Abstract: Embodiments of this specification provide account opening methods, systems, and apparatuses. An example method is performed by a terminal device that includes a trusted execution environment (TEE) and an encryption hardware-based secure element. When it is detected that a current user initiates an account opening request, the terminal device obtains a user public key of the current user in the TEE, and signs a user public key by using a predetermined manufacturer private key, to obtain a user certificate; signs, in the secure element by using a user private key corresponding to the user public key, opening information; generates an opening request in the TEE based on at least the user certificate and signed opening information; and, in the TEE, generates an opening request packet based on the opening request, and sends the opening request packet to a server that opens an account based on the opening request packet.

Abstract: This specification discloses methods, apparatus, devices, and systems for determining a feature effective value of business data. In one implementation, a method includes: obtaining a joint data share of a first participant based on joint data that includes feature values of a plurality of objects corresponding to a plurality of feature terms, obtaining a predictive value share and a model parameter share based on the joint data and a business prediction model, determining, through secure multi-party computation, a correlation data share corresponding to the plurality of participants, and determining, through a significance test method, an effective value of a feature term of the plurality of feature terms.

Abstract: Implementations of this specification provide graph data processing systems and methods. An example graph data processing system includes a data storage system and a graph computing engine. The data storage system is configured to store a plurality of pieces of graph data corresponding to a plurality of versions, where the plurality of pieces of graph data are generated based on a plurality of groups of service data generated by a target service system in a plurality of consecutive time intervals. The graph computing engine is configured to receive a graph feature computing request. The graph computing engine is further configured to search the plurality of pieces of graph data stored in the data storage system for a plurality of pieces of target graph data corresponding to the plurality of target versions, and compute graph features of the plurality of pieces of target graph data.

Abstract: Some embodiments of this specification disclose graphical model training methods, apparatuses, and devices. In an embodiment, a method performed by a terminal device includes: acquiring node information of a first graph to be constructed, node information of a second graph and node connection information of the second graph, acquiring a latent vector of a first node that has training label information in the first graph, acquiring latent vectors of the second node and the node in the second graph. performing, based on the first sample data and the second sample data, model training on a graphical model sent by a server, acquiring gradient information corresponding to the trained graphical model, and sending the gradient information to the server for the server to update model parameters in the graphical model based on gradient information provided by different terminal devices to obtain an updated graphical model.

Abstract: A computer-implemented method for communication channel management performed by a wireless access point (AP) device is described. An original management frame that carries a target information element is constructed, where the target information element includes an information element related to communication channel management. When determined that one or more clients are connected to the AP device, for each of the determined clients: A destination address of the original management frame is set to a MAC address of the client. To obtain an encrypted management frame by using a key corresponding to the client, information in the target information element is encrypted. The encrypted management frame is sent in a WiFi network, so that a connected client in the WiFi network determines, based on the destination address, whether to process the encrypted management frame.

Abstract: Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for managing blockchain-based trustable transaction services. One of the methods includes: storing order data of an order between a buyer and a seller on a blockchain of a blockchain network, the order data including one or more payment conditions and data of a trustable undertaking (TU) service for the order, verifying that the buyer has the TU service for the order guaranteed by the buyer financial institution, generating a smart contract for the order based on the order data on the blockchain, and executing the smart contract to automatically instruct the buyer financial institution to make a payment of the order for the buyer to the seller according to the TU service for the order in response to determining that a payment condition for the payment specified in the smart contract is met.

Abstract: A container group scheduling method includes obtaining multiple to-be-scheduled pods from a pod scheduling queue. Equivalence class partitioning on the multiple to-be-scheduled pods is performed to obtain at least one pod set. Each of the at least one pod set is determined as a target pod set. Scheduling processing is performed on the target pod set to bind each pod in the target pod set to a node configured to run the pod. A target schedulable node set corresponding to the target pod set is determined. A correspondence between the target pod set and the target schedulable node set is cached. From the target schedulable node set, a node corresponding to each pod in the target pod set is determined. Each pod in the target pod set is bound to the node corresponding to each pod in the target pod set. The cached correspondence is deleted.

