A trusted data management method for the Internet of Things based on blockchain technology

Abstract

The present invention discloses a trusted data management method for the Internet of Things based on blockchain technology, which divides the trusted management problems faced by the Internet of Things data into four parts: trusted device authentication, trusted data transmission, trusted data storage and trusted data sharing. The present invention builds a distributed, tamper-proof communication network for gateways and edge servers based on blockchain technology. For device authentication, the present invention uses Diffie-Hellman key exchange technology to design a mutual authentication mechanism for the Internet of Things device and gateway, and designs a session key negotiation mechanism to ensure secure and reliable data transmission; for data storage, the present invention uses the Kademlia algorithm to build a distributed secure storage solution in the edge server network; finally, the present invention uses attribute-based encryption technology to implement a user access control mechanism to ensure the trusted sharing of Internet of Things data.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things and network security technology, and specifically relates to an Internet of Things trusted data management method based on blockchain technology. Background Art

[0002] With the advancement of wireless communication technology and smart device manufacturing technology, the Internet of Things technology has flourished, bringing great convenience to people's lives through the new interactive mode of the Internet of Everything. The Internet of Things has created a number of new application scenarios, including smart medical care, smart home, and smart transportation, by collecting real-time data through smart terminals to assist in high-performance decision-making. However, since the Internet of Things requires many heterogeneous devices to collaborate in a distributed manner, there are many trust issues at the data management level: First, since dishonest data sources may provide inaccurate and biased data to upper-level applications, the quality of Internet of Things services is damaged; in addition, malicious users can insert fake Internet of Things devices to disrupt applications and affect the normal operation of the Internet of Things system. These problems are caused by the lack of device authentication identity mechanism. The Internet of Things data is vulnerable to security attacks during transmission, resulting in privacy leakage and malicious tampering, etc.; In addition, the current Internet of Things data storage solution relies on third-party cloud service providers, which introduces the risk of centralization. Once the third-party organization is attacked by a single point or internal attack, it will cause serious privacy leakage and data security issues; In addition, since there is currently a lack of access control mechanism for Internet of Things data, users can obtain the required data without authorization by bribing data storage providers or eavesdropping.

[0003] The Chinese patent with publication number CN113032814A provides an IoT data management method and system, in which the IoT gateway encrypts the IoT data sent by the IoT device according to the data private key to obtain the target encrypted data, and the IoT device is a trusted device associated and authenticated by the data authentication server; the IoT gateway obtains the target data fingerprint of the target encrypted data; the IoT gateway sends the target data fingerprint and the permission information of the target encrypted data to the data authentication server for storage; the data storage server verifies the integrity of the received target encrypted data according to the target data fingerprint, and if the verification of the target encrypted data is successful, the target encrypted data is stored in the target area.

[0004] The Chinese patent with publication number CN113066552A discloses a monitoring data management system based on blockchain technology, including a device collection client, a data interaction management client, a consumer client and a blockchain node. The device collection client, the data interaction management client and the consumer client realize data interaction through the blockchain node. The patented technology adopts the Raft consensus mechanism, combines blockchain technology with hardware device data collection and data sharing, and realizes the alliance chain design and multi-role access control based on IoT devices and data interaction platforms.

[0005] From the above analysis, we can see that there are many research technologies that can solve some data management problems. Most of them focus on IoT data storage and trusted data sharing, but only solve one part of trusted data management. No one has yet proposed a set of trusted solutions for device authentication, data transmission, data storage and access control. With the booming development of blockchain technology, its decentralized, tamper-proof, traceable, secure and transparent features are widely used in the field of distributed collaboration. The integration of blockchain and cryptography technology provides an excellent solution for IoT trusted data management. In addition, by using blockchain's smart contract technology, the solution for trusted data management can be automatically encoded, breaking away from the need for third-party institutions, improving security and reducing operating costs. Summary of the invention

[0006] In view of the above, the present invention provides an IoT trusted data management method based on blockchain technology, which is divided into four parts: device identity authentication, data security transmission, trusted data storage, and trusted data sharing. It builds a distributed, tamper-proof communication network for gateways and edge servers to ensure authorized access for legitimate users, resist malicious reading of data by illegal users, and ensure trusted sharing of IoT data.

