A method for determining truth value of public verification based on privacy protection

Abstract

The present invention relates to a method for determining a truth value through public verification based on privacy protection. In the truth value discovery phase, the task executor and the platform use a threshold-based Paillier homomorphic encryption system to complete the truth value discovery under the premise of protecting the privacy data of the task executor. At the same time, the task executor generates a homomorphic hash value related to its own data and a corresponding random number and commitment value in the truth value discovery phase, and sends the commitment value to the platform, retains the homomorphic hash value and the random number, and the platform sends these commitment values ​​to the verifier. In the verification phase, the task executor sends all homomorphic hash values ​​and random numbers to the verifier through the platform, and the verifier uses the random number and homomorphic hash value to verify the commitment value received from the platform to prevent the platform from tampering with the data. After verification, individuals with computing capabilities can use the computing data disclosed by the platform to verify the truth value discovery results. This method reduces the computing overhead and communication overhead of users and platforms while protecting user privacy.

Description

Technical Field

[0001] The present invention relates to a method for publicly verifying the correctness of a computing task result, and specifically to a method for publicly verifying the correctness of a true value result based on privacy protection, and belongs to the fields of verifiable computing, privacy protection technology and truth value discovery computing. Technical Background

[0002] In recent years, with the rapid increase of mobile smart devices and the rapid development of Internet of Things technology and communication technology, the Internet of Everything is getting closer and closer. On this basis, a business model called crowd intelligence perception has been developed. This model uses the mobility, perception and data collection of mobile smart devices to enable an individual (task initiator) to publish perception tasks to mobile smart device owners (task executors) on relevant platforms. Task executors then upload their device perceptions and generate data to the platform. Task initiators can obtain messages through the platform, and then task requesters can pay commissions to task executors through the platform. In this model, task initiators and task executors cannot communicate with each other. They can only communicate with the platform, and task executors are allowed to perform multiple perception tasks at the same time.

[0003] Since the task initiator and the platform cannot avoid some task executors sending false data, the truth value discovery algorithm is introduced. Truth value discovery can derive a data close to the true value (that is, data that can correspond to the true situation of the perception object of the perception task) from a pile of data without prior knowledge, which can solve the problem of some false data. Truth value discovery requires the platform to perform two iterative calculations - weight update calculation and truth value update calculation. After the specified number of iterations are completed, or the difference between the true value at the end of an iteration and the true value at the end of the previous iteration is within a certain set threshold, the iteration can be ended. In this iterative process, the platform needs to bear certain computing overhead and communication overhead.

[0004] However, platforms are usually for-profit. On the one hand, under the premise of being able to complete truth value discovery, the platform hopes to reduce its own operating costs, such as returning random values ​​to the task initiator, thereby reducing computing overhead. On the other hand, the platform is also interested in the identity information of the task initiator and task executor, the collected data and other information, because this information has certain commercial value. This raises two security issues in truth value discovery: one is the privacy protection issue, that is, how to protect the personal privacy information of the task initiator and task executor and the collected data from being known by the platform; the other is how to ensure that the platform correctly executes the truth value discovery algorithm instead of returning a random value.

[0005] At present, there are many ways to solve the first security problem, but it is very difficult to solve both security problems at the same time. One known method is to use multi-source data polynomial verification method and differential privacy method. However, the disadvantage of this method is that the computational overhead and communication overhead are very large. The task initiator and the platform often need to bear huge overhead, and the verifier can only be the task initiator, which leads to great limitations of this method. Summary of the invention

[0006] The purpose of the present invention is to address the technical defects of the existing technology such as security vulnerabilities and excessive computational overhead. In order to simultaneously solve the technical problems such as privacy protection in truth value discovery and ensuring that the platform can correctly execute the truth value discovery algorithm, a public verification truth value determination method based on privacy protection is creatively proposed.

[0007] The core idea of ​​the present invention is to divide the whole process into a truth value discovery phase and a verification phase.

[0008] In the truth value discovery phase, the task executor and the platform use the threshold-based Paillier homomorphic encryption system to complete the truth value discovery algorithm while protecting the task executor's privacy data. At the same time, the task executor generates homomorphic hash values ​​related to its own data and the corresponding random numbers and commitment values ​​in the truth value discovery phase, and sends the commitment values ​​to the platform, retaining the homomorphic hash values ​​and random numbers, and the platform sends these commitment values ​​to the verifier.

[0009] In the verification phase, the task executor sends all homomorphic hash values ​​and random numbers to the verifier through the platform. The verifier first uses these random numbers and homomorphic hash values ​​to verify the commitment values ​​previously received from the platform to prevent the platform from tampering with the data. After verification, individuals with computing capabilities can use the computing data previously disclosed by the platform to verify the results of the truth value discovery.

[0010] In order to achieve the above object, the present invention adopts the following technical scheme.

[0011] A method for determining truth value of public verification based on privacy protection includes three main objects: user, platform and verifier.

[0012] Among them, users refer to registered users who have registered on the platform and hold mobile intelligent sensing devices, referred to as users for short, and are divided into task initiators and task executors. Task initiators are referred to as initiators for short; task executors are referred to as executors for short.

[0013] The initiator is responsible for uploading his / her own perception task to the platform. Afterwards, the initiator can become an executor to upload data to the platform, or become a verifier to verify the final result. Finally, the initiator will receive the task result returned by the platform and the verification result returned by the verifier.

[0014] The executor receives a perception task from the platform, obtains perception data using its own device, and encrypts and uploads it to the platform. Subsequently, the executor assists the platform in completing the truth discovery algorithm and generates the data required for the verification phase;

[0015] After obtaining the data required for verification from the platform, the verifier verifies the calculation results of the platform and finally securely transmits the verification results to the initiator and the executor through the platform.

[0016] Step 1: Initialization. First, a trusted third-party institution, hereinafter referred to as the trusted institution, generates the public key of the Paillier homomorphic encryption system that supports the threshold and a complete private key, and at the same time generates a part of the private key for the platform and all its users respectively. After that, the trusted institution publishes the public key, transmits the corresponding other part of the private key to the platform and each user through a secure channel, and saves and keeps secret the complete private key after aggregating the two parts. Then, the trusted institution publishes the parameters of the homomorphic hash algorithm. Finally, the trusted institution selects a curve as the encryption curve for the Elliptic Curve Diffie–Hellman key Exchange (i.e., the ECDH algorithm), and generates the private key of the Elliptic Curve Diffie–Hellman key Exchange for each user.

[0017] The present invention further provides a specific implementation method for Step 1, including the following steps:

[0018] Step 1.1: The trusted institution selects two prime numbers δ and β such that δ = 2δ′ + 1, β = 2β′ + 1, where δ′ and β′ are both prime numbers. Let τ = δβ, γ = δ′β′, and let be divisible by γ, and at the same time satisfy has a remainder of 1 when divided by τ, which is the complete private key. At this time, a public key PK = (θ, τ) of the Paillier homomorphic encryption system that supports the threshold is generated, where θ = τ + 1. At this time, the trusted institution selects a number X greater than the number of users U, and assumes that X is twice the number of users U, and generates a polynomial as shown in Equation 1:

[0019]

[0020] where x represents that when at least x partial private keys decrypt the ciphertext C of the partial plaintext, the ciphertext C is the ciphertext obtained by encrypting the plaintext M with PK, and the corresponding plaintext M of C can be obtained; a 0 、a i are all coefficients of X, and a i ∈{0, 1, …, τ(γ - 1)}, 0 < i < x; the private keys of the users and the platform are s i, according to formula 1, s i =f(i),1≤i≤U+1.

