A ciphertext conversion method and system for an internet of things scenario

Abstract

The application belongs to the technical field of cryptography and data security, and discloses a ciphertext conversion method and system for an Internet of Things scene, which comprises the following steps: a key management end is initialized to generate series parameters; a client encrypts original plaintext data by using a homomorphically friendly symmetric encryption algorithm; a server constructs a homomorphic key stream; the server converts symmetric ciphertext into homomorphic ciphertext; and the server performs subsequent homomorphic calculation. According to the application, direct calculation of encrypted data can be realized without plaintext decryption of data on the server side, so that the risk of data leakage is reduced; meanwhile, the introduction of symmetric encryption reduces the communication overhead of the client, improves the overall efficiency of the system, and is suitable for a multi-party collaborative trusted calculation scene in the Internet of Things scene.

Description

Technical Field

[0001] This invention belongs to, but is not limited to, the fields of cryptography and data security technology, and particularly relates to a ciphertext conversion method and system for Internet of Things (IoT) scenarios. Background Technology

[0002] Secure data collection and reliable data transfer are crucial foundations for driving the development of the digital economy and the smart Internet of Things (IoT) industry. With the rapid development of IoT applications, massive numbers of terminal devices continuously generate and upload data resources containing private information and sensitive business data, such as device operating status, environmental monitoring information, power load data, and human health and physiological signals. Due to the generally limited computing power, storage space constraints, and low-power operation requirements of IoT terminal devices, existing systems typically symmetrically encrypt the data at the device level (symmetric encryption algorithms have low computational overhead and are widely used for encrypted data transmission in the IoT sensing layer), upload it to the cloud for decryption, and then process and analyze the data in plaintext. However, because the decryption process occurs in a cloud environment beyond the data owner's control, the data still faces the risk of privacy leakage during use. This problem is particularly prominent when data relies on third-party platforms for storage and computing services. In emerging application scenarios such as data element circulation and the construction of trusted data spaces, data owners want to complete data processing, sharing, and collaborative computing while maintaining data control. The traditional "decrypt first, then compute" model is insufficient to meet the requirements of controllable and reliable data transfer.

[0003] Currently, the commonly used technologies in the industry are as follows:

[0004] To mitigate the aforementioned risks, the industry is integrating privacy-preserving computing technologies into IoT scenarios to achieve privacy protection and data processing for IoT data. Homomorphic encryption, in particular, allows for direct computation on data without decrypting plaintext, and is widely used in cloud-based privacy computing and data security outsourcing. Existing solutions include two approaches: one involves performing homomorphic encryption directly on a powerful terminal before uploading to a cloud server for ciphertext-based privacy computation to protect data throughout the process; the other utilizes trusted execution environment (TEE) technology, where symmetric ciphertext is decrypted into plaintext in a TEE environment in the cloud before being homomorphically encrypted again for subsequent ciphertext computation.

[0005] However, in IoT data processing scenarios, the aforementioned existing technologies still have the following problems:

[0006] (1) Limited computing resources on the terminal side. General privacy computing schemes require data to be directly generated into computable ciphertext using homomorphic encryption methods such as CKKS / BGV on the terminal side. However, these algorithms have high hardware resource requirements, large ciphertext size expansion, and high communication cost, making them difficult to deploy on resource-constrained IoT devices, thus making it difficult for the system to be practically implemented.

[0007] (2) Symmetrically encrypted data cannot be directly computed. Internet of Things systems generally use symmetric encryption to protect data, but the encryption methods of classic symmetric encryption algorithms (Advanced Encryption Standard AES, Chinese Cryptographic Algorithm SM4, stream ciphers, etc.) do not have homomorphic computability. If the cloud needs to perform data analysis, it must still decrypt the data first, which cannot fundamentally avoid the problem of data exposure.

[0008] (3) Lack of edge-cloud collaborative processing mechanism. Most existing privacy computing platforms are designed for data centers or high-performance environments and lack a unified encrypted processing mechanism for the "lightweight terminal-untrusted cloud platform" architecture, making it difficult to balance low terminal overhead with cloud privacy computing capabilities. Summary of the Invention

[0009] To address the problems existing in the prior art, this invention provides a ciphertext conversion method and system for IoT scenarios. Through edge-cloud collaboration, plaintext data is encrypted using a symmetric encryption algorithm on resource-constrained IoT devices, and then the symmetric ciphertext is converted into a ciphertext form capable of performing homomorphic computation on a cloud server. This reduces terminal computing and communication overhead while ensuring data privacy.