[0007] A method for managing trusted data of the Internet of Things based on blockchain technology comprises the following steps:

[0008] (1) Use asymmetric encryption algorithms and signature algorithms to complete identity security authentication between IoT terminal devices and gateways, and use Diffie-Hellman key exchange technology to complete session key negotiation between terminal devices and gateways;

[0009] (2) The terminal device uses the session key obtained through negotiation with the gateway to encrypt the original IoT data and transmit it to the gateway. The gateway then sends the encrypted data to the edge server. The edge server uses the Kademlia algorithm to implement distributed secure storage of IoT data in the edge server network.

[0010] (3) Use attribute-based encryption scheme to implement user access control mechanism for IoT data.

[0011] Furthermore, the specific implementation process of step (1) is as follows:

[0012] 1.1 A random number n is generated by the IoT terminal device a , using your own signature private key SK Sd For a and the current timestamp TS 1 Sign and use the encrypted public key PK of the gateway that needs to be authenticated Eg Encrypt the signature result to form message M 1 , and send it to the gateway;

[0013] 1.2 The gateway uses its own encrypted private key SK Eg To M 1 Decrypt, get the signature result, and then use the signature public key PK of the terminal device Sd Verify the signature and obtain n a , successful verification means that the terminal device is a legitimate device; then the gateway randomly generates a random number n b , using your own signature private key SK Sg For a 、n b And the current timestamp TS 2 Sign and use the encrypted public key PK of the terminal device Ed Encrypt the signature result to form message M 2 , and send it to the terminal device;

[0014] 1.3 The terminal device uses its own encryption private key SK Ed To M 2 Decrypt, get the signature result, and then use the gateway's signature public key PK Sg Verify the signature and obtain n a and n b If the verification is successful, it means that the gateway identity is legal; at the same time, the terminal device verifies the obtained n a Are they consistent? If they are consistent, the terminal device uses the signature private key SK Sd For b and the current timestamp TS 3 Sign and use the gateway's encrypted public key PK Eg Encrypt the signature result to form message M 3 , and send it to the gateway;

[0015] 1.4 The gateway uses its own encrypted private key SK Eg To M 3 Decrypt, get the signature result, and then use the signature public key PK of the terminal device Sd Verify the signature and obtain nb , and then verify the obtained n b Are they consistent? If they are consistent, it means that the sender is the correct interaction object, and the mutual authentication between the IoT terminal device and the gateway is completed;

[0016] 1.5 The terminal device generates a random number m D As the private key, then calculate the public key PK 1 =m D *G, G represents the group, and then uses the gateway's encryption public key PK Eg PK 1 and the current timestamp TS 4 Encrypt to form message M 4 , and send it to the gateway;

[0017] 1.6 The gateway generates a random number m G As the private key, then calculate the public key PK 2 =m G *G, and then use the encrypted public key PK of the terminal device Ed PK 2 and the current timestamp TS 5 Encrypt to form message M 5 , and send it to the terminal device;

[0018] 1.7 The gateway uses its own encrypted private key SK Eg To M 4 Decrypt and get PK 1 Then calculate the security session key SKey between it and the terminal device = m G *PK 1 =m G *m D *G; the terminal device uses its own encrypted private key SK Ed To M 5 Decrypt and get PK 2 Then calculate the security session key SKey between it and the gateway = m D *PK 2 =m D *m G *G, the session key negotiation between the IoT terminal device and the gateway is now completed.

[0019] Furthermore, the specific implementation process of step (2) is as follows:

[0020] 2.1 The IoT terminal device uses the secure session key SKey between it and the gateway to encrypt the original IoT data and transmit it to the gateway, which then forwards the encrypted data to the nearest edge server S 1 ;

[0021] 2.2 Edge Server S 1 The 160-bit hash used to calculate the encrypted data is used as the Key, and the encrypted data is used as the Value. According to the k value set by the system, the k edge servers whose ID numbers are closest to the Key are found, and the Key-Value is then transmitted to these k edge servers for storage, thus completing the distributed storage of IoT data in the edge server network.

