Data processing method and apparatus

Abstract

The application discloses a data processing method and device, and a method suitable for verifying a device, which comprises the following steps: receiving a data access request sent by a first electronic device, wherein the data access request at least contains an attribute identifier of the first electronic device and a data identifier of first data to be accessed, the first data belongs to a second electronic device, the first electronic device and the second electronic device are both connected to an edge device, and the edge device is connected to a remote storage device; verifying whether the first electronic device meets a verification condition corresponding to the second electronic device according to the attribute identifier; obtaining a target private key corresponding to the second electronic device in the case that the first electronic device meets the verification condition; and sending the target private key to the edge device through the first electronic device, so that the edge device uses the target private key to perform decryption processing on the first data obtained from the remote storage device and sends obtained second data to the first electronic device.

Description

Technical Field

[0001] This application relates to the field of smart home technology, and in particular to a data processing method and device. Background Technology

[0002] With the development of technology, smart home applications are becoming increasingly widespread. Multiple smart devices send their data to the cloud for storage via a single Wi-Fi connection, while smart devices within the same local area network can access the data of other devices by accessing the cloud.

[0003] However, this access method allows devices on other local area networks or other unauthorized devices to access private data in the cloud, thus posing a risk of privacy data leakage. Summary of the Invention

[0004] In view of the above, this application provides a data processing method and apparatus, as follows:

[0005] A data processing method, comprising:

[0006] The device receives a data access request sent by a first electronic device. The data access request includes at least an attribute identifier of the first electronic device and a data identifier of the first data to be accessed. The first data belongs to a second electronic device. Both the first electronic device and the second electronic device are connected to an edge device, and the edge device is connected to a remote storage device.

[0007] Based on the attribute identifier, verify whether the first electronic device meets the verification conditions corresponding to the second electronic device;

[0008] If the first electronic device meets the verification conditions, the target private key corresponding to the second electronic device is obtained;

[0009] The target private key is sent to the edge device through the first electronic device, so that the edge device uses the target private key to decrypt the first data obtained from the remote storage device and sends the resulting second data to the first electronic device.

[0010] In the above method, preferably, the attribute identifier includes at least a time attribute and / or a spatial attribute, wherein the time attribute is related to the access time corresponding to the data access request; and the spatial attribute is related to the current device location of the first electronic device.

[0011] In the above method, preferably, the preset identifier corresponding to the second electronic device includes at least one time range and at least one spatial range;

[0012] Wherein, the attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device, including:

[0013] The access time represented by the time attribute in the attribute identifier of the first electronic device falls within any of the stated time ranges;

[0014] Furthermore, the terminal location represented by the spatial attribute in the attribute identifier of the first electronic device is within any of the aforementioned spatial ranges.

[0015] In the above method, preferably, obtaining the target private key corresponding to the second electronic device includes:

[0016] Based on the data identifier, obtain the device information of the second electronic device to which the first data belongs;

[0017] Obtain the target private key corresponding to the device information from the preset key set.

[0018] In the above method, preferably, the key set contains public key information and private key information corresponding to multiple second electronic devices;

[0019] The public key and private key information corresponding to the second electronic device are obtained in the following ways:

[0020] Upon receiving an encryption request from the second electronic device, obtain the security parameters of the second electronic device;

[0021] The security parameters are processed to obtain the private key information and public key information corresponding to the second electronic device. The public key information is used to encrypt the data, and the private key information is used to decrypt the data.

[0022] In the above method, preferably, the key set further includes a preset identifier corresponding to the second electronic device, the preset identifier being used to verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; wherein, the preset identifier is obtained based on the received identifier configuration operation.

[0023] A data processing method applied to an edge device connected to multiple electronic devices and connected to a remote storage device, the method comprising:

[0024] Receive a data access request sent by a first electronic device, wherein the data access request includes at least the attribute identifier of the first electronic device and the data identifier of the data to be accessed;

[0025] Based on the data identifier, first data corresponding to the data identifier is obtained from the remote storage device; the first data belongs to the second electronic device.

[0026] Upon receiving the target private key sent by the first electronic device, the first data is decrypted using the target private key to obtain the second data;

[0027] The target private key is sent to the first electronic device by the verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier;

[0028] The second data is sent to the first electronic device.