[0010] This invention is implemented as follows: a ciphertext conversion method for IoT scenarios, the method comprising:

[0011] Step 1: The key management terminal generates the homomorphic encryption parameters and keys required for system operation and distributes them to the client and server; the key management terminal generates homomorphic encryption key pairs. , Wait, for the homomorphic key Securely store the homomorphic public key locally. Other public parameters are distributed to the server. In addition, the key management terminal also generates stream cipher keys. This is securely distributed to clients to encrypt the original data. Furthermore, homomorphic public keys are needed to perform ciphertext conversion. Encryption stream cryptographic key , recorded as Distribute it to the server;

[0012] Step Two: Client-side symmetric encryption; the client is an IoT device that generates or collects data, such as health monitoring information, smart meter readings, fingerprints, or facial features, denoted as... The client uses the master key. and random numbers Generate stream cipher keystream Then use Encrypting raw plaintext data , thus obtaining symmetric encrypted ciphertext And upload it to the server;

[0013] Step 3: The server constructs a homomorphic keystream; the server uses the random number sequence provided by the key management terminal. and key ciphertext Generate stream cipher keystream ciphertext in a homomorphic ciphertext field. The keystream ciphertext is represented as the encrypted form of the stream cipher key in a homomorphic encryption domain.

[0014] Step 4: The server converts the symmetric ciphertext to homomorphic ciphertext; the server receives the symmetric ciphertext uploaded by the client. First, it is mapped to a homomorphic ciphertext space. Then, the server performs ciphertext conversion, transforming the symmetric encrypted message sequence into a homomorphic encrypted message sequence; that is, performing subtraction and modulo. ;

[0015] Step 5: Perform subsequent homomorphic computation; this result serves as the initial form of the computation ciphertext supported by the CKKS scheme. The ciphertext can then be scaled up to a suitable scale and noise level for direct participation in subsequent complex homomorphic computations.

[0016] Another objective of this invention is to provide an IoT-oriented ciphertext conversion system that implements the aforementioned ciphertext conversion method for IoT scenarios, the system comprising:

[0017] The key management terminal is mainly used to generate and manage relevant keys and encryption / decryption parameters for clients and servers, and to securely distribute the generated keys to clients and servers.

[0018] The client is an IoT device, including but not limited to wearable health monitoring devices, smart meters and water meters, video surveillance terminals and other resource-constrained devices; after completing data collection, the client uses a homomorphic friendly symmetric encryption algorithm to encrypt the collected data to generate symmetric ciphertext, and uploads the symmetric ciphertext to the cloud server without performing homomorphic encryption calculation operations;

[0019] The server is a cloud server used to perform the ciphertext conversion and ciphertext calculation process. After receiving the symmetric ciphertext uploaded by the client, the server combines the obtained homomorphic encryption public key and system parameters, and through the designed conversion calculation process, converts the symmetric ciphertext into CKKS homomorphic ciphertext in the ciphertext state, and further executes the preset calculation formula on the homomorphic ciphertext to obtain the corresponding ciphertext calculation result.

[0020] Furthermore, the key management terminal is a trusted entity that is fully trusted by the IoT client, and will not collude with any other participants. The key information and security parameters stored inside it will not be leaked.

[0021] First, the key management terminal initializes the system parameters; let's assume... For large integers, construct a polynomial ring: Where N represents the dimension of the ring;

[0022] Subsequently, the key management terminal generates a stream cipher key. The key is distributed to the client via a secure channel for symmetric encryption of the original data; simultaneously, to enable subsequent ciphertext conversion operations, the key management terminal uses a homomorphic encryption public key. For the stream cipher key Encryption is performed to obtain the key in homomorphic ciphertext form. and distribute it to the server;

[0023] In addition, the key management terminal also generates a set of random number sequences. The result is sent to the client for use as a random number input during the stream cipher encryption process.