[0022] Furthermore, the specific implementation process of step (3) is as follows:

[0023] 3.1 The data owner stores the access policy P on the gateway, and the gateway executes Setup(1 λ )→(PK,MSK), that is, the system public key PK and the system master key MSK are calculated according to the security parameter λ, and then the PK is embedded into the transaction and sent to the blockchain network, while the MSK is stored locally;

[0024] 3.2 The user sends a data request to the edge server. The edge server first verifies the user's identity and then interacts with the gateway using a smart contract. If the user's identity is legitimate, the gateway will generate a corresponding attribute set S for it, the user's public key PK user It will be stored in the smart contract as an authorized user identifier, and the gateway will generate a private key for the user;

[0025] 3.3 The gateway executes KeyGen(PK,MSK,S)→SK, that is, inputs the system public key PK, the system master key MSK and the user's attribute set S, and calculates the output user access private key SK; the gateway uses the user public key PK user Encrypt SK and embed the encryption result into the transaction, and send the transaction ID and smart contract address to the edge server through the blockchain;

[0026] 3.4 The edge server receives the encryption result and transmits it to the user. The user uses his own private key SK user After decrypting it, the user access private key SK is obtained;

[0027] 3.5 The gateway executes Encrypt(PK,P,SKey)→CT, that is, inputs the system public key PK, access policy P, and the session key SKey between the IoT terminal device and the gateway, generates the ciphertext CT, completes the encryption of the session key SKey, and then the gateway sends the ciphertext CT to the edge server for storage through the blockchain network;

[0028] 3.6 The user uses the Kademlia algorithm to download the encrypted data and ciphertext CT from the edge server, and runs Decrypt(PK,SK,CT)→SKey, that is, inputs the system public key PK, the user access private key SK and the ciphertext CT, and decrypts to obtain the session key Skey; if the user's attribute set S satisfies the access policy P set by the data owner, SKey can be successfully decrypted, otherwise the decryption fails;

[0029] 3.7 The user executes Decrypt(SKey, encrypted data) → original data, and uses the session key SKey to decrypt the encrypted data to obtain the original IoT data.

[0030] Furthermore, in step 3.6, the specific process of the user using the Kademlia algorithm to download the encrypted data and the ciphertext CT from the edge server is as follows:

[0031] 3.6.1 The user initiates a search request to the edge server based on the Key of the requested data. The edge server checks whether it has stored the data pair (Key, Value). If so, it returns the encrypted data directly to the user. Otherwise, it finds the k node IDs closest to the Key value and sends a FIND_VALUE request to these k nodes (i.e., the edge servers in the network);

[0032] 3.6.2 The node that receives the FIND_VALUE request first checks whether the data pair (Key, Value) is stored locally. If so, it returns the encrypted data to the sender's edge server. Otherwise, the node finds the k node IDs closest to the Key value and sends a FIND_VALUE request to these k nodes. The search continues in this way until the encrypted data is obtained or an edge server with a node ID closer to the Key value than the currently known node ID cannot be obtained (this means that the data the user is looking for does not exist).

[0033] The identity authentication scheme between the terminal device and the gateway designed by the present invention effectively curbs the security risk of malicious devices accessing the network and ensures the legitimacy of the IoT data source; by designing the session key negotiation mechanism between the terminal device and the gateway, the confidentiality of the data during the transmission process is protected to avoid eavesdropping and tampering attacks; in addition, the present invention builds a reliable distributed data storage scheme in the edge network based on the Kademlia algorithm, which greatly reduces the security and privacy risks of centralized storage, solves the bandwidth bottleneck, and greatly improves the scalability of data storage. Finally, since the present invention designs a set of active access control mechanisms based on attribute-based encryption, only users whose attribute sets match the access policies formulated by the data owner can obtain access authorization, which ensures the data availability of authorized users, effectively prevents malicious users from taking illegal means to obtain original data, improves the security of consumer-level users accessing data, protects the original value of IoT data, and realizes user-oriented permission management. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 The figure is a schematic diagram of the authentication process between the IoT terminal device and the gateway of the present invention.

[0035] Figure 2 The figure is a schematic diagram of the session key negotiation process of the present invention.

[0036] Figure 3 It is a schematic diagram of the trusted data management process of the present invention. DETAILED DESCRIPTION

[0037] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0038] The present invention uses Diffie-Hellman key exchange technology, asymmetric encryption, signature algorithm, Kademlia algorithm, and attribute-based encryption technology based on blockchain technology to implement an IoT trusted data management solution. Gateway devices and edge servers serve as blockchain nodes to maintain a blockchain network, and perform logical interactions by calling smart savings. The overall process is as follows Figure 3 shown.