[0021] The trusted institution will make PK = (θ, τ) public. The trusted institution will make the private key s corresponding to each user and platform i The trusted institution sends the complete private key to them through a secure communication channel without letting any third party know. Keep it confidential.

[0022] Step 1.2: The trusted institution selects a generator g based on the security parameter κ. q is a prime number, g and q are the public parameters Lpp. Let the maximum number of iterations of truth value discovery be L, and the upper limit of the number of perception tasks in a single truth value discovery be T. Let T>L, then the trusted institution selects T parameters: And make it public.

[0023] Step 1.3: The trusted institution selects an elliptic curve α as the ECDH encryption curve, and then generates an ECDH private key sk for each user i and sent to each user through a secure communication channel.

[0024] Step 2: Users negotiate keys.

[0025] Specifically, each user u i Using the platform as an intermediary to communicate with other users j Use ECDH method to exchange keys and get the symmetric key k i,j Afterwards, users publish / receive perception tasks on the platform.

[0026] Step 3: Weight update.

[0027] The user accepts the perception task on the platform and learns the data accuracy P of the perception task, that is, the accuracy of all data in this task is P decimal places. Each user processes his or her perception data and encrypts it and sends it to the platform. The platform uses the Paillier homomorphic encryption security aggregation method based on the support threshold to aggregate the ciphertext of all users and obtain the aggregated plaintext. Finally, the platform updates the weight of each user.

[0028] Among them, the Paillier homomorphic encryption security aggregation method based on support threshold, referred to as the security aggregation method, is as follows:

[0029] Input: Each user u i The encrypted data c i , and c i The corresponding plaintext m i, where i∈[1,U];

[0030] Output: Plaintext aggregate value of all users

[0031] First, each user u i Send encrypted data to the platform c i ;

[0032] Then, the platform multiplies all the ciphertexts to get the aggregate value: The platform selects at least x-1 users and sends them the aggregate value The selected user uses his or her own partial private key to decrypt The obtained partial plaintext A is sent to the platform. The platform finally receives at least x-1 copies of partial plaintext A, plus the partial plaintext B calculated by itself, and uses the threshold-supported Paillier homomorphic encryption joint decryption method to obtain the complete plaintext, that is,

[0033] Among them, the Paillier homomorphic encryption security aggregation method based on support threshold is referred to as the security aggregation method.

[0034] The present invention further provides a specific implementation method of step 3, which includes the following steps.

[0035] Step 3.1: User u i Getting your own perception data After that, calculate the distance between your perception data and the initial true value in, Represents the perception data vector The tth data of represents the true value of the t-th perception task in the first iteration, 1≤t≤T, T represents a total of T tasks. Then, U i Get aggregate value Finally, u i Calculate two Piallier homomorphically encrypted ciphertexts: Enc(Disk i *10 2P ) and Enc(log(Disk i )*10 2P ), where log(Disk i ) has a precision of P.

[0036] Step 3.2: User u i Calculate the homomorphic hash value h i : Generate a random value r i, obtain the commitment value c through the commitment method COM.Commit() instantiated by SHA-256 i ←COM.Commit(h i ,r i ), where g 1 Indicates the homomorphic hash parameter taken in the first round of iteration. The parameter selected in the lth round is g l , P means log(Disk i ) precision. After that, u i Enc(Disk i *10 2P ) and Enc(log(Disk i )*10 2P ) is sent to the platform, and c i Sent to the validator via the platform.

[0037] Step 3.3: The platform aggregates all Enc (Disk i *10 2P )Ciphertext: Then the plaintext Sum of the aggregate value is obtained through the secure aggregation algorithm, where The platform calculates Enc(log(Sum)*10 2P ), and then calculate Enc(w i *10 2P )=Enc(log(Sum)*10 2P )·Enc(log(Disk i )*10 2P ) -1 Get user u i Encrypted weights. Finally, the platform will obtain all the encrypted weights Enc(w j *10 2P ) and commitment value c j Send to user U i ,where i,j∈[1,U].

[0038] Step 4: Weight decryption. Each user decrypts their own weight ciphertext through the platform as an intermediate communicator, without leaking their own weight plaintext.

[0039] The present invention further provides a specific implementation method of step 4, comprising the following steps:

[0040] Step 4.1: User u i Use your own part of the private key i To other users j Decrypt the encryption weights one by one to obtain the partial plaintext HalfDec(wj *10 2P ) i At the same time, use the corresponding user U j The symmetric key k i,j Encrypt the above plaintext by AES-OFB symmetric encryption method to get C_HalfDec(w j *10 2P ) i , where j∈[1,U]∩i≠j. User u i The above ciphertext is sent to the platform. After receiving it, the platform sends the ciphertext to the corresponding user.

[0041] Step 4.2: User u i The platform receives the ciphertext C_HalfDec(w i *10 2P ) j Afterwards, through k i,j Decryption restores at least x parts of the ciphertext: (HalfDec(w i *10 2P ) 1 ,…,HalfDec(w i *10 2P ) x ), then the plaintext w is obtained by the joint decryption method in the threshold-supported Paillier homomorphic encryption method i *10 2P , then u i Get your own weighted plaintext w i .

[0042] Step 5: True value update. Each user completes the true value update of the perception task together with the platform without disclosing their own weights and perception data.

[0043] The present invention further provides a specific implementation method of step 5, comprising the following steps:

[0044] Step 5.1: User u i Calculate the product of the weight and each sensor data and encrypt it to get the Pillier homomorphic ciphertext Among them i∈[1,U],t∈[1,T]. u i Send these ciphertexts to the platform.

[0045] Step 5.2: User u i Compute two homomorphic hash values: and Generate two random numbers rr i With rw iThen, through the commitment method COM.Commit() instantiated by SHA-256, two commitment values ​​cc are obtained i ←COM.Commit(hh i ,rr i ) and cw i ←COM.Commit(hw i ,rw i ). i cc i With cw i Sent to the validator via the platform.

[0046] Step 5.3: After receiving the data sent by all users in steps 5.1 and 5.2, the platform calculates and Then, we get T+1 aggregate values. Then, we get T+1 aggregate value plaintexts through the secure aggregation method: and Where t∈[1,T]. Afterwards, the platform updates the true value of the t-th perception task in the next round through Equation 2:

[0047]

[0048] Step 6: Iteration. Repeat steps 3 to 5 until the true values ​​of all perception tasks converge (i.e.: ), or the upper limit L of the number of loops is reached, the loop stops.

[0049] Step 7: Verification. All users will verify the homomorphic hash value h generated in each round. i 、hh i With hw i And the corresponding random number r i ,rr i With rw i The platform sends the data to the verifier. The verifier verifies each commitment value first. If a certain verification fails, the platform true value result can be determined to be incorrect; otherwise, subsequent verification calculations are performed.