[0024] Furthermore, the general interaction process between the client and the server is as follows:

[0025] On the client side, data generated by IoT devices is first symmetrically encrypted before being uploaded to the server. In this embodiment, data generated by IoT devices, such as health monitoring data, electricity meter readings, and biometric data, can be represented as a real-number vector of length n: ;

[0026] The specific encryption process is as follows: First, the client uses the stream cipher key. and random numbers Generate keystream: Next, the original data is scaled by multiplying it by a scaling factor. This yields an integer vector: Finally, symmetric encryption is achieved using modular addition (modulo t), yielding the stream cipher ciphertext: The ciphertext Then it is sent to the server;

[0027] The server receives a random number from the key management terminal. and homomorphic encryption key Then, a homomorphic keystream can be pre-constructed. This is used for subsequent ciphertext conversion calculations; this process can be completed before receiving data from the client, thus improving overall efficiency.

[0028] When the server receives the symmetric ciphertext uploaded by the client Next, it needs to be extended to the homomorphic encryption space to support subsequent homomorphic operations; that is, the vector-form ciphertext is mapped to polynomial form: The mapping function Defined as: ,in, Indicates the number of slots used for each homomorphic ciphertext;

[0029] Furthermore, it is embedded into the homomorphic ciphertext space: ,in, .

[0030] Subsequently, the server performs a ciphertext conversion operation, using homomorphic subtraction and modular arithmetic to convert symmetric ciphertext into homomorphic ciphertext: After the above operations, the initial form of homomorphic ciphertext can be obtained.

[0031] Another object of the present invention is to provide a computer device, the computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the encrypted conversion method for Internet of Things scenarios.

[0032] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the ciphertext conversion method for Internet of Things scenarios.

[0033] Another objective of this invention is to provide an information data processing terminal, which is used to implement the encrypted conversion system for Internet of Things scenarios as described in claim 2.

[0034] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows:

[0035] The difficulty in solving the existing technical problems lies in two aspects: First, IoT terminal devices have limited computing resources, making it difficult to directly handle highly complex homomorphic encryption operations; second, while symmetric encryption has the advantage of high efficiency, its ciphertext cannot directly support computational functions, resulting in an inherent contradiction between privacy protection and computing power. Furthermore, in an untrusted cloud environment, it is also necessary to ensure that the cloud cannot obtain plaintext information during computation, further increasing the technical implementation difficulty.

[0036] Solving existing technical problems is of great significance: if we can enable the cloud to perform calculations on encrypted data without decryption while maintaining the efficiency advantage of symmetric encryption on the terminal side, we can realize privacy protection and trusted processing of IoT data throughout the entire process from collection and transmission to calculation, promote the secure flow and compliant use of data, further promote the release of data element value and the healthy development of the digital economy, and facilitate the construction of a trusted data space and the trusted flow of data elements.

[0037] (1) Reduce the computation and communication overhead of IoT devices. IoT devices are usually limited in computing and storage capabilities, making it difficult to directly use homomorphic encryption for data encryption. This invention uses a lightweight symmetric encryption method to encrypt data on the client side, and completes the homomorphic ciphertext conversion only in the cloud, which greatly reduces the computational burden and communication overhead of terminal devices, making the solution more suitable for resource-constrained IoT scenarios.

[0038] (2) Enables computable conversion of symmetric ciphertext to homomorphic ciphertext, supporting complex data computation. This invention constructs a homomorphic keystream in the cloud and performs ciphertext conversion operations, enabling symmetric ciphertext, which was originally only used for storage and transmission, to be converted into a ciphertext form that supports homomorphic computation. This achieves the ability to "compute data in an encrypted state," allowing cloud servers to perform various data analysis and computation tasks in an encrypted state, such as statistical analysis, machine learning inference, or data aggregation, thereby fully leveraging the computing power of the cloud computing platform.

[0039] (3) Ensuring data privacy and security. In the solution of this invention, the original data remains encrypted throughout its entire lifecycle. The server only performs conversion and calculation operations in the ciphertext domain and does not need to obtain the original plaintext data, thereby effectively preventing the leakage of sensitive data and improving the overall privacy protection capability of the system.