[0039] like Figure 1 As shown, the IoT terminal and the gateway perform two-way authentication to verify the legitimacy of the device joining the network. The specific steps are as follows:

[0040] Step 1: The IoT terminal device randomly generates a random number n a , using your own signature private key SK Sd For a and real-time timestamp TS 1Sign, and use the encrypted public key PK of the gateway that needs to be authenticated Eg Encrypt the signature result to form message M 1 , and send it to the corresponding gateway.

[0041] Step 2: The gateway uses its own encrypted private key SK Eg To M 1 Decrypt and then use the IoT device's signature public key PK Sd Verify the signature and obtain n a , successful verification means that the IoT device is a legitimate device, and then the gateway randomly generates a random number n b , and then use the signature private key SK Sg For a 、n b and real-time timestamp TS 2 Sign, and use the encrypted public key PK of the IoT device that needs to be authenticated Ed Encrypt the signature result to form message M 2 , and then feed back to the IoT devices.

[0042] Step 3: The IoT device uses its own encrypted private key SK Ed To M 2 Decrypt and get the signature result, using the gateway's signature public key PK Sg Verify the signature. If the verification is successful, it means that the gateway identity is legal. At the same time, the device verifies the obtained n a Is it correct? If it is correct, the IoT device uses the signature private key SK Sd For b and real-time timestamp TS 3 Sign and use the gateway's encrypted public key PK Eg Encrypt the signature result to form message M 3 , which is then sent to the gateway.

[0043] Step 4: Gateway uses encrypted private key SK Eg To M 3 Decrypt and then use the IoT device's signature public key PK Sd Verify the signature and obtain n b , verify n b Are they consistent? If they are consistent, it means that the sender is the correct interaction object, and the mutual authentication between the IoT device and the gateway is completed.

[0044] like Figure 2 As shown in the figure, the IoT device negotiates the session key with the gateway to protect the security of the data transmitted during the communication process. The specific steps are as follows:

[0045] Step 1: The IoT device randomly generates a number mD As the private key, then calculate the public key PK 1 =m D *G, then the IoT device uses the gateway's encrypted public key PK Eg PK 1 and real-time timestamp TS 4 Encrypt to form message M 4 , and send it to the gateway.

[0046] Step 2: Gateway accepts M 4 , and randomly generate a number m G As the private key, then calculate the public key PK 2 =m G *G, then the gateway uses the encrypted public key PK of the IoT device Ed PK 2 and real-time timestamp TS 5 Encrypt to form message M 5 , and then feed back to the IoT devices.

[0047] Step 3: The IoT device calculates the secure session key SKey=m with the gateway D *PK 2 =m D *m G *G.

[0048] Step 4: The gateway calculates the secure session key with the IoT device: SKey = m G *PK 1 =m D *m G *G, thus completing the session key negotiation between IoT devices.

[0049] After the IoT device completes mutual identity authentication and session key negotiation with the gateway, the data owner uploads the IoT data access policy P to the gateway, and then the gateway executes Encrypt(PK, P, SKey)→CT, that is, inputs the system public key PK, data access policy P and session key SKey, outputs the ciphertext CT, and completes the encryption of the session key SKey. At the same time, the IoT device uses SKey to encrypt the original data and sends the encrypted data to the gateway, which sends (CT, encrypted data, timestamp) to the edge server for storage through the blockchain network.

[0050] The present invention proposes a distributed secure storage solution using the Kademlia algorithm. The specific process is as follows: the edge server calculates the 160-bit hash value of the encrypted data as the Key, and the encrypted data as the Value. According to the k value set by the system, the k edge servers whose ID numbers (each edge server has a 160-bit ID number) are closest to the Key are found, and the Key-Value, CT and timestamp are transmitted to the k edge servers through the blockchain network for storage. At this point, the distributed storage of IoT data in the edge server network is completed.

[0051] The distributed redundant storage solution proposed in the present invention has two significant advantages: first, since the encrypted data is stored in multiple copies, even if one of the edge servers is attacked, it will not affect the data search, ensuring the availability of services and improving the robustness of the system; in addition, the Kademlia algorithm provides an efficient data query method that can be used in the log 2 N The target edge server can be located within a certain time, so that users can get the service quickly.

[0052] In order to prevent illegal access to IoT data, the present invention uses attribute-based encryption technology to design an access control mechanism for IoT data users. The specific steps are as follows:

[0053] Step 1: When a user needs to use IoT data, he sends a data request to the nearest edge server and provides his public key information and identity information.

[0054] Step 2: The edge server transmits the user information to the gateway via blockchain.