[0050] The present invention further provides a specific implementation method of step 7, comprising the following steps:

[0051] Step 7.1: All users will generate their own homomorphic hash values ​​h in each round. i 、hh i With hw i And the corresponding random number r i ,rr i With rw iSent to the verifier through the platform. The verifier verifies each commitment value through the decommitment method COM.Deommit() instantiated by SHA-256:

[0052] 1←COM.Deommit(c′ i ,h′ i ,r′ i )

[0053] 1←COM.Deommit(cc′ i ,hh′ i ,rr′ i )

[0054] 1←COM.Deommit(cw′ i ,hw′ i ,rw′ i )

[0055] Among them, h′ i ,hh′ i , hw′ i Indicates the user u forwarded by the platform to the verifier i The homomorphic hash value of i ,rr′ i , rw′ i Indicates the user u forwarded by the platform to the verifier i A random number; c′ i ,cc′ i , cw′ i Indicates the user u forwarded by the platform to the verifier i If all the committed values ​​pass the verification, the verification operation will continue; otherwise, the true value result of the platform is judged to be incorrect.

[0056] Step 7.2: The verifier verifies the result of the weight update through equation 3 and equation 4:

[0057]

[0058] w i,l =log(Sum′ l )-log(Disk i,l ),0 <l≤L (4)

[0059] Among them, h i,l 、w i,l , respectively represent the user u in the first iteration i The generated homomorphic hash value, weighted plaintext and the obtained aggregate value Disk,Sum′ l is the Sum disclosed by the platform in the first iteration, g l Represents the lth parameter in T generated by a trusted authority.

[0060] The verifier first calculates equation 3. If equation 3 is not true, the verifier returns the result "0", indicating that the verification failed; otherwise, it verifies equation 4. If equation 4 is not true, the verifier returns the result "0"; the above situations are all considered verification failures, and the true value results of the platform are incorrect; finally, if both equations 3 and 4 are true, the result "1" is returned, indicating that the verification passed.

[0061] Among them, the verifier's results must be forwarded to the user through the platform. To prevent the platform from tampering with the results, the verifier first calculates the corresponding commitment value in the message sent to the user, and then sends the commitment value first. After the user receives the commitment value, the corresponding result and random number are sent. This method is also applicable to the subsequent steps. The user receives the verification result sent by the verifier and verifies Formula 3 again. Only when all users pass the verification can the next step of verification be carried out, otherwise the verification fails.

[0062] Step 7.3: The verifier verifies the result of the truth value update through equations 5, 6, and 7:

[0063]

[0064]

[0065]

[0066] Among them, Swd′ t,l and Sw′ l Indicates the Swd disclosed by the platform in the first iteration t and Sw;hh i,l ,hw i,l They represent user u in the first iteration i The two homomorphic hash values ​​generated in step 6.2, represents the true value of the tth task in the lth iteration; g l , g t They represent the lth and tth parameters in T generated by the trusted institution in step 1.2, respectively. t is the tth random positive integer generated by the verifier.

[0067] The verifier first calculates formula 5. If formula 5 does not hold, the verifier returns the result "0", indicating that the verification fails; otherwise, it verifies formula 6. If formula 6 does not hold, the verifier returns the result "0"; otherwise, it verifies formula 7. If formula 7 does not hold, the verifier returns the result "0"; the above situations are all considered as verification failures.

[0068] Finally, if Equation 5, Equation 6, and Equation 7 are all true, the result "1" is returned, indicating that the verification is successful and the true value result of the platform is correct.

[0069] Beneficial Effects

[0070] Compared with the prior art, the method of the present invention has the following advantages:

[0071] 1. This method realizes public verification, that is, any third party can verify the results by obtaining all public data;

[0072] 2. This method uses a homomorphic hash algorithm, which allows the verifier to verify the calculation results of the platform at the end of any iteration, increasing the flexibility of verification;

[0073] 3. This method uses homomorphic encryption and homomorphic hashing methods to reduce the computing and communication costs of users and platforms while ensuring the protection of user privacy. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Figure 1 Schematic diagram of the model of the method of the present invention.

[0075] Figure 2 This is an experimental diagram comparing the computational overhead of the method of the present invention with similar methods.

[0076] Figure 3 This is a comparison experiment diagram of the communication overhead between the method of the present invention and similar methods. DETAILED DESCRIPTION

[0077] The present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0078] Example

[0079] like Figure 1 As shown, a method for determining a truth value based on public verification based on privacy protection includes collecting perception data, corresponding to Figure 1 The "1" in ; weight update, corresponding to Figure 1 "2", "3", "4" in; the truth value is updated, corresponding to Figure 1 "5", "6" in the verification phase, corresponding to Figure 1 There are four stages "7" and "8" in it. Figure 1 The system initialization and key negotiation process for each user are omitted.

[0080] The taxi business is a travel application scenario of the Internet of Vehicles. The taxi platform can create an APP that integrates payment, task publishing and task collection. The driver can install the APP on the device in the car to register as a user of the taxi platform (task executor). A research institution can also publish perception tasks on the platform as a user of the platform (task requester). For example, in order to conduct research, the institution needs to understand the average income of drivers in City S, so it publishes targeted perception tasks on the platform, and only taxi drivers in City S can receive the task through the platform. After receiving the task, the taxi driver in City S sends encrypted data to the platform as an executor and maintains communication with the platform until the verification phase is over.

[0081] The execution time of such tasks should be as short as possible, and the executors obviously do not want the execution time of the tasks to be too long; and the income is a kind of private information, and the executors are also unwilling to disclose it; at the same time, the executors use on-board equipment with limited computing power. Therefore, a fast, low-cost, and privacy-preserving truth value discovery and verification method has practical application significance.

[0082] The specific implementation process is as follows:

[0083] Assume that there are 3 perception tasks on the platform and there are 3 users, namely u 1 ,u 2 ,u 3 ,The truth value discovery only iterates for one round.

[0084] Assume that the threshold-supported Paillier homomorphic encryption requires at least three different partial plaintexts to restore the complete plaintext, and there are a total of three partial keys. In this example, the platform is not distributed with keys.

[0085] For the convenience of calculation, assume that the three bases g in homomorphic hashing are 1 =g 2 =g 3 = 2. Let 0x(Y) represent a hexadecimal number, and Y represent a specific value.

[0086] Assume that the perception data is accurate to three decimal places, that is, P=3.

[0087] Assume that the initial weight of each user is 100.