[0040] Compared with existing technology products, the advantages of this invention are:

[0041] This invention addresses the problem that IoT data, after being uploaded to the cloud using symmetric encryption, must be decrypted before participating in data processing and computation, thus posing a risk of plaintext data leakage during the computation process. By employing a method of "lightweight encryption at the IoT terminal + cloud-based ciphertext conversion + homomorphic ciphertext computation," the invention achieves the conversion of symmetric ciphertext into homomorphic computable ciphertext, enabling data to participate in complex computations while remaining encrypted throughout the process. This achieves a privacy-preserving computation mechanism for end-to-cloud collaboration. This method avoids the computational burden caused by resource-constrained IoT devices performing complex homomorphic encryption operations, while ensuring the privacy and security of IoT data throughout the entire process of collection, transmission, storage, and computation. This invention can be widely applied in scenarios such as smart medical monitoring, smart meter metering, wearable device data analysis, and smart city sensing systems, thereby achieving the goals of "lightweight terminal computation, usable cloud computation, and privacy-preserving data processing," and providing reliable technical support for the secure sharing and value mining of IoT data.

[0042] As further supporting evidence of the inventiveness of this invention, the following important aspects are also reflected:

[0043] (1) The expected benefits and commercial value of the technical solution of this invention after transformation are as follows: This invention combines symmetric encryption and homomorphic encryption to realize a data computing mechanism that does not require plaintext decryption, significantly reducing communication overhead and terminal computing burden while ensuring data privacy and security. Compared with the scheme that directly adopts homomorphic encryption, this invention can effectively reduce the bandwidth and storage pressure caused by data expansion, thus making it more suitable for resource-constrained IoT terminal environments. In practical applications, this invention can be widely used in scenarios with high data privacy requirements such as smart healthcare, smart grids, and industrial IoT, which helps to promote the secure flow of data elements and the development of multi-party collaborative computing services, and has good prospects for industrial implementation and commercial promotion value.

[0044] (2) The technical solution of this invention solves a long-standing technical problem that people have long desired to solve but have never been able to: In existing IoT and cloud computing integration applications, data usually needs to be decrypted in the cloud before it can participate in calculations, resulting in the exposure of sensitive information during processing and posing significant security risks. Although homomorphic encryption can achieve ciphertext computation, its high computation and communication costs limit its application in practical IoT systems. This invention introduces a ciphertext conversion mechanism to achieve the conversion from symmetric ciphertext to homomorphic ciphertext without exposing plaintext, enabling data to directly participate in subsequent calculations, thereby achieving a balance between data security and computational feasibility, and solving the long-standing key technical problem of "difficulty in balancing security and efficiency". Attached Figure Description

[0045] Figure 1 This is the overall technical framework for ciphertext conversion provided in the embodiments of the present invention;

[0046] Figure 2 These are the general steps for converting symmetric ciphertext into a homomorphic ciphertext frame, as provided in the embodiments of the present invention.

[0047] Figure 3 This is the key management terminal interaction process provided in the embodiments of the present invention;

[0048] Figure 4 This is the general interaction flow between the client and the server provided in the embodiments of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0050] like Figure 1 As shown, the overall technical framework for ciphertext conversion provided in this embodiment of the invention includes:

[0051] (1) Key management terminal, mainly used to generate and manage relevant keys and encryption / decryption parameters for clients and servers, and to securely distribute the generated keys to clients and servers.

[0052] (2) The client is an IoT device, including but not limited to wearable health monitoring devices, smart meters and water meters, video surveillance terminals and other resource-constrained devices. After completing data collection, the client uses a homomorphic friendly symmetric encryption algorithm to encrypt the collected data to generate symmetric ciphertext, and uploads the symmetric ciphertext to the cloud server without performing homomorphic encryption calculation operations.

[0053] (3) The server is a cloud server used to perform the ciphertext conversion and ciphertext calculation process. After receiving the symmetric ciphertext uploaded by the client, the server combines the obtained homomorphic encryption public key and system parameters, and through the designed conversion calculation process, converts the symmetric ciphertext into CKKS homomorphic ciphertext in the ciphertext state, and further executes the preset calculation formula on the homomorphic ciphertext to obtain the corresponding ciphertext calculation result.

[0054] like Figure 2 The diagram illustrates the general steps of converting IoT data symmetric ciphertext into homomorphic ciphertext according to an embodiment of the present invention, specifically including the following steps:

[0055] (1) Initialize and generate a series of parameters at the key management terminal;

[0056] (2) The client uses a homomorphic-friendly symmetric encryption algorithm to encrypt the original plaintext data;

[0057] (3) The server constructs a homomorphic key stream;

[0058] (4) The server converts the symmetric ciphertext to homomorphic ciphertext;

[0059] (5) The server performs subsequent homomorphic computation.