[0055] Step 3: The gateway first determines whether the user identity is legal. If it is legal, it generates the corresponding attribute base S and the user's public key PK. user It will be stored in the smart contract as an authorized user identifier; then the gateway runs KeyGen(PK,MSK,S)→SK, inputs the system public key PK, the system master key MSK and the user's attribute set S, and outputs the user access private key SK; the gateway uses the user's public key PK user Encrypt SK and embed the encrypted result into the blockchain transaction, and send the transaction ID and smart contract address to the edge server through the blockchain.

[0056] Step 4: The user first downloads the system public key PK and the encrypted private key SK from the edge server network, and uses the private key SK user Decrypt SK, and then use the Kademlia query algorithm to find the encrypted data block and CT from the edge server network. The specific process is as follows:

[0057] Step 4-1: The data user initiates a search request to the edge server based on the Key of the requested data. The edge server checks whether it has stored the (Key, Value) data pair. If so, it directly returns the encrypted data to the user. Otherwise, it finds the k nodes closest to the Key value and sends a FIND_VALUE request to these k node IDs.

[0058] Step 4-2: The node that receives the FIND_VALUE request first checks whether it has stored the (Key, Value) data pair. If so, it returns the encrypted data to the sender edge server. Otherwise, it finds the k nodes closest to the Key value again and sends a FIND_VALUE request to these k node IDs.

[0059] Step 4-3: The above steps are repeated until VALUE is obtained or an edge server with a closer key value than the currently known server ID cannot be obtained, which means that the data the user is looking for does not exist.

[0060] Step 5: The user runs Decrypt(PK,SK,CT)→SKey, inputs the system public key PK, the user private key SK and the encrypted session key CT, and outputs the session key Skey; if the user's attribute set S satisfies the access policy P set by the data owner, SKey can be successfully decrypted, otherwise the decryption fails.

[0061] Step 6: The user runs Decrypt(SKey, encrypted data) → original data, and uses the session key SKey to decrypt the encrypted data to obtain the original data.

[0062] The present invention ensures authorized access by legitimate users through the access control mechanism, resists malicious reading of data by illegal users, and realizes trusted sharing of IoT data.

[0063] The above description of the embodiments is to facilitate the understanding and application of the present invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments. Improvements and modifications made by those skilled in the art to the present invention based on the disclosure of the present invention should be within the protection scope of the present invention.