[0029] Preferably, the above method further includes:

[0030] The device receives a data storage request sent by the second electronic device, the data storage request containing at least the second data and the public key information corresponding to the second electronic device; the public key information corresponding to the second electronic device is generated by the verification device based on the security parameters of the second electronic device and sent to the second electronic device.

[0031] The second data is encrypted using the public key information to obtain the first data;

[0032] The first data is sent to the remote storage device.

[0033] A verification device, comprising:

[0034] A memory used to store computer programs and the data generated by the execution of said computer programs;

[0035] A processor is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of first data to be accessed, the first data belonging to a second electronic device, both the first electronic device and the second electronic device being connected to an edge device, the edge device being connected to a remote storage device; verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; if the first electronic device meets the verification conditions, obtain a target private key corresponding to the second electronic device; send the target private key to the edge device through the first electronic device, so that the edge device uses the target private key to decrypt the first data obtained from the remote storage device and sends the obtained second data to the first electronic device.

[0036] An edge device connected to a plurality of electronic devices and connected to a remote storage device, the edge device comprising:

[0037] A memory used to store computer programs and the data generated by the execution of said computer programs;

[0038] A processor is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of the data to be accessed; obtain first data corresponding to the data identifier from the remote storage device according to the data identifier; the first data belongs to a second electronic device; upon receiving a target private key sent by the first electronic device, decrypt the first data using the target private key to obtain second data; wherein the target private key is sent to the first electronic device by a verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device according to the attribute identifier; and send the second data to the first electronic device. Attached Figure Description

[0039] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart of a data processing method provided in Embodiment 1 of this application;

[0041] Figure 2 This is an example diagram illustrating the applicability of this application to smart home scenarios;

[0042] Figure 3 A flowchart of a data processing method provided in Embodiment 2 of this application;

[0043] Figure 4 This is a partial flowchart of a data encryption and storage method provided in Embodiment 2 of this application;

[0044] Figure 5 This is a schematic diagram of the structure of a data processing device provided in Embodiment 3 of this application;

[0045] Figure 6 This is another structural schematic diagram of a data processing apparatus provided in Embodiment 3 of this application;

[0046] Figure 7 This is a schematic diagram of the structure of a data processing device provided in Embodiment 4 of this application;

[0047] Figure 8This is another structural schematic diagram of a data processing apparatus provided in Embodiment 4 of this application;

[0048] Figure 9 This is a schematic diagram of the structure of a verification device provided in Embodiment 5 of this application;

[0049] Figure 10 This is a schematic diagram of the structure of an edge device provided in Embodiment Six of this application;

[0050] Figure 11 This is a schematic diagram illustrating data encryption and decryption in a smart home scenario applicable to this application;

[0051] Figure 12 This diagram illustrates how to generate public and private keys for a registered DO in a smart home scenario, as described in this application. Detailed Implementation

[0052] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0053] refer to Figure 1 The diagram shown is a flowchart illustrating the implementation of a data processing method according to Embodiment 1 of this application. This method can be applied to electronic devices capable of data processing, such as computers or servers. The technical solution in this embodiment is mainly used to improve the data security of terminals within a local area network.

[0054] Specifically, the method in this embodiment may include the following steps:

[0055] Step 101: Receive a data access request sent by the first electronic device.

[0056] The data access request includes at least the attribute identifier of the first electronic device and the data identifier of the first data to be accessed. The first data belongs to the second electronic device. Both the first and second electronic devices are connected to an edge device, which is connected to a remote storage device. For example, ... Figure 2As shown in the illustration, taking a smart home scenario as an example, the remote storage device can be a cloud server of a cloud service provider (CSP). The cloud server is used to store data sent by terminals in various local area networks. The first electronic device and the second electronic device are smart home terminals connected to different WiFi networks, such as mobile phones, laptops, monitors, smart door locks, smart speakers, air purifiers, and robot vacuum cleaners. The second electronic device is a terminal acting as the data owner (DO), and the first electronic device is a terminal acting as the data user (DU). An edge device, such as an edge node (EN), is configured between the cloud server and the local area network terminals. The technical solution in this embodiment is implemented on a verification device that can connect to the first electronic device and the second electronic device, such as an attribute authority (AA). The AA receives a data access request sent by the DU that needs to access data on the DO. The data access request contains at least the data identifier of the first data to be accessed on the DO, and also contains the attribute identifier of the DU.