Abstract: Embodiments of this specification provide computer-implemented methods, apparatuses, and computer-readable storage media for interface invocation request processing. In an example interface invocation request processing method, an invocation request for a first interface of an operating system is received from a client application, and the first interface is configured to obtain privacy data. First scenario information is obtained, where the first scenario information is description information of a use scenario of the first interface declared when the client application applies for an invocation permission of the first interface. Current scenario information of the client application is obtained. The invocation request is executed in response to at least that the current scenario information matches the first scenario information.

Abstract: Example blockchain-based user element authentication methods, apparatuses, systems and computer-readable media are provided. In an example, a node device in a blockchain receives a smart contract invocation transaction, where the smart contract invocation transaction includes an encrypted to-be-authenticated user element provided by a user client. In response to the smart contract invocation transaction, the node device invokes encryption conversion logic in the smart contract, decrypts the encrypted to-be-authenticated user element in a trusted computing environment, and performs secondary encryption processing. The user element authentication authority decrypts the to-be-authenticated user element and performs user element authentication. The node device obtains an authentication result submitted by the user element authentication authority and stores the authentication result in the blockchain.

Abstract: One or more embodiments of this specification provide methods and apparatuses for transmitting messages. A method includes: determining a blockchain message from two or more message queues stored in a relay node in a blockchain relay communication network based on a message transmission policy, the message transmission policy being configured to transmit blockchain messages in the blockchain relay communication network based upon a priority identifier representing a priority of a blockchain message to be transmitted in the blockchain relay communication network; obtaining identifier from the blockchain message, and determining one or more target blockchain nodes in the blockchain relay communication network corresponding to the identifier; determining a target relay node connected to the one or more target blockchain nodes in the blockchain relay communication network; and transmitting the blockchain message to the one or more target blockchain nodes through the target relay node.

Abstract: A computer-implemented method for image processing includes obtaining, based on a source image including a first biological object, an identity feature and attribute feature used to represent identity information and attribute information of the first biological object. Based on a target image including a second biological object, a context feature used to represent context information of the second biological object is obtained. Based on the identity feature, a fused image of the source image and the target image, the attribute feature, and the context feature is generated, where the fused image includes a fused biological object of a first biological object and the second biological object, identity information and attribute information of the fused biological object is identical to the identity information and the attribute information of the first biological object, and context information of the fused biological object is identical to the context information of the second biological object.

Abstract: A computer-implemented method includes determining, based on a configured computing resource share at a previous moment/time period based on an estimated traffic sequence of each application in a target period a representation vector of each application of a plurality of applications and a pre-estimated central processing unit utilization of each application. The pre-estimated central processing unit utilization of each application, the representation vector of each application, and the estimated traffic sequence of each application in the target period are input into a decision network and a current computing resource configuration policy of a first moment/time period based on an output result of the decision network.

Abstract: Implementations of this specification provide query optimization methods, apparatuses, and systems for secure multi-party databases. In an implementation, a method includes: receiving a current query associated with a plurality of target database of a multi-party database system, generating a plurality of execution plans for the current query, determining, for each execution plan, a respective cost computation formula of a plurality of cost computation values for computing an execution cost of jointly executing the execution plan by the plurality of target databases, receiving a secure computation result from each of a plurality of query engines corresponding to the plurality of target databases, and determining an optimal execution plan having a lowest cost value in the plurality of cost computation formulas based on the secure computation result.

Abstract: A multi-booth traffic allocation scheme for multiple users if provided. In an implementation, an exposure probability of each booth and a unit traffic revenue and corresponding unit resource consumption of each candidate display object for each user are obtained. An optimization objective and a resource consumption constraint corresponding to a multi-booth traffic allocation scheme are constructed. The constructed optimization objective includes a sum value of traffic revenues for each user under the multi-booth traffic allocation scheme. The traffic revenues for each user are determined based on the exposure probability of each booth, a booth allocation scheme of candidate display objects, and the unit traffic revenue of each candidate display object. A multi-booth traffic allocation scheme when the resource consumption constraint is satisfied and the optimization objective is maximized is determined.