Claims

1. A method for managing trusted data of the Internet of Things based on blockchain technology, comprising the following steps: (1) Use asymmetric encryption algorithms and signature algorithms to complete identity security authentication between IoT terminal devices and gateways, and use Diffie-Hellman key exchange technology to complete session key negotiation between terminal devices and gateways. The specific implementation process is as follows: 1.1 A random number n is generated by the IoT terminal device a , using your own signature private key SK Sd For a Sign with the current timestamp TS1 and use the encrypted public key PK of the gateway that needs to be authenticated Eg Encrypt the signature result to form message M1 and send it to the gateway; 1.2 The gateway uses its own encrypted private key SK Eg Decrypt M1 to get the signature result, and then use the signature public key PK of the terminal device Sd Verify the signature and obtain n a , successful verification means that the terminal device is a legitimate device; then the gateway randomly generates a random number n b , using your own signature private key SK Sg For a 、n b And the current timestamp TS2 is signed, and the encrypted public key PK of the terminal device is used Ed The signature result is encrypted to form a message M2, and sent to the terminal device; 1.3 The terminal device uses its own encryption private key SK Ed Decrypt M2 to get the signature result, and then use the gateway's signature public key PK Sg Verify the signature and obtain n a and n b If the verification is successful, it means that the gateway identity is legal; at the same time, the terminal device verifies the obtained n a Are they consistent? If they are consistent, the terminal device uses the signature private key SK Sd For b Sign with the current timestamp TS3 and use the gateway's encrypted public key PK Eg Encrypt the signature result to form message M3 and send it to the gateway; 1.4 The gateway uses its own encrypted private key SK Eg Decrypt M3 to get the signature result, and then use the signature public key PK of the terminal device Sd Verify the signature and obtain n b , and then verify the obtained n b Are they consistent? If they are consistent, it means that the sender is the correct interaction object, and the mutual authentication between the IoT terminal device and the gateway is completed; 1.5 The terminal device generates a random number m D As the private key, then calculate the public key PK1 = m D *G, G represents the group, and then uses the gateway's encryption public key PK Eg Encrypt PK1 and the current timestamp TS4 to form message M4 and send it to the gateway; 1.6 The gateway generates a random number m G As the private key, then calculate the public key PK2 = m G *G, and then use the encrypted public key PK of the terminal device Ed Encrypt PK2 and the current timestamp TS5 to form a message M5, and send it to the terminal device; 1.7 The gateway uses its own encrypted private key SK Eg Decrypt M4, obtain PK1, and calculate the secure session key SKey between it and the terminal device = m G *PK1=m G *m D *G; the terminal device uses its own encrypted private key SK Ed Decrypt M5, obtain PK2, and calculate the secure session key SKey between it and the gateway = m D *PK2=m D *m G *G, the session key negotiation between the IoT terminal device and the gateway is now completed; (2) The terminal device uses the session key obtained through negotiation with the gateway to encrypt the original IoT data and transmit it to the gateway. The gateway then sends the encrypted data to the edge server. The edge server uses the Kademlia algorithm to implement distributed secure storage of IoT data in the edge server network. The specific implementation process is as follows: 2.1 The IoT terminal device uses the secure session key SKey between it and the gateway to encrypt the original IoT data and transmit it to the gateway, which then forwards the encrypted data to the nearest edge server S1; 2.2 Edge server S1 uses the 160-bit hash used to calculate the encrypted data as the Key, the encrypted data as the Value, and finds the k edge servers whose ID numbers are closest to the Key according to the k value set by the system, and then transmits the Key-Value to these k edge servers for storage, thus completing the distributed storage of IoT data in the edge server network; (3) Use attribute-based encryption scheme to implement user access control mechanism for IoT data. The specific implementation process is as follows: 3.1 The data owner stores the access policy P on the gateway, and the gateway executes Setup(1 λ )→(PK,MSK), that is, the system public key PK and the system master key MSK are calculated according to the security parameter λ, and then the PK is embedded into the transaction and sent to the blockchain network, while the MSK is stored locally; 3.2 The user sends a data request to the edge server. The edge server first verifies the user's identity and then interacts with the gateway using a smart contract. If the user's identity is legitimate, the gateway will generate a corresponding attribute set S for it, the user's public key PK user It will be stored in the smart contract as an authorized user identifier, and the gateway will generate a private key for the user; 3.3 The gateway executes KeyGen(PK,MSK,S)→SK, that is, inputs the system public key PK, the system master key MSK and the user's attribute set S, and calculates the output user access private key SK; the gateway uses the user public key PK user Encrypt SK and embed the encryption result into the transaction, and send the transaction ID and smart contract address to the edge server through the blockchain; 3.4 The edge server receives the encryption result and transmits it to the user. The user uses his own private key SK user After decrypting it, the user access private key SK is obtained; 3.5 The gateway executes Encrypt(PK,P,SKey)→CT, that is, inputs the system public key PK, access policy P, and the session key SKey between the IoT terminal device and the gateway, generates the ciphertext CT, completes the encryption of the session key SKey, and then the gateway sends the ciphertext CT to the edge server for storage through the blockchain network; 3.6 The user uses the Kademlia algorithm to download encrypted data and ciphertext CT from the edge server, that is, the user initiates a search request to the edge server based on the Key of the requested data. The edge server checks whether it has stored the data pair (Key, Value). If so, it directly returns the encrypted data to the user. Otherwise, it finds the k node IDs closest to the Key value and sends a FIND_VALUE request to these k nodes. The node that receives the FIND_VALUE request first checks whether the data pair (Key, Value) is stored locally. If so, it returns the encrypted data to the sending edge server. Otherwise, the node finds the k node IDs closest to the Key value and sends a FIND_VALUE request to these k nodes. The search continues to spread until the encrypted data is obtained or the edge server whose node ID is closer to the Key value than the currently known node ID cannot be obtained. Then run Decrypt(PK,SK,CT)→SKey, that is, input the system public key PK, the user access private key SK and the ciphertext CT, and decrypt to get the session key Skey; if the user's attribute set S meets the access policy P set by the data owner, SKey can be successfully decrypted, otherwise the decryption fails; 3.7 The user executes Decrypt(SKey, encrypted data) → original data, and uses the session key SKey to decrypt the encrypted data to obtain the original IoT data.

Images