[0057] Step 102: Based on the attribute identifier, verify whether the first electronic device meets the verification conditions corresponding to the second electronic device. If the first electronic device meets the verification conditions, proceed to step 103.

[0058] The attribute identifier is used to verify whether the first electronic device has permission to access the first data. Specifically, if the first electronic device meets the verification conditions corresponding to the second electronic device according to the attribute identifier, it indicates that the first electronic device has legitimate permission to access the first data on the second electronic device. At this time, step 103 is executed. However, if the first electronic device does not meet the verification conditions corresponding to the second electronic device according to the attribute identifier, it indicates that the first electronic device does not have legitimate permission to access the first data on the second electronic device. At this time, the data access request of the first electronic device can be discarded and the current process ends.

[0059] Step 103: Obtain the target private key corresponding to the second electronic device.

[0060] The target private key is a key pre-configured for data decryption on the second electronic device. It should be noted that each electronic device that needs to access data on the network is pre-configured with a corresponding private key and public key; the public key is used for data encryption, and the private key is used for data decryption.

[0061] Step 104: Send the target private key to the edge device through the first electronic device, so that the edge device can use the target private key to decrypt the first data obtained from the remote storage device and send the obtained second data to the first electronic device.

[0062] Specifically, in this embodiment, the target private key can be sent to the first electronic device to indicate that the first electronic device can use the target private key to obtain the first data. Based on this, the first electronic device sends the target private key to the edge device, which has the first data obtained from the remote storage device according to the data identifier of the first data. Thus, the edge device uses the target private key to decrypt the first data and then sends the decrypted second data to the first electronic device. At this time, the first electronic device obtains the unencrypted second data (i.e., the decrypted first data).

[0063] As can be seen from the above scheme, in the data processing method provided in Embodiment 1 of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0064] In one implementation, the attribute identifier includes at least a time attribute and / or a spatial attribute. The time attribute is related to the access time corresponding to the data access request; the spatial attribute is related to the current device location of the first electronic device. Specifically, the time attribute can be represented by the access time corresponding to the data access request, and the spatial attribute can be represented by the current device location of the first electronic device.

[0065] Based on this, in this embodiment, when verifying whether the first electronic device meets the verification conditions of the second electronic device in step 102, it can be determined whether the time attribute in the attribute identifier meets the verification conditions of the second electronic device. If the time attribute meets the verification conditions, step 103 is executed; or, in this embodiment, it can be determined whether the spatial attribute in the attribute identifier meets the verification conditions of the second electronic device. If the spatial attribute meets the verification conditions, step 103 is executed; or, in this embodiment, it can be determined whether the time attribute in the attribute identifier meets the verification conditions of the second electronic device and whether the spatial attribute in the attribute identifier meets the verification conditions of the second electronic device. If both the time attribute and the spatial attribute meet the verification conditions, step 103 is executed.

[0066] As can be seen, in this embodiment, the first electronic device is verified in terms of multiple attributes such as access time and device location to determine whether the first electronic device has the legal right to access data on the second electronic device.

[0067] In one implementation, the second electronic device has a preset identifier, which can be understood as a verification condition for the second electronic device. In this embodiment, determining whether the first electronic device meets the verification condition of the second electronic device based on the attribute identifier of the first electronic device can specifically be as follows: determine whether the attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device. If the attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device, it indicates that the first electronic device meets the verification condition of the second electronic device, that is, the first electronic device has the legal permission to access the data on the second electronic device; if the attribute identifier of the first electronic device does not match the verification identifier corresponding to the second electronic device, it indicates that the first electronic device does not meet the verification condition of the second electronic device, that is, the first electronic device does not have the legal permission to access the data on the second electronic device.

[0068] Specifically, the preset identifier corresponding to the second electronic device includes at least one time range and at least one spatial range. Based on this:

[0069] In one implementation, the attribute identifier of the first electronic device matches a preset identifier corresponding to the second electronic device, which may include:

[0070] The access time represented by the time attribute in the attribute identifier of the first electronic device is within the time range of any one of the preset identifiers corresponding to the second electronic device, or the terminal location represented by the spatial attribute in the attribute identifier of the first electronic device is within the spatial range of any one of the preset identifiers corresponding to the second electronic device.