[0060] like Figure 3 The diagram shows the key management terminal interaction process provided in this embodiment of the invention.

[0061] In this embodiment of the invention, the key management terminal is primarily responsible for the generation and distribution of system parameters and keys. It is considered a trusted entity fully trusted by the IoT client, and will not collude with any other participating parties; the key information and security parameters stored internally will not be leaked.

[0062] First, the key management terminal initializes system parameters. Let... For large integers, construct a polynomial ring: Where N represents the dimension of the ring.

[0063] Subsequently, the key management terminal generates a stream cipher key. The data is then distributed to the client via a secure channel for symmetric encryption of the original data. Simultaneously, to enable subsequent ciphertext conversion operations, the key management terminal utilizes a homomorphic encryption public key. For the stream cipher key Encryption is performed to obtain the key in homomorphic ciphertext form. And distribute it to the server.

[0064] In addition, the key management terminal also generates a set of random number sequences. The result is sent to the client for use as a random number input during the stream cipher encryption process.

[0065] like Figure 4 This is the general interaction flow between the client and the server provided in the embodiments of the present invention.

[0066] On the client side, data generated by IoT devices is first symmetrically encrypted before being uploaded to the server. In this embodiment, data generated by IoT devices (such as health monitoring data, meter readings, biometric data, etc.) can be represented as a real-number vector of length n: .

[0067] The specific encryption process is as follows: First, the client uses the stream cipher key. and random numbers Generate keystream: Next, the original data is scaled by multiplying it by a scaling factor. This yields an integer vector: Finally, symmetric encryption is achieved using modular addition (modulo t), yielding the stream cipher ciphertext: The ciphertext It is then sent to the server.

[0068] The server receives a random number from the key management terminal. and homomorphic encryption key Then, a homomorphic keystream can be pre-constructed. This is used for subsequent ciphertext conversion calculations. This process can be completed before receiving data from the client, thus improving overall efficiency.

[0069] When the server receives the symmetric ciphertext uploaded by the client Next, it needs to be extended to the homomorphic encryption space to support subsequent homomorphic operations. That is, the vector-form ciphertext is mapped to a polynomial form: The mapping function Defined as: ,in, This indicates the number of slots used for each homomorphic ciphertext.

[0070] Furthermore, it is embedded into the homomorphic ciphertext space: ,in, .

[0071] Subsequently, the server performs a ciphertext conversion operation, using homomorphic subtraction and modular arithmetic to convert symmetric ciphertext into homomorphic ciphertext: After the above operations, the initial form of homomorphic ciphertext can be obtained.

[0072] The following specific embodiments are used to fully illustrate that the ciphertext conversion technology solution of the present invention for IoT scenarios can be implemented by those skilled in the art and can cover application methods under different data types, different terminal capabilities, different business links, and different computing requirements. All embodiments revolve around the same core mechanism: the client uses lightweight symmetric encryption to protect the original data, and the server performs ciphertext conversion on the uploaded symmetric ciphertext based on pre-acquired homomorphic key ciphertext and random number information. This transforms data that could not directly participate in homomorphic operations into homomorphic ciphertext that can continue to perform privacy-preserving computations in the cloud. This mechanism is not simply a superposition of symmetric encryption and homomorphic encryption, but rather establishes an executable bridge path between resource-constrained terminals and high-computational-overhead privacy computations, possessing a clear technical concept and a stable implementation foundation.

[0073] Example 1 illustrates a scenario of continuous physiological parameter collection by a wearable health monitoring terminal. The terminal periodically collects heart rate, blood oxygen, body temperature, and sleep monitoring data, forming a 16-bit real number sequence. The terminal only stores the stream cipher master key and the random number input corresponding to the current collection. It first performs uniform scaling and integer encoding on the original real number sequence, then uses the stream cipher to generate a keystream. Modular encryption is then performed on each item of the encoded data to generate symmetric ciphertext, which is then uploaded. Before receiving the ciphertext, the server has already constructed the keystream ciphertext based on the homomorphic key ciphertext and the corresponding random number. Upon receiving the symmetric ciphertext, it loads it into the homomorphic message representation space, eliminates masked terms through homomorphic subtraction, and outputs the target homomorphic ciphertext that can be directly used for statistical analysis. Subsequently, the server can perform mean, fluctuation amplitude, and trend analysis in the ciphertext state. This example demonstrates that the terminal can achieve subsequent ciphertext analysis of medical data without bearing the burden of homomorphic encryption, showcasing its adaptability to low-power devices.

