019-09-06 阿里巴巴集团控股有限公司 一种基于安全计算的个人数据服务方法和***

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7478157B2 (en) * 2001-11-07 2009-01-13 International Business Machines Corporation System, method, and business methods for enforcing privacy preferences on personal-data exchanges across a network
US7526084B2 (en) * 2005-09-02 2009-04-28 Mitsubishi Electric Research Laboratories, Inc. Secure classifying of data with Gaussian distributions
GB2485783A (en) * 2010-11-23 2012-05-30 Kube Partners Ltd Method for anonymising personal information
CN102088491B (zh) * 2011-02-01 2013-06-26 西安建筑科技大学 一种面向分散式的云存储安全架构及其数据存取方法
CN102143188A (zh) * 2011-04-10 2011-08-03 上海擎龙通信技术有限公司 基于云计算加密存储服务的控制***
CN102710623B (zh) * 2012-05-23 2014-03-12 中国电力科学研究院 一种基于多方交互的智能电网用电信息隐私保护方法
EP2683127A1 (en) * 2012-07-05 2014-01-08 Alcatel-Lucent Voucher authorization for cloud server
CN103957109B (zh) * 2014-05-22 2017-07-11 武汉大学 一种云数据隐私保护安全重加密方法
CN105553940A (zh) * 2015-12-09 2016-05-04 北京中科云集科技有限公司 一种基于大数据处理平台的安全防护方法
CN106027552A (zh) * 2016-06-30 2016-10-12 中经汇通电子商务有限公司 一种用户访问云存储数据的方法及***
US20190028766A1 (en) * 2017-07-18 2019-01-24 Audible Magic Corporation Media classification for media identification and licensing
CN110800251B (zh) * 2017-08-03 2022-05-27 赫尔实验室有限公司 基于云的隐私保护导航操作的***、方法和介质
CN107979595B (zh) * 2017-11-23 2020-11-13 储明 私有数据保护方法及网关***

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101599188A (zh) * 2009-07-10 2009-12-09 广东南方信息安全产业基地有限公司 一种基于ipa安全认证的门禁***
CN105072255A (zh) * 2015-07-10 2015-11-18 北京奇虎科技有限公司 移动设备隐私权限控制方法、装置及相应的手机设备
CN108573168A (zh) * 2018-04-10 2018-09-25 Oppo广东移动通信有限公司 隐私空间启动方法和装置、存储介质、电子设备
CN110210246A (zh) * 2019-05-31 2019-09-06 阿里巴巴集团控股有限公司 一种基于安全计算的个人数据服务方法和***

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2022267770A1 (zh) * 2021-06-24 2022-12-29 支付宝(杭州)信息技术有限公司 隐私计算数据资源发布、发现的方法、装置和***
CN114143000A (zh) * 2021-11-29 2022-03-04 百保(上海)科技有限公司 基于不经意传输协议与秘密分享的匿踪查询方法及装置
WO2023241503A1 (zh) * 2022-06-17 2023-12-21 维沃移动通信有限公司 隐私保护方法、装置、终端、节点及存储介质

Also Published As

Publication number Publication date
CN110210246B (zh) 2022-01-07
CN110210246A (zh) 2019-09-06

Similar Documents

Publication Publication Date Title
WO2020238242A1 (zh) 一种基于安全计算的个人数据服务方法和***
US11677756B2 (en) Risk adaptive protection
US20220116219A1 (en) Zero-knowledge environment based social networking engine
US20220108026A1 (en) System and method for multiparty secure computing platform
CN111475841B (zh) 一种访问控制的方法、相关装置、设备、***及存储介质
JP6538570B2 (ja) クラウドデータセキュリティのためのシステム及び方法
WO2021159684A1 (zh) 数据处理方法、***、平台、设备及机器可读介质
US10862843B2 (en) Computerized system and method for modifying a message to apply security features to the message's content
US10063372B1 (en) Generating pre-encrypted keys
US11544394B2 (en) Information processing apparatus and method for processing information
US8677154B2 (en) Protecting sensitive data in a transmission
US20170277774A1 (en) Systems and methods for secure storage of user information in a user profile
US11120160B2 (en) Distributed personal data storage and encrypted personal data service based on secure computation
US20170277775A1 (en) Systems and methods for secure storage of user information in a user profile
EP3566415B1 (en) Successive cryptographic techniques
US20180089451A1 (en) Tokenized links with granular permissions
US10382528B2 (en) Disposition actions in digital asset management based on trigger events
US20160314550A1 (en) Limited user contract content sharing
US10853898B1 (en) Method and apparatus for controlled messages
US11722518B2 (en) System for providing enhanced cryptography based response mechanism for malicious attacks
CN112948891A (zh) 一种数据上传、数据解密的方法、装置、设备和介质
EP4211575A1 (en) System and method for multiparty secure computing platform
Hewitt Installing Backdoors Assists CyberTerrorists

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20815250

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20815250

Country of ref document: EP

Kind code of ref document: A1