[0071] In another implementation, the attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device, which may include:

[0072] The access time represented by the time attribute in the attribute identifier of the first electronic device is within the time range of any one of the preset identifiers corresponding to the second electronic device.

[0073] Furthermore, the terminal location represented by the spatial attribute in the attribute identifier of the first electronic device is within any one of the spatial ranges of the preset identifiers corresponding to the second electronic device.

[0074] Specifically, time ranges can be identified by time periods, while spatial ranges can be represented by geographical coordinates or network address ranges. For example, DO corresponds to the time range of 8:00 to 18:00 and the spatial range of IP-1 to IP-20. If DU's access time is between 8:00 and 18:00 and DU's IP address is within the range of IP-1 to IP-20, then DU meets DO's verification conditions, meaning DU has legitimate permission to access DO's data.

[0075] In one implementation, obtaining the target private key corresponding to the second electronic device in step 103 can be achieved in the following way:

[0076] First, based on the data identifier, the device information of the second electronic device to which the first data belongs is obtained. For example, device information that uniquely identifies the second electronic device, such as the device name or device code, is determined according to the data identifier. Then, a target private key corresponding to the device information is obtained from a preset key set. For example, the corresponding key information is searched in the key set according to the device information to obtain the target private key that matches the device information.

[0077] It should be noted that the key set contains public and private key information for multiple secondary electronic devices. The public key information is used for data encryption, and the private key information is used for data decryption. Specifically, the public and private key information for the secondary electronic devices can be obtained through the following methods:

[0078] First, upon receiving an encryption request from the second electronic device, the security parameters of the second electronic device are obtained. These security parameters are unique to the second electronic device, which can set them as needed, such as a random string. Then, the security parameters are processed to obtain the private key and public key information corresponding to the second electronic device. The public key information is used to encrypt the data, and the private key information is used to decrypt the data.

[0079] The encryption request for the second electronic device can be generated when the second electronic device joins the network, or it can be generated after the second electronic device has joined the network and needs to upload data. The encryption request at least indicates that the second electronic device needs to use public key information and private key information. Based on this, in this embodiment, upon receiving the encryption request from the second electronic device, the private key information and public key information are generated for the second electronic device using its own security parameters.

[0080] Specifically, in this embodiment, a key generation algorithm can be used to process the security parameters, such as string replacement, encryption, and hashing, to obtain public and private key information that cannot be copied by other devices. Then, the public and private key information of the second electronic device is stored in a key set. Furthermore, in this embodiment, the verification device can also send the public key information of the second electronic device to the second electronic device, so that the second electronic device can send the public key information to an edge device. The edge device then uses the public key information of the second electronic device to encrypt the data of the second electronic device before sending it to a remote storage device for storage.

[0081] In one implementation, the key set also includes a preset identifier corresponding to the second electronic device. The preset identifier is used to verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier. The preset identifier is obtained by configuring the operation based on the received identifier.

[0082] In other words, the verification device in this embodiment can query the preset identifier corresponding to the second electronic device from the key set. When it receives a data access request sent by the first electronic device, it compares the attribute identifier in the data access request with the queried preset identifier. If the attribute identifier matches the preset identifier, it can obtain the target private key of the second electronic device, so that it can be sent to the edge device through the first electronic device. The edge device uses the target private key of the second electronic device to decrypt the first data obtained from the remote storage device, and then sends the decrypted second data to the first electronic device to achieve secure data access.

[0083] refer to Figure 3 This is a flowchart illustrating the implementation of a data processing method provided in Embodiment 2 of this application. This method can be applied to edge devices capable of data processing, where the edge device is connected to multiple electronic devices and also connected to a remote storage device, such as... Figure 2 As shown in the image.

[0084] Specifically, the method in this embodiment may include the following steps:

[0085] Step 301: Receive a data access request sent by the first electronic device.

[0086] The data access request includes at least the attribute identifier of the first electronic device and the data identifier of the data to be accessed.

[0087] Step 302: Obtain the first data corresponding to the data identifier from the remote storage device based on the data identifier.

[0088] In this embodiment, the first data belongs to the second electronic device and is encrypted. Specifically, in this embodiment, a data identifier can be used to search for the first data that matches the data identifier in a remote storage device.