[0074] Example 2 illustrates a remote meter reading scenario for smart meters. During each data collection cycle, the meter records active power, reactive power, voltage, current, and cumulative electricity consumption information, forming an 8-bit vector. Due to the large number of such terminals deployed and the limited computing power of individual devices, traditional homomorphic encryption methods that directly upload data to the terminal are difficult to implement. In this invention, the meter only performs stream cipher encryption and uploads the result; the server then uses a homomorphic domain keystream reconstruction mechanism to achieve ciphertext conversion. After conversion, the cloud can directly perform total electricity consumption summation, load peak identification, and abnormal fluctuation detection in the ciphertext state. This example demonstrates that this invention is not limited to single-point data protection but can support centralized homomorphic processing after massive concurrent uploads from terminals, resolving the contradiction between insufficient terminal computing resources and the need for cloud-based privacy computing in the IoT environment.

[0075] Example 3 illustrates a privacy analysis scenario after feature extraction at the video surveillance front end. Instead of directly uploading the original image, the camera terminal locally extracts a 64-bit human behavior feature vector, which is then encrypted using stream ciphers. Due to the high dimensionality of the feature vector, the server loads multiple feature components into the same homomorphic message object according to slot rules, and then performs ciphertext conversion. The converted result can be directly fed into the homomorphic inference process corresponding to the cloud-based behavior recognition model for personnel trajectory clustering or abnormal behavior scoring. This example demonstrates that the present invention is applicable not only to scalar sensor data but also to medium- and high-dimensional feature data, and improves conversion efficiency through slot mapping and batch loading mechanisms, reflecting the integrity of the structural design and its engineering feasibility.

[0076] Example 4 illustrates a fingerprint or facial recognition authentication scenario. The terminal extracts the biometric template locally, represents it as a fixed-length numerical vector, and then performs symmetric encryption before uploading. The server recovers the corresponding keystream ciphertext based on the homomorphic key ciphertext, converts the uploaded result into homomorphic ciphertext, and then performs template distance calculation or similarity scoring in the ciphertext state. The key to this scenario is that the original biometric template is highly sensitive, and traditional plaintext comparison carries a risk of leakage. Directly performing homomorphic encryption on the terminal would incur significant latency and energy consumption. This invention, through a collaborative structure of symmetric encryption upload and server-side ciphertext conversion, retains a lightweight implementation path for the terminal while providing an input foundation for subsequent encrypted authentication, demonstrating its practical technical effectiveness in highly sensitive data processing scenarios.

[0077] Example 5 illustrates an industrial IoT edge data acquisition and cloud-based predictive maintenance scenario. The device continuously collects operating parameters such as vibration, temperature, rotational speed, and current, forming a time-slice data sequence and generating multiple batches of symmetric ciphertext according to a preset sampling interval. Before receiving data, the server can pre-construct keystream ciphertext for multiple time periods based on a pre-shared random number plan. Upon arrival of each batch of ciphertext, the server only needs to perform mapping and transformation to quickly obtain the target homomorphic ciphertext, and then further perform trend regression and fault prediction under the ciphertext state. This example highlights that the present invention allows the keystream ciphertext construction process to be moved forward, forming a "pre-generation plus online transformation" execution mode, reducing the processing latency in the actual receiving stage, which is particularly suitable for the continuity and real-time requirements of industrial scenarios. This is not inherent in ordinary encrypted upload processes, but is based on the system design of the present invention regarding random number input, keystream evolution, and homomorphic domain consistency reconstruction mechanisms.

[0078] Five embodiments cover typical IoT application scenarios such as health monitoring, smart metering, video feature analysis, biometric authentication, and industrial predictive maintenance. These embodiments demonstrate that the invention can be stably implemented under different data scales, dimensional structures, and real-time requirements. They also illustrate that the technical contribution of this invention lies not in simply replacing encryption algorithms, but in proposing a ciphertext bridging mechanism between resource-constrained terminals and cloud-based privacy computing. This mechanism allows for low-complexity implementation on the client side, enabling the server to obtain target ciphertext that can directly participate in homomorphic computation. It balances security, deployability, and computational continuity, providing a complete and clear implementation path for those skilled in the art and strongly supporting the essential characteristics and positive effects of the invention's technical solution.