[0088] During system initialization, the security parameter is set to 256. Select two large prime numbers and So that: in and is also a prime number. Therefore, the public key of Paillier homomorphic encryption that supports the threshold in this method can be obtained in: Full private key: The three partial private keys generated are:

[0089] ·s 1 =0x(5b07868e120d1091d0fd3556d2c1accf6bbdd15a6fed68c38a34dc4cd6fa4c7 27ac5cf99930f4f992ce3fd8c4d8acef1dbded33daec2d419702f11708b559958);

[0090] ·s 2 =0x(6417420d42c67bbd7202701b98d779da6b918722b6443e7dbaebcdbf0a69fed 06afeb03a74a17f6b2178fac85873477990d0da5a20f997b90246da3529126fee);

[0091] ·s 3 =0x(179034a069916634a51130c49f951f7c8909868735b06f0de1c8fc1c4161497 816bee3cfc18108c84c9a2e79c2872641ae0690587b0cac213d20b4feb15b6776);

[0092] Select three bases g with the same hash 1 =g 2 =g 3 =2. Select NIST256p as the encryption curve of the ECDH method. Each user obtains two 256-bit symmetric keys after key exchange. Assume that the symmetric keys of the three users are:

[0093] ·k 1,2 =k 2,1 0x(0bf00f351eb684907cae0531c375ef0cf81961a23add2220a8afa8707737c6f4);

[0094] ·k 1,3 =k3,1 0x(1a2e612291e83072e368ed24babb4f4af1cd86fc669a7e967c5014b2f620c164);

[0095] ·k 2,1 =k 1,2 0x(0bf00f351eb684907cae0531c375ef0cf81961a23add2220a8afa8707737c6f4);

[0096] ·k 2,3 =k 3,2 0x(91e60db7a3bdb23c04bc64ca605690dc048ad5ad7e278758d4b1bd26130f58dc);

[0097] ·k 3,1 =k 1,3 0x(91e60db7a3bdb23c04bc64ca605690dc048ad5ad7e278758d4b1bd26130f58dc);

[0098] ·k 3,2 =k 2,3 0x(ba6939b62bfa179c3739763655a1366d225e4d2232b78709904b945edadd8785);

[0099] Initialization completed.

[0100] Three users take on three perception tasks on the platform, where the given initial truth values ​​are: Users begin to collect sensory data, corresponding to Figure 1 . Assume that the perception data of these three users are:

[0101]

[0102]

[0103]

[0104] After collecting the data, we enter the weight update phase, such as Figure 1 “2”, “3”, “4” in the figure.

[0105] The user performs the calculation, corresponding to Figure 1 First, get the distance between your perception data and the initial true value:

[0106]

[0107]

[0108]

[0109] After that, users aggregate their get Disk 1 =479.103235, Disk 2 =709.476074, Disk 3 =903.447569;

[0110] After encryption, we get:

[0111] ·Enc(Disk 1 *10 2P )=0x(1b6fd12b0b0c6117f34eb8baaeb4908b80a820317a312408dbf84ee660ab384 0ef43dbac801bffbb5b58fcc80c95521c865151ced8219a42dcae862b7155e7c7b);

[0112] ·Enc(Disk 2 *10 2P )=0x(119a86e17a99cac1b47dad0c09617726f2e42878524ff88e65ec2f243fd28f1 629d665a0c226f406fb026124b0f3954c4330a1f0a898b09f832fe9e42bcc0f4a8);

[0113] ·Enc(Disk 3 *10 2P )=0x(10d09bddcc12673c496542350e369cf3fa39dfa90d98b62109b7c80bfe04d05 454218f497badb2372388209e794b278ba231b2a1b4ba4a2d3985b63f63f59adae);

[0114] At the same time, Disk i Taking the logarithm and retaining three decimal places gives:

[0115] log(Disk 1)=6.172,log(Disk 2 )=6.565,log(Disk 3 )=6.806;

[0116] After encryption, we get:

[0117] ·Enc(log(Disk 1 )*10 2P )=0x(62e0d4ff3660f798d9f51029b23d0d514a111135d6a556c7c88950cc291a1c d3ec173a69e7ea5f3260e0dcf88a160636931d203d073869e34afe6bf98068b921);

[0118] ·Enc(log(Disk 1 )*10 2P )=0x(4591568f15264ce4fbc57b2692f98b7ebd95d287dd3fb1dfd300985192526e 562760b7df762320c2c28cfb103164dfd95685384f9cfcf62a49ba028e7e0bc2fc);

[0119] ·Enc(log(Disk 2 )*10 2P )=0x(1710c8256a4cb4b7a7e52a333910cf6eac74819bc2c4615068f43faf9d09723 a7ef25e4d3f2528e04df9be9d1886a886c0e23c1acd0cdbc8808c6be26309f7ec2);

[0120] After completing the above calculations, the user generates a homomorphic hash value h i , and at the same time calculate the commitment value c i =SHA256(str(h i )+str(r i )), such as h i =13, r i =5, str(h i )+str(r i )=135; then:

[0121] ·h 1=0x(d14e53da6c6311846e314b2985ca90c15e66dc17d2c038384ba362ed263889c5);

[0122] ·h 2 =0x(2ae91469b761383c7816b69fe98ada8520e4ca71c5e8a182f755c95ec49e77e);

[0123] ·h 3 =0x(133360f0acac31605aea4404680a63063e6a9d100ea41e228068c3ed455bc6486);

[0124] ·r 1 =861608164813,r 2 =32613963466, r 3 =272815919628

[0125] ·c 1 =0x(334eb8b6c09b60f8730d798145bdb4562378dff41bb81205512c510d4241de3f);

[0126] ·c 2 =0x(db0306c432d076d10e4b91ca0502b47cd71012c8ec101b0b47a49343f5104355);

[0127] ·c 3 =0x(765884ee03a52f73248706ebd17a0458a8e0e82859b13142ef56c931e0de20c6);

[0128] After completing the promised calculation, the user will Enc (Disk i *10 2P ) and Enc(log(Disk i )*10 2P ) is sent to the platform, and c i Sent to the validator via the platform.

[0129] This process corresponds to Figure 1 After receiving the user's data, the platform uses the secure aggregation method to calculate the aggregation value. The ciphertext aggregation value obtained by the platform is: The platform sends the aggregated ciphertext to three users, who decrypt it separately to obtain three partial plaintexts part_paintext i :

[0130] part_paintext 1 =0x(125912503d48d5f03236ac47da05d113054814868ef9e80848ee216eabe2406 c41428de7ee4a13132526461a66b383dae0e29a5344f95ce17f93ad810ab82f9e9);

[0131] part_paintext 2 =0x(d1109ee62a430fd80f9580f5c63e17c6a26b0c1a0a022c41174f05bda043ebe 5abefb732123058de410317bf127417f83b404ae2f1e923d3afa0ee75763c287f);

[0132] part_paintext 3 =0x(7a9239eb2d1ee7563cc1aa895dee3dee00feda52c7c7dcff05288562e437993 be987ec19fdffe5e27bf840f0ab1bc49cf12bfe258f4aa2de11e7a758e6003e1a);

[0133] Finally, the platform uses the threshold-supported Paillier homomorphic encryption joint decryption method to obtain the logarithm of the complete plaintext Encrypted Enc(log(Sum)*10 2P )=0x(9674f86b16f227bba8f58e805ea8f92b668ba082a3d8158e6b6f9185ca79822a5fc67da199c15a880654f85f3d6d3f1d77606978c77d9ad249edef84716df0db), and then calculate the weighted ciphertext of each user: Enc(w i *10 2P ) and sent to each user, where:

[0134] ·Enc(w 1 *102P )=0x(11e31fe5fb3dfbedef88ce56fa8f5e341932e4ed30981118d22dfd725d3708c 4bbb268b5c4c8cfe2a6e41c96f45f31f6cecce334a80b95be68d5ba2a354cacd05);

[0135] ·Enc(w 2 *10 2P )=0x(18965f350ea6d69598ab17ce07b01d2089dc0eac9ec4ceac0da14501322e3c1 42dd604b6a7b2408f740927020239f271d0b9c9ec61263d7b8e0b82cdc0dbccf0f);

[0136] ·Enc(w 3 *10 2P )=0x(10b740a4a1af32d31ab87ec47409e0e2a944acc6ebea1ebfe6603260f9eea29 1bc88f8f9349a7a16b0995c86a67ecca41ee924fcdf07f12b2a9eefbd595abb1f7).