Abstract: This specification provides example data query methods, apparatuses, and systems for a multi-party secure database. In an example computer-implemented method, a central node receives a data query request from a data requester, where the data query request relates to one or more pieces of target data stored at one or more data providers. The central node determines whether the data query request satisfies respective security requirements of the one or more pieces of target data. In response to determining that the data query request satisfies respective security requirements of the one or more pieces of target data, the central node processes the one or more pieces of target data to obtain result data; and sends the result data to the data requester. The central node can restrict query of the target data by the data requester based on the security requirement of the target data stored at the data provider.

Abstract: Privacy preservation model training includes a plurality of iterative update rounds performed on a model held by a data party of a plurality of data parties participating in training to obtain model data, which includes first shared data and local data corresponding to a shared portion and a dedicated portion of the model, respectively. The iterative training adds a perturbation to the first shared data to perform privacy preservation on at least the first shared data. The first shared data is transmitted to a server, which determines, based on first shared data of the plurality of data parties, second shared data. The shared portion of the model is updated based on the second shared data returned by the server. A next iterative update round is performed based on an updated model or using the updated model as a final model.

Abstract: Implementations of this specification disclose methods and systems for training a privacy protection model. In an implementation, a method comprising: performing one or more times of iterative training on the model based on a training sample held by the data party to obtain model data, transmitting the first shared data to a server for the server to determine second shared data based on the first shared data, receiving the second shared data from the server, updating the shared portion of the model based on the second shared data to obtain an updated shared portion, and generating, based on the updated shared portion, an updated model for performing a next one of the plurality of iterative updates in response to determining that the next one of the plurality of iterative updates is not a last one of the plurality of iterative updates.

Abstract: First graph structure data indicating connectivity relationships mined for N object nodes is generated based on node representation parameters. The first graph structure data and node traffic data including T traffic values of each object node at T time points is processed to obtain N first embedded representations of the N object nodes. Second graph structure data indicating original connectivity relationships pre-generated for N object nodes and the node traffic data are processed to obtain N second embedded representations of the N object nodes. Fusion processing is performed on the N first embedded representations and the N second embedded representations to obtain a fused representation matrix, which is processed with the T traffic values. A predicted traffic value of each object node after the T time points is determined. Parameters are updated in a traffic prediction system based on the predicted traffic value and a corresponding actual traffic value.

Abstract: Trusted execution environment construction is described and includes obtaining regulatory requirement information of a trusted execution environment. The regulatory requirement information is parsed to obtain atomized security function information applied to the trusted execution environment. Formal parsing processing is performed on the security function information to obtain a security solution of the trusted execution environment to prove that it satisfies the regulatory requirement information and generating a test case corresponding to the security solution based on an axiom of the security solution. Using a predetermined property migration mechanism based on the security solution and the test case corresponding to the security solution, a trusted execution environment is constructed that has same property information as the security solution and the test case with respect to a predetermined property item in a target scenario.

Abstract: Bandwidth-controlled, private, multi-party joint data processing is described. When performing an nth iteration of joint data processing on service data, multiple participants separately determine a same nth identifier at the current iteration and includes sub-identifiers separately corresponding to service data of the multiple participants. The multiple participants are enabled to separately determine their respective random arrays in a predetermined trusted interaction manner and based on the nth identifier and initial seeds of the multiple participants. When a first sub-identifier exists in a correspondence between sub-identifiers and confidential data, the multiple participants separately obtain first confidential data corresponding to the first sub-identifier and perform the current iteration of joint data processing with another participant using secure multi-party computation (MPC) based on exchange of other confidential data and respective first confidential data.