[0079] This invention implements a system based on the above technical solution and tests its computational performance and communication overhead. The test results are shown in the figure below. This invention divides the complete business process into the TKM stage (key management end), the Client stage (client), and the Server stage (server).

[0080] In the TKM phase: This phase is the system initialization and data encryption phase, mainly including homomorphic encryption key generation (HEKeyGen) and homomorphic encryption. The HEKeyGen operation generates a homomorphic encryption key pair, with a data size of 3345 MB and a processing time of 20.9289 s. Operation is a stream key Perform homomorphic encryption to generate ciphertext. The data volume was 240 MB, and the processing time was 10.9347 seconds. This stage is a one-time initialization operation that can be completed in advance during the system deployment phase and will not affect the performance of the business during operation.

[0081] Client Phase: This phase is the client-side lightweight preprocessing phase, mainly including generating the stream cipher encryption key (SC.Hera) and lightweight encryption (SC.Enc). The SC.Hera operation generates only 1 KB of data and takes 2.3918 ms; the SC.Enc operation generates the encrypted stream ciphertext. The data size was 1 KB, and the processing time was 5.6901 ms. All operations in this stage were performed in milliseconds, significantly reducing the computational burden and communication overhead of the client device, making it suitable for performance-constrained devices such as mobile devices and edge devices.

[0082] Server Phase: This phase involves server-side encrypted computation and primarily includes format conversion (VecToPoly), coefficient mapping (SlotsToCoeffs), and ciphertext conversion (Transcipher). The VecToPoly operation converts the encrypted stream into ciphertext. Convert to polynomial format The data size was 8 MB, and the processing time was 19.9904 ms; the SlotsToCoeffs operation converts the homomorphic symmetric stream key. Mapped to homomorphic decryption key form The data size was 16 MB, and the processing time was 106.5132 s. The Transcipher operation completed the core operation, namely, converting the symmetric stream encrypted ciphertext into a homomorphically computable ciphertext format to generate the ciphertext. The data volume was 12 MB, and the processing time was 38.7416 seconds. This stage, through algorithm optimization and task splitting, ensured data security while keeping core computational overhead within an acceptable range.

[0083] The test results in Table 1 show that the present invention effectively reduces computational overhead and data transmission burden while ensuring data security, thus verifying the feasibility and practicality of the method.

[0084] Table 1

[0085]

[0086] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0087] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for ciphertext conversion in IoT scenarios, characterized in that, Includes the following steps: Step S1: The key management terminal generates the system parameters, homomorphic public key, homomorphic private key, and stream cipher master key required for homomorphic encryption; sends the homomorphic public key and public parameters to the server, sends the stream cipher master key to the client, and encrypts the stream cipher master key using the homomorphic public key to obtain the homomorphic key ciphertext corresponding to the stream cipher master key, and then sends it to the server. Step S2: The client obtains the plaintext data to be encrypted and a random number, generates a key stream based on the stream cipher master key and the random number, performs numerical encoding on the plaintext data to be encrypted, performs modular encryption using the key stream to obtain symmetric ciphertext, and sends the symmetric ciphertext to the server. Step S3: The server generates a key stream ciphertext that is consistent with the client side in the homomorphic ciphertext field based on the random number and the homomorphic key ciphertext. Step S4: The server maps the symmetric ciphertext to the message representation space supported by homomorphic encryption to obtain the intermediate ciphertext representation; Step S5: The server performs homomorphic subtraction and modulo reduction on the intermediate ciphertext representation and the key stream ciphertext in ciphertext state to obtain homomorphic ciphertext corresponding to the plaintext data to be encrypted. Step S6: Use the homomorphic ciphertext obtained in step S5 as the input ciphertext for subsequent homomorphic computation.

2. The encrypted conversion method for IoT scenarios according to claim 1, characterized in that, Step S2 involves numerically encoding the plaintext data to be encrypted, including: The plaintext data to be encrypted is represented as a sequence of real numbers of length n; Multiply the real number sequence by a preset scaling factor; The scaled result is converted into a sequence of integers and used as input data for symmetric encryption.