[0137] The user decrypts the weight, corresponding to Figure 1 Each user u i Use your own part of the private key i Decrypt other users u j and its own encryption weight, and obtain the partial plaintext HalfDec(w j *10 2P ) i :

[0138] ·HalfDec(w 1 *10 2P ) 1 =0x(130670a19011edcd2855e8fb9ee250a8bdd57b4f8dfbb0721d51343b75f05f6 da2d0c15bb73bd917d19d8fb2f6c17289aa570a78f9d26833e59d03c60c3614c82);

[0139] ·HalfDec(w 1 *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> (0x(97bf729a1ddbaf40883814dabca4059460402fb80b00ad4eaee27a6fafc9827c5f12237c66556a5ecfdc1b28f6f1ad9c77c66f3cfeb4c83b285c948bbbbf88d3))<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0140] <h2 style=";text-align:left;direction:ltr"> HalfDec(w<h2 style=";text-align:left;direction:ltr"> 1 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 3 <h2 style=";text-align:left;direction:ltr"> (0x(1318091dcc492e72ab54ef6cda1e4f49fdfd2c7d26ab4df1275bb0941c9f3ab30dd07e5c9ad9f68773c33fb9d520b1bcf9ad7742b31a25f6eb5382de3cbcb5b14))<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0141] <h2 style=";text-align:left;direction:ltr"> HalfDec(w<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 1 <h2 style=";text-align:left;direction:ltr"> (0x(d979291267e7c30770666b26b46c790e86231685a3f3b77ddbf600abf0fb76ce1ae771de2bde5823d93b96138be59ca21be6130cfe7b0d61476fc22a781b8391))<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0142] <h2 style=";text-align:left;direction:ltr"> HalfDec(w<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> (0x(206631da83047e2c27a7b1080eeacdf3c8772012648b45930726bd14e8f9141b55096f47bd548667a4d914db45a0999668692db25850fa5d4bf73af562f42013))<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0143] <h2 style=";text-align:left;direction:ltr"> HalfDec(w<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 3=0x(1448e00ebb2e585d3370288fd7c397ed8783192f85e2f6867a3f40ea0f2a974 1e7746926adf621af507512d6d51cff47e49f0ae744c642ca7bfcfa3aa22706d31);

[0144] ·HalfDec(w 3 *10 2P ) 1 =0x(1b6ee6e4ceed5e00885410bbf2cac41be726c0082ae5834872016f56d9b8f30 ab0861cc0b3390e8b25a03c7a0331b29b14b4db9588f9d8bf6726dcbf873565f30);

[0145] ·HalfDec(w 3 *10 2P ) 2 =0x(27a175341107386862e11dbed83ce2844b48c4da55754ba10f8f195d69556d1 5764b4ec8d64b7fc06767b913ca943ed76b80577c367137d949803cfc9cd52490);

[0146] ·HalfDec(w 3 *10 2P ) 3 =0x(2baf0956615abbfe66ac622fd20b8a82613b8cc72a6a50486496f8f6416b4c cb6426f75ae899f84ab389ff6350b2ce98c6254788f5a53dc97c1ee05161474ad);

[0147] And use the symmetric key k i,j Encrypt and get user u j The ciphertext C_HalfDec(w j *10 2P ) i , where i≠j:

[0148] ·C_HalfDec(w 1 *10 2P ) 2<h2 style=";text-align:left;direction:ltr">=0x(332621a6866e0e9268d344bb323eaa1e02fb8f14802784a48d960d0e9cb1a8d980b1d1c3e7df0495f45353f0f066f9a710f700010c138a2bd6ae5d9c1b7f669344011beb6f04d127c424eb74b 23e3e25dd289a1e03a5147562256c4274744ff8c6352db1e8ad247091c817a7a9fbd187102682f8d2297ad5d262bd415cf5aae15fc0eefc23b7e929fbb7646b82489b47db3592c4c073697a3a8e);<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0149] <h2 style=";text-align:left;direction:ltr"> C_HalfDec(w<h2 style=";text-align:left;direction:ltr"> 1 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 3 <h2 style=";text-align:left;direction:ltr"> =0x(c8fad5fc971eba3b338e71ca6ee587c474c79f7785ac3ae83f2ad503b03c7dbffb2203298cb8fd0cfae0184a27c992fe36697e7a588062333f758735a4cf5b36c6327f98c93ebf4d94fe376ee9 219b977a44325a8cdada235cb54a3542e6ed50770b2419fbc2670826ba24b506d8f02add994d6304f1f8365f55b6e2f3b69e99a1ef46165f2eccf34e5607c0d594c7a315c6316fa13c2162319659);<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0150] <h2 style=";text-align:left;direction:ltr"> C_HalfDec(w<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 1<h2 style=";text-align:left;direction:ltr">=0x(352e26a88069079161d546b7323fa31501f58d1f832183a08d970f0f9cbbaedb85b1dec1e3db0094f0565ff0f167faa411f600060a158427daad549e1b79619044041ce86a04da20c621e878b3 3f3f25da2c901b05a51a7d63206e4472754efdc5332eb3eca9277099ca16a1a9f7dd85112788fddf287ed7d165b54a53f4a1e15fc0eef02fb9e22dffb7696d81499a40df3a98cdc07c6f7a368d11);<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0151] <h2 style=";text-align:left;direction:ltr"> C_HalfDec(w<h2 style=";text-align:left;direction:ltr"> 2 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 3 <h2 style=";text-align:left;direction:ltr"> =0x(0c86a1722d9536eddf0e82f682ceea8c2b45ae9a894ad00920ce958ef893b2c855c0b36e0d15a17721d9aedf3e966b6e29757ae867092051ca2dbbf4096ea088864b3dc8374648d52a5d6894c7 b5ac7dcf617090ada2cf83357a6573149ccf6a253aee883cce820895b5f687dcc591c27d1d7cb6fa6cd391c09c517400835095fbff0fb5578b91299bbd1aa54fe15c14c38a4930a65215768e717f);<h2 style=";text-align:left;direction:ltr"> <h2 style=";text-align:left;direction:ltr">