[0089] Step 303: Upon receiving the target private key sent by the first electronic device, use the target private key to decrypt the first data to obtain the second data.

[0090] The target private key is sent to the first electronic device by the verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier.

[0091] Step 304: Send the second data to the first electronic device.

[0092] As can be seen from the above scheme, in the data processing method provided in Embodiment 2 of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0093] In one implementation, the method in this embodiment may further include the following steps, such as... Figure 4 As shown:

[0094] Step 401: Receive a data storage request sent by the second electronic device.

[0095] The data storage request includes at least the public key information corresponding to the second data and the second electronic device. The public key information corresponding to the second electronic device is generated by the verification device based on the security parameters of the second electronic device and sent to the second electronic device.

[0096] Step 402: Encrypt the second data using the public key information to obtain the first data.

[0097] Step 403: Send the first data to the remote storage device.

[0098] In other words, the process described in steps 401 to 403 is the process mentioned in this embodiment where the first data is encrypted and stored in a remote storage device. For example, with Figure 2 For example, DO sends the data that needs to be saved to the cloud server and DO's public key information to the edge node. The edge node uses DO's public key information to encrypt DO's data and uploads the encrypted data to the cloud server for storage. After receiving DO's private key information from DU and reading the encrypted data from the cloud server, the edge node uses DO's private key information to decrypt the encrypted data and sends the decrypted data to DU, thereby achieving secure data access.

[0099] refer to Figure 5 This is a schematic diagram of a data processing device provided in Embodiment 3 of this application. This device can be configured in an electronic device capable of data processing, such as a computer or server. The technical solution in this embodiment is mainly used to improve the data security of terminals within a local area network.

[0100] Specifically, the device in this embodiment may include the following units:

[0101] The request receiving unit 501 is used to receive a data access request sent by a first electronic device. The data access request includes at least an attribute identifier of the first electronic device and a data identifier of the first data to be accessed. The first data belongs to a second electronic device. Both the first electronic device and the second electronic device are connected to an edge device, and the edge device is connected to a remote storage device.

[0102] The condition verification unit 502 is used to verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; if the first electronic device meets the verification conditions, the private key acquisition unit 503 is triggered.

[0103] Private key acquisition unit 503 is used to acquire the target private key corresponding to the second electronic device;

[0104] The private key transmission unit 504 is used to send the target private key to the edge device through the first electronic device, so that the edge device uses the target private key to decrypt the first data obtained from the remote storage device and sends the obtained second data to the first electronic device.

[0105] As can be seen from the above scheme, in the data processing device provided in Embodiment 3 of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0106] In one implementation, the attribute identifier includes at least a time attribute and / or a spatial attribute, wherein the time attribute is related to the access time corresponding to the data access request; and the spatial attribute is related to the current device location of the first electronic device.

[0107] In one implementation, the preset identifier corresponding to the second electronic device includes at least one time range and at least one spatial range; wherein, the attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device, including: the access time represented by the time attribute in the attribute identifier of the first electronic device is within any one of the time ranges; and the terminal location represented by the spatial attribute in the attribute identifier of the first electronic device is within any one of the spatial ranges.

[0108] In one implementation, the private key acquisition unit 503 is specifically used to: obtain device information of the second electronic device to which the first data belongs based on the data identifier; and obtain a target private key corresponding to the device information from a preset key set.

[0109] In one implementation, the key set includes public key information and private key information corresponding to multiple second electronic devices; wherein, the device in this embodiment may further include the following units, such as... Figure 6 As shown:

[0110] The key acquisition unit 505 is used to obtain the security parameters of the second electronic device upon receiving an encryption request from the second electronic device; and to process the security parameters to obtain the private key information and public key information corresponding to the second electronic device, wherein the public key information is used to encrypt data and the private key information is used to decrypt data.

[0111] In one implementation, the key set further includes a preset identifier corresponding to the second electronic device. The preset identifier is used to verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier. The preset identifier is obtained based on the received identifier configuration operation.

[0112] It should be noted that the specific implementation of each unit in this embodiment can be referred to the corresponding content above, and will not be described in detail here.