3. The ciphertext conversion method for IoT scenarios according to claim 1, characterized in that, The method for the server to generate the keystream ciphertext in step S3 is as follows: Based on the same random number input rules as the client side, stream cipher evolution calculations are performed on the homomorphic key ciphertext corresponding to the stream cipher master key in the homomorphic ciphertext domain to obtain the homomorphic ciphertext representations corresponding to the key stream components at each position, thereby forming a key stream ciphertext sequence.

4. The encrypted conversion method for IoT scenarios according to claim 1, characterized in that, Steps S4 and S5 include: The symmetric ciphertext is reorganized into a polynomial message representation according to the homomorphic encryption slot loading rule; The polynomial message representation is embedded into the homomorphic ciphertext operation space; Perform a slot-by-slot homomorphic subtraction between the embedded intermediate ciphertext representation and the keystream ciphertext; Then, perform modular reduction according to the modulus range used in symmetric encryption to output the target homomorphic ciphertext.

5. A ciphertext conversion system for Internet of Things (IoT) scenarios, characterized in that, The ciphertext conversion method for IoT scenarios as described in claim 1 includes: The key management module is used to generate homomorphic encryption system parameters, homomorphic public key, homomorphic private key and stream cipher master key, and send the homomorphic public key and public parameters to the server, send the stream cipher master key to the client, and generate the homomorphic key ciphertext corresponding to the stream cipher master key and send it to the server. The client encryption module is used to obtain the plaintext data to be encrypted and a random number, generate a key stream based on the stream cipher master key and the random number, perform symmetric encryption on the plaintext data to be encrypted, and output symmetric ciphertext. The server-side conversion module is used to construct a key stream ciphertext based on the random number and the homomorphic key ciphertext, perform homomorphic space mapping on the symmetric ciphertext, and perform ciphertext conversion based on the key stream ciphertext to output a target homomorphic ciphertext that can participate in homomorphic computation. The homomorphic computation module is used to receive the target homomorphic ciphertext and perform a preset homomorphic operation.

6. The encrypted text conversion system for IoT scenarios according to claim 5, characterized in that, The key management module is configured as follows: Store the homomorphic private key; Distribute the streaming cipher master key to the client; Distribute the homomorphic public key, public parameters, random number generation rules or random number sequences, and homomorphic key ciphertext corresponding to the stream cipher master key to the server.

7. The encrypted text conversion system for IoT scenarios according to claim 5, characterized in that, The server-side conversion module is configured as follows: Generate the keystream ciphertext before receiving the symmetric ciphertext; After receiving the symmetric ciphertext, the mapping from the symmetric ciphertext to the homomorphic message representation space is completed first, and then the conversion from the symmetric ciphertext to the homomorphic ciphertext is completed. The transformed target homomorphic ciphertext is output to the homomorphic computation module.

8. A ciphertext conversion device for Internet of Things (IoT) scenarios, characterized in that, The ciphertext conversion device is used to execute the ciphertext conversion method for IoT scenarios as described in claim 1, and works in conjunction with the ciphertext conversion system for IoT scenarios as described in claim 5. The ciphertext conversion device is deployed on a server and includes: The keystream ciphertext generation unit is used to generate keystream ciphertext based on a random number and the homomorphic key ciphertext corresponding to the stream cipher master key. The ciphertext mapping unit is used to convert the symmetric ciphertext sent by the client into an intermediate ciphertext representation in the homomorphic message representation space; The ciphertext conversion unit is used to perform homomorphic subtraction and modulo reduction on the intermediate ciphertext representation and the key stream ciphertext to obtain the target homomorphic ciphertext. The computation interface unit is used to send the target homomorphic ciphertext to the homomorphic computation process.

9. The encrypted conversion device for IoT scenarios according to claim 8, characterized in that, The ciphertext mapping unit is used to write multiple data components in the symmetric ciphertext into the same homomorphic message representation object according to the preset number of slots loaded, so as to improve the efficiency of batch ciphertext conversion.

10. The encrypted conversion device for IoT scenarios according to claim 8, characterized in that, After the ciphertext conversion unit outputs the target homomorphic ciphertext, it is also used to perform scaling, noise budget matching, or hierarchical parameter alignment on the target homomorphic ciphertext to meet the needs of subsequent homomorphic computation.

Images