[0152] <h2 style=";text-align:left;direction:ltr"> C_HalfDec(w<h2 style=";text-align:left;direction:ltr"> 3 <h2 style=";text-align:left;direction:ltr"> *10<h2 style=";text-align:left;direction:ltr"> 2P <h2 style=";text-align:left;direction:ltr"> )<h2 style=";text-align:left;direction:ltr"> 1=0x(cbfedcf49f1dbe33398a7cc265e284cf70c6967085a23ae83928d20bb33074bbf3250c2688b bfd0cf3e51e4e2cca90f338617a7e588c633132728432a2c65b3dc1317892cb3fbd4097fc316ae9 289d937941325c8cddd62459bb4c3f42efed577b0d2819f6c2610e26bc24b500dbf02ed59a4e670 3f8fb335c52b9eefeb7989aa4e640175d2dcaf6495000c4de94c3aa1dc33c6fa63a2964329855);

[0153] ·C_HalfDec(w 3 *10 2P ) 2 =0x(0f80af7e239431eddf018ef685cde2852d44a99b814ddb0a20cd978ffd96b7c958c5b36d0a 16a67628d8aed83e916264237074ed6f0e2258c02cb7f70669a68c854f39ca36434cd82b51689bc 1b9ad7bce607094aba6ce8432776d771d9ac86b2a3ae18c3cc5830491b7f58dd7cd9ac7781075b 5fa64d690cf9f5f7908855391fbf309b5558a972491bb18a74ee15a1cc58c4a31a65710788a76);

[0154] After that, C_HalfDec(w j *10 2P ) i After receiving the above ciphertext, the platform sends it to the corresponding user. i First decrypt C_HalfDec(w j *10 2P ) i , we get (HalfDec(w i *10 2P ) 1 ,…,HalfDec(w i *10 2P )3 ), and then the plaintext w can be obtained by the joint decryption method in the Paillier homomorphic encryption method that supports thresholds i *10 2P , you can get your own weight: w 1 =15.289,w 2 =14.896,w 3 =14.655.

[0155] Entering the truth value update phase, corresponding to Figure 1 The “5” and “6” in the figure.

[0156] User i The product of the weight and each sensor data is calculated and encrypted to obtain the Pillier homomorphic ciphertext: correspond Figure 1 The "5" in the formula:

[0157] ·

[0158] ·

[0159] ·

[0160] ·

[0161] ·

[0162] ·

[0163] ·

[0164] ·

[0165] ·

[0166] Then, user u i Calculate two homomorphic hash values ​​hh i With hw i , generate two random numbers rr i With rw i , and calculate two commitment values ​​cc i With cw i .u i cc iWith cw i Sent to the verifier through the platform Sent to the platform, where:

[0167] ·hh 1 =0x(cf337865e62b94347383fdb23bbe16929073993cbf56bd04e1c7250a9686622d);

[0168] ·hh 2 =0x(9ebc1b760148ad0077cafbd0e8c93fc341e229b30bdfac2e3563efef67104bc5);

[0169] ·hh 3 =0x(1bd726d0c6a6981401229fc995295013f8021ba35b78d066358dbc905e9c4dbd);

[0170] ·rr 1 =376560732090,rr 2 =69356426186,rr 3 =119385276438

[0171] cc 1 =0x(2324f48d90ff7af585c758e65191ae10282be6ba3d3148d5a3b4d96c9e147737);

[0172] cc 2 =0x(0de4bb28c6356884ef826da5d59d5ac82033d8d450acb28667f3513712816ab6);

[0173] cc 3 =0x(d1b330ba969bff941a2bb748765f5c418f0b1dd2e169d1173e3018ed83dc7e9e);

[0174] ·hw 1 =0x(fd6d6db960833d04dd88ec3bd1cedc10dcf08f8a3e940517760e1559ef08c7fe);

[0175] ·hw 2=0x(63e69d6ae2588f3fe5644129d55f2a60b5322a7182eca73813325c8827f82d3a);

[0176] ·hw 3 =0x(12f02a86460baca5fed11b3b178e37955ee65835c5b88d1ccc896499189ddbc97);

[0177] ·rw 1 =709713389571,rw 2 =587096844930,rw 3 =487399542919

[0178] ·cw 1 =0x(d3056583955823f790aa76c930cbf15b011909ba249726b0e2b0d27ac4dd4596);

[0179] ·cw 2 =0x(7eeac1b6d3bef5322a30ed613fda0564a50de05cfcb925b7e37f5acb1105bb84);

[0180] ·cw 3 =0x(af28f2284e61fc1344fe7ac92cc2825ddcb7ee54338000cfc00c295f8dfabace);

[0181] This step corresponds to Figure 1 The platform calculates the aggregate value and Get T+1 aggregate values:

[0182] ·Enc(Swd 1 )=0x(13feca3033435175344c04eed36d7683234ec5498c0ab92c8f62be81c2939cc 1b27215d8a70856f6aa0d3c1d5e67615e220174563b274b16ad61f4cf3d9ed6342);

[0183] ·Enc(Swd 2)=0x(9cc38d1d7d5b941207ea1a5e37270ff5c4fe0ece994cb62c2684ed04a1ac86 9ddb8da7e674ab4bd7f8263554d42ef8dcb87792481b06aa8da89cb62bf761113c);

[0184] ·Enc(Swd 3 )=0x(d9b6f0ade01af49fb85fe8a7ecd44a7c4bed86cbbed087a65e230ad3383ca1 c86d883313e2df4bf986436bf425ef07576612cc1b8fa353d1406b18e3fb7ebfbd);

[0185] ·Enc(Sw)=0x(2412f27458029cd2c507d57138e7c0655ee5c79042d39ffc2afc066fd15 12cc7c633896ff2a5bee1ca93c4544c156d69060af447caf7f40ce7a8aaa0a2e1590f);

[0186] Afterwards, the security aggregation method is used to obtain T+1 aggregated value plaintexts: Swd 1 =1268466017,Swd 2 =958087459,Swd 3 =1367260321, Sw = 44840000, and then the platform updates the final truth value of each perception task through formula (1): And make it public.

[0187] Enter the verification phase, corresponding to Figure 1 The “7” and “8” in the picture.

[0188] All users will have their own homomorphic hash value: h i ,hh i With hw i And the corresponding random number: r i ,rr i With rw i Sent to the verifier through the platform. The verifier verifies each commitment value, i.e. c′ i = SHA256(h′ i +r′ i ), cc′ i =SHA256(hh′ i+rr′ i ),cw′ i =SHA256(hw′ i +rw′ i ) is true.

[0189] If the commitment verification passes, then calculate:

[0190]

[0191] If the above verification passes, the user calculates:

[0192] w 1,1 =log(Sum′ 1 )-log(Disk 1,1 )=15.289;

[0193] w 2,1 =log(Sum′ 2 )-log(Disk 2,1 )=14.896;

[0194] w 3,1 =log(Sum′ 3 )-log(Disk 3,1 )=14.655;

[0195] If the above verification is passed, the weight calculation result is correct. Verify separately:

[0196]

[0197]

[0198] If the above passes verification, then verify each true value:

[0199]

[0200]

[0201]

[0202] At this point, the verification process is complete.