[0113] refer to Figure 7 This is a schematic diagram of a data processing device provided in Embodiment 4 of this application. This device can be configured on an edge device capable of data processing. The edge device is connected to multiple electronic devices and also to a remote storage device, such as... Figure 2 As shown in the figure. The technical solution in this embodiment is mainly used to improve the data security of terminals within a local area network.

[0114] Specifically, the apparatus in this embodiment may include the following units:

[0115] The request receiving unit 701 is used to receive a data access request sent by the first electronic device, wherein the data access request includes at least the attribute identifier of the first electronic device and the data identifier of the data to be accessed;

[0116] The data acquisition unit 702 is configured to obtain first data corresponding to the data identifier from the remote storage device based on the data identifier; the first data belongs to the second electronic device.

[0117] The data decryption unit 703 is used to decrypt the first data using the target private key when it receives the target private key sent by the first electronic device, so as to obtain the second data.

[0118] The target private key is sent to the first electronic device by the verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier;

[0119] The data transmission unit 704 is used to transmit the second data to the first electronic device.

[0120] As can be seen from the above scheme, in the data processing device provided in Embodiment 4 of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0121] In one implementation, the apparatus in this embodiment may further include the following units, such as... Figure 8 As shown:

[0122] The encryption processing unit 705 is configured to receive a data storage request sent by the second electronic device, wherein the data storage request includes at least the second data and public key information corresponding to the second electronic device; the public key information corresponding to the second electronic device is generated by the verification device according to the security parameters of the second electronic device and sent to the second electronic device; the second data is encrypted using the public key information to obtain the first data; and the first data is sent to the remote storage device.

[0123] It should be noted that the specific implementation of each unit in this embodiment can be referred to the corresponding content above, and will not be described in detail here.

[0124] refer to Figure 9This is a schematic diagram of a verification device provided in Embodiment 5 of this application. The verification device can be a computer or server, etc. The technical solution in this embodiment is mainly used to improve the data security of terminals within a local area network.

[0125] Specifically, the verification device in this embodiment may include the following structure:

[0126] Memory 901 is used to store computer programs and data generated by the execution of said computer programs;

[0127] Processor 902 is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of first data to be accessed, the first data belonging to a second electronic device, both the first electronic device and the second electronic device being connected to an edge device, the edge device being connected to a remote storage device; verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; if the first electronic device meets the verification conditions, obtain a target private key corresponding to the second electronic device; send the target private key to the edge device through the first electronic device, so that the edge device uses the target private key to decrypt the first data obtained from the remote storage device and sends the obtained second data to the first electronic device.

[0128] As can be seen from the above scheme, in the verification device provided in Embodiment 5 of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0129] refer to Figure 10 This is a schematic diagram of an edge device provided in Embodiment Six of this application. The edge device is connected to multiple electronic devices, and the edge device is also connected to a remote storage device, such as... Figure 2 As shown in the figure. The technical solution in this embodiment is mainly used to improve the data security of terminals within a local area network.

[0130] Specifically, the edge device in this embodiment may include the following structure:

[0131] Memory 1001 is used to store computer programs and data generated by the execution of said computer programs;

[0132] Processor 1002 is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of the data to be accessed; obtain first data corresponding to the data identifier from the remote storage device according to the data identifier; the first data belongs to a second electronic device; upon receiving a target private key sent by the first electronic device, decrypt the first data using the target private key to obtain second data; wherein the target private key is sent to the first electronic device by a verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device according to the attribute identifier; and send the second data to the first electronic device.

[0133] As can be seen from the above scheme, in the edge device provided in Embodiment Six of this application, the verification device verifies the electronic device with access requirements based on the attribute identifier of the electronic device. Only when the electronic device meets the verification conditions of the accessed electronic device is the private key of the accessed electronic device allowed to be obtained, so that the edge device can decrypt the accessed data on the remote storage and then send the decrypted data to the electronic device. Therefore, in this embodiment, the verification device performs device verification and the edge device performs data decryption, thereby improving the data security of each device within the local area network.

[0134] Taking smart home scenarios as an example, people can turn all smart devices in their home on and off with just one electronic device, navigating a sea of ​​electronic data. However, the storage, sharing, management, and control of electronic privacy data in smart homes has become a major challenge. Various cloud storage technologies have been proposed for the storage, management, and sharing of massive amounts of personal data, bringing great convenience to life. However, traditional cloud storage servers are not entirely trustworthy. When users store data on cloud servers, their personal privacy data is subject to a series of security threats. To prevent the leakage of private electronic data during transmission, attribute encryption can be used to encrypt and control user data before it is uploaded from edge computing devices to cloud servers, ensuring user privacy and security.