[0203] In the present invention, if any third party obtains the following data in each round of iteration: h′ i ,hh′ i ,hw′ i ,r′ i ,rr′ i ,rw′ i ,c′ i ,cc′ i ,cw′i ,Sum′,Sw′,Swd′ t , the calculation results of the platform can be verified by calculating formulas 3, 5, 6 and 7, and public verification is achieved, and the beneficial effect 1 can be verified;

[0204] In the present invention, the value of parameter L in equations 3, 5 and 6 can be changed to in The initial value of l can also be changed, and the formula still holds; the beneficial effect 2 can be proved;

[0205] Figure 2 and Figure 3 The comparative experimental diagram of the present invention and the same type of method is shown when the number of perception tasks and the number of users are fixed to 50 in this embodiment. The legend V-EPTD is the corresponding curve of the present invention; Figure 2 .(a)- Figure 2 (c) The number of sensing tasks is fixed to 50, corresponding to the computational overhead of a single user, platform, and single validator; Figure 2 .(d)- Figure 2 (e) The number of users is fixed at 50, corresponding to the computational overhead of a single user, platform, and single validator. Figure 3 .(a)- Figure 3 (c) The number of sensing tasks is fixed to 50, corresponding to the communication overhead of a single user, platform, and single verifier; Figure 3 .(d)- Figure 3 (e) The number of users is fixed at 50, corresponding to the communication overhead of a single user, platform, and single validator. Figure 2 and Figure 3 It shows that the communication and computing overhead of a single user of the present invention is extremely low. In the present invention, the communication and computing overhead between the platform and a single verifier are much lower than those of the same type of methods. Beneficial effect 3 can be proved.

[0206] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for determining a truth value of public verification based on privacy protection, characterized in that: It includes the truth discovery phase and the verification phase; In the truth value discovery phase, the task executor and the platform use the threshold-based Paillier homomorphic encryption system to complete the truth value discovery algorithm while protecting the task executor's privacy data. At the same time, the task executor generates homomorphic hash values ​​related to its own data and the corresponding random numbers and commitment values ​​in the truth value discovery phase, and sends the commitment values ​​to the platform, retaining the homomorphic hash values ​​and random numbers. The platform sends these commitment values ​​to the verifier. In the verification phase, the task executor sends all homomorphic hash values ​​and random numbers to the verifier through the platform. The verifier first uses these random numbers and homomorphic hash values ​​to verify the commitment values ​​previously received from the platform to prevent the platform from tampering with the data. After verification, individuals with computing capabilities can use the computing data previously disclosed by the platform to verify the results of the truth value discovery. Among them, users refer to registered users who have registered on the platform and hold mobile intelligent sensing devices, referred to as users for short, and are divided into task initiators and task executors; task initiators are referred to as initiators for short; task executors are referred to as executors for short; The initiator is responsible for uploading his / her own perception task to the platform; after that, the initiator uploads data to the platform as an executor, or verifies the final result as a verifier; finally, the initiator receives the task result returned by the platform and the verification result returned by the verifier; The executor is responsible for receiving the sensing task from the platform, using its own equipment to obtain the sensing data, and encrypting and uploading it to the platform; then, the executor assists the platform to complete the truth value discovery algorithm and generate the data required for the verification phase; The verifier is responsible for obtaining the data required for verification from the platform, verifying the calculation results of the platform, and finally securely passing the verification results to the initiator and executor through the platform; Step 1: First, a trusted third-party organization, referred to as the trusted organization, generates a public key and a complete private key that supports the threshold Paillier homomorphic encryption system, and generates a portion of the private key for the platform and all its users; Afterwards, the trusted institution publishes the public key, transmits the corresponding private key to the platform and each user through a secure channel, and stores and keeps the complete private key after the two parts are combined; The trusted authority then publishes the parameters of the homomorphic hashing algorithm; Finally, the trusted institution selects a curve as the encryption curve for the elliptic curve Diffie-Hellman key exchange and generates a private key for each user for the elliptic curve Diffie-Hellman key exchange; Step 1.1: The trusted institution selects two prime numbers δ and β, such that δ = 2δ′+1, β = 2β′+1, where δ′ and β′ are both prime numbers; let τ = δβ, γ = δ′β′, and let can divide γ and also satisfy After dividing by τ, the remainder is 1. That is the complete private key; at this point, a public key that supports the threshold Paillier homomorphic encryption system is generated in At this time, the trusted institution selects a number X that is greater than the number of users U, and assumes that X is twice the number of users U, and generates a polynomial as shown in Formula 1: Among them, x represents that when at least x partial private keys decrypt the partial plaintext of ciphertext C, the ciphertext C is the ciphertext obtained by encrypting the plaintext M with PK, and the corresponding plaintext M of C is obtained; a0, a i are all coefficients of X, and a0 = δ, a i ∈ {0, 1, …, τ(γ - 1)}, 0 < i < x; the respective private keys of the user and the platform are s i , according to Equation 1, s i = f(i), 1 ≤ i ≤ U + 1; The trusted institution will make PK = (θ, τ) public; the trusted institution will make the private key s corresponding to each user and platform i The private key is sent to users and platforms through a secure communication channel without being known to third parties. Confidentiality; Step 1.2: The trusted institution selects a generator g based on the security parameter κ; the cyclic group G of order q = <g>, q is a prime number, G, g, q are the public parameters Lpp; let the maximum number of iterations of truth value discovery be L, and the upper limit of the number of perception tasks in a single truth value discovery be T; let T>L, then the trusted institution selects T parameters: g1,…,g T ∈G, and make it public;< / g> Step 1.3: The trusted institution selects an elliptic curve α as the encryption curve for the elliptic curve Diffie-Hellman key exchange, and then generates a private key sk for each user for the elliptic curve Diffie-Hellman key exchange i and sent to each user through a secure communication channel; Step 2: The user negotiates the key; Each user u i Using the platform as an intermediary to communicate with other users j Use the elliptic curve Diffie-Hellman key exchange method to exchange keys and obtain the symmetric key k i,j ;Afterwards, users publish / receive perception tasks on the platform; Step 3: Update weights; The user receives the perception task on the platform and learns the data accuracy P of the perception task, that is, the accuracy of all data in this task is P decimal places; each user processes his or her own perception data and encrypts it and sends it to the platform; the platform uses the Paillier homomorphic encryption secure aggregation method based on the support threshold to aggregate the ciphertext of all users and obtain the aggregated plaintext; finally, the platform updates the weight of each user; Among them, the Paillier homomorphic encryption security aggregation method based on support threshold is as follows: Input: Each user u i The encrypted data c i , and c i The corresponding plaintext m i , where i∈[1,U]; Output: Plaintext aggregate value of all users First, each user u i Send encrypted data to the platform c i ; Then, the platform multiplies all the ciphertexts to get the aggregate value: The platform selects at least x-1 users and sends them the aggregate value The selected user uses his or her own partial private key to decrypt The obtained partial plaintext A is sent to the platform; the platform finally receives at least x-1 copies of partial plaintext A, plus the partial plaintext B calculated by itself, and uses the threshold-supported Paillier homomorphic encryption joint decryption method to obtain the complete plaintext, that is, Step 3.1: User u i After obtaining your own perception data V i =(V i [1],…,V i [T]) after calculating the distance DI between the perceived data and the initial true value i , Among them, V i [t] represents the perception data vector V i The tth data of represents the true value of the t-th perception task in the first iteration, 1≤t≤T, T represents a total of T tasks; then, U i Get aggregate value Finally, u i Calculate two Piallier homomorphically encrypted ciphertexts: Enc(Disk i *10 2P ) and Enc(log(Disk i )*10 2P ), where log(Disk i ) has a precision of P; Step 3.2: User u i Calculate the homomorphic hash value h i : Generate a random value r i , get the commitment value c through the commitment method COM.Commit() i ←COM.Commit(h i ,r i ), where g1 represents the homomorphic hash parameter taken in the first round of iteration, and the parameter selected in the first round is g l , P means log(Disk i ) precision; after that, u i Enc(Disk i *10 2P ) and Enc(log(Disk i )*10 2P ) is sent to the platform, and c i Sent to the validator via the platform; Step 3.3: The platform aggregates all Enc (Disk i *10 2P )Ciphertext: Then the plaintext Sum of the aggregate value is obtained through the secure aggregation algorithm, where The platform calculates Enc(log(Sum)*10 2P ), and then calculate Enc(w i *10 2P )=Enc(log(Sum)*10 2P )·Enc(log(Disk i )*10 2P ) -1 Get user u i Encrypted weights; Finally, the platform will obtain all the encrypted weights Enc(w j *10 2P ) and commitment value c j Send to user U i ,where i,j∈[1,U]; Step 4: Each user decrypts his own weighted ciphertext through the platform as an intermediate communicator, without leaking his own weighted plaintext; Step 5: Each user completes the truth value update of the perception task together with the platform without disclosing their own weights and perception data; Step 6: Loop through steps 3 to 5 until the true values ​​of all perception tasks converge or the upper limit of the number of loops L is reached, then stop the loop; Step 7: All users will generate their own homomorphic hash values ​​h in each round i 、hh i With hw i And the corresponding random number r i ,rr i With rw i The platform sends the data to the verifier. The verifier verifies each commitment value first. If a certain verification fails, the platform true value result is judged to be incorrect. Otherwise, subsequent verification calculations are performed. Step 7.1: All users will generate their own homomorphic hash values ​​h in each round. i 、hh i With hw i And the corresponding random number r i ,rr i With rw i Sent to the verifier through the platform; the verifier verifies each commitment value through the decommitment method COM.Deommit(): 1←COM.Deommit(c′ i ,h′ i ,r′ i ) 1←COM.Deommit(cc′ i ,hh′ i ,rr′ i ) 1←COM.Deommit(cw′ i ,hw′ i ,rw′ i ) Among them, h′ i ,hh′ i , hw′ i Indicates the user u forwarded by the platform to the verifier i Homomorphic hash value of r′ i ,rr′ i , rw′ i Indicates the user u forwarded by the platform to the verifier i A random number; c′ i ,cc′ i , cw′ i Indicates the user u forwarded by the platform to the verifier i If all the committed values ​​pass the verification, the verification operation will continue; otherwise, the true value result of the platform is judged to be incorrect; Step 7.2: The verifier verifies the result of the weight update through equation 3 and equation 4: w i,l =log(Sum′ l )-log(Disk i,l ),0<l≤L (4) Among them, h i,l Indicates user u in the lth iteration i The resulting homomorphic hash value, w i,l Indicates user u in the lth iteration i Generated weighted plaintext; Disk i,l Indicates user u in the lth iteration i The aggregate value Disk; Sum′ l is the Sum disclosed by the platform in the first iteration, g l Represents the lth parameter in T generated by a trusted institution; The verifier first calculates equation 3. If equation 3 is not true, the verifier returns the result "0", indicating that the verification fails. Otherwise, it verifies equation 4. If equation 4 is not true, the verifier returns the result "0". The above situations are all considered verification failures, and the platform's true value results are incorrect. Finally, if both equations 3 and 4 are true, the result "1" is returned, indicating that the verification passes. Among them, the verifier's results must be forwarded to the user through the platform; to prevent the platform from tampering with the results, the verifier first calculates the corresponding commitment value when sending a message to the user, and then sends the commitment value first, and waits until the user receives the commitment value, and then sends the corresponding result and random number. This method is also applicable to the subsequent steps; the user receives the verification result sent by the verifier and verifies formula 3 again; only when all users pass the verification, the next step of verification will be carried out, otherwise the verification fails; Step 7.3: The verifier verifies the result of the truth value update through equations 5, 6, and 7: Among them, Swd′ t,l and Sw′ l Indicates the Swd disclosed by the platform in the first iteration t and Sw;hh i,l ,hw i,l They represent user u in the first iteration i Two homomorphic hash values ​​of represents the true value of the tth task in the lth iteration; g l , g t They represent the lth and tth parameters in T generated by the trusted institution, respectively. t is the tth random positive integer generated by the verifier; The verifier first calculates formula 5. If formula 5 does not hold, the verifier returns the result "0", indicating that the verification fails; otherwise, it verifies formula 6. If formula 6 does not hold, the verifier returns the result "0"; otherwise, it verifies formula 7. If formula 7 does not hold, the verifier returns the result "0"; the above situations are all considered as verification failures; Finally, if equations 5, 6, and 7 are all true, the result "1" is returned, indicating that the verification is successful and the true value result of the platform is correct.

2. A method for determining a truth value of public verification based on privacy protection as claimed in claim 1, characterized in that: Step 4 specifically includes the following steps: Step 4.1: User u i Use your own part of the private key i To other users j Decrypt the encryption weights one by one to obtain the partial plaintext HalfDec(w j *10 2P ) i ; At the same time, use the corresponding user U j The symmetric key k i,j Encrypt the above part of the plaintext and get C_HalfDec(w j *10 2P ) i , where j∈[1,U]∩i≠j; user u i Send the above ciphertext to the platform; after receiving it, the platform sends the ciphertext to the corresponding user; Step 4.2: User u i The platform receives the ciphertext C_HalfDec(w i *10 2P ) j Afterwards, through k i,j Decryption restores at least x parts of the ciphertext: (halfDec(w i *10 2P )1,…,HalfDec(w i *10 2P ) x ), then the plaintext w is obtained by the joint decryption method in the threshold-supported Paillier homomorphic encryption method i *10 2P , then u i Get your own weighted plaintext w i .

3. A method for determining a truth value of public verification based on privacy protection as claimed in claim 1, characterized in that: Step 5 specifically includes the following steps: Step 5.1: User u i The product of the weight and each sensor data is calculated and encrypted to obtain the Pillier homomorphic ciphertext enc(V i [t]*w i *10 2P ), where i∈[1,U],t∈[1,T]; u i Send these ciphertexts to the platform; Step 5.2: User u i Compute two homomorphic hash values: and Generate two random numbers rr i With rw i Then, through the commitment method COM.Commit(), two commitment values ​​cc are obtained i ←COM.Commit(hh i ,rr i ) and cw i ←COM.Commit(hw i ,rw i );u i cc i With cw i Sent to the validator via the platform; Step 5.3: After receiving the data sent by all users in steps 5.1 and 5.2, the platform calculates and Get T+1 aggregate values; then, get T+1 aggregate value plaintexts through the secure aggregation method: and where t∈[1,T]; then, the platform updates the true value of the t-th perception task in the next round through Equation 2:

Images