[0135] This application provides an edge computing attribute encryption data control scheme for smart homes. This scheme encrypts electronic data generated by smart devices (i.e., smart terminals) at the edge device through an attribute encryption scheme that supports time and spatial domain constraints. This effectively meets the real-time and mobility requirements of edge computing. In addition, it provides fine-grained access authorization, allowing only users whose attribute sets meet the access policy to access and control smart home device data. This effectively prevents third-party users from accessing and using electronic control data, greatly protecting user privacy and data control security.

[0136] Specifically, the edge computing attribute encryption data control scheme provided in this application for smart homes mainly involves: DO, DU, Central Authority (CA), AA, EN, and CSP.

[0137] In this context, DO refers to the data source, which owns and controls the data and uploads access policies to the CSP.

[0138] DU refers to the user who needs to access data in the cloud server. The data user obtains the decryption result from EN and gets the plaintext data.

[0139] EN has storage and computing capabilities to process DU access requests in real time, decrypt the ciphertext of DU requests, and transmit the results to DU.

[0140] CA is completely trustworthy and is responsible for the registration of DO, DU, and AA;

[0141] The AA is completely trusted. The AA generates a public-private key pair (i.e., public key information and decryption information) based on attributes within the domain (i.e., the local area network). The public key information is sent to the DO for encryption, and the private key information is sent to the DU for decryption. The AA determines whether to generate and distribute the relevant attribute private key to the DU by comparing whether the DU's request time (i.e., access time) and request location (i.e., device location) are both within a valid range.

[0142] As can be seen, the solution provided in this application can be applied in local area clouds to meet the security and privacy needs of local users. Furthermore, the solution utilizes mobile cloud storage for user data within the local area network and encrypts user data stored on the cloud server through edge computing attribute encryption. Moreover, when a user needs to access control data, the attribute authorization authority compares the user's temporal and spatial characteristics to determine whether to generate and distribute relevant attribute private keys to the user, increasing the security of accessed data. Simultaneously, after receiving access information from the data user, the edge computing node searches the cloud server based on the user's search information. When the user's attribute private key matches the access policy defined by the data owner, the edge computing node can transmit plaintext control data to the data user. This access control method integrates computation at the edge node, reducing the computational burden on the cloud server.

[0143] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0144] Please see Figure 11 and Figure 12 The implementation steps of this application are as follows:

[0145] 1. Registration: DO, DU, and AA register with the CA. These three roles submit their identity information to the CA. DO I DU I AA To verify the legitimacy of their identity;

[0146] 2. System setup: such as Figure 11 In the system architecture, when a DO connects to the system, it inputs the security parameter w, and the AA outputs the DO's public key P. DO Key M DO And artificially set the time domain [T1…T N ] and spatial domain [H1…H N ];

[0147] 3. Data encryption: DO's data D DO On the EN side, data is encrypted using encryption algorithm E, as shown in formula (1), and the ciphertext T is stored. DO In the cloud server CSP;

[0148] T DO =E(D) DO ) Formula (1)

[0149] 4. Data Access: When a registered DU needs to access the CSP's control data, the DU sends a request to both the AA and the edge node EN.

[0150] 5. Attribute Verification: AA verifies the time domain T of the requested DU. DU (i.e., time range) and spatial domain H DU (i.e., spatial range) attribute verification is performed, as shown in formulas (2) and (3) below, to verify whether it meets the set value, when the time domain T of DU DU With spatial domain H DU After all values ​​are within the set range, AA sends key M to DU. DO ;

[0151] T DU ∈[T1…T N ] Formula (2)

[0152] H DU ∈[H1…H N ] Formula (3)

[0153] 6. Data decryption and control: EN decrypts and controls data based on the key M sent by DU. DO Data decryption is performed using the following formula (4), allowing the data user to access and control the decrypted electronic data D. DO .

[0154] D DO =T DO M DO Formula (4)

[0155] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0156] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0157] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0158] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, comprising: The device receives a data access request sent by a first electronic device. The data access request includes at least an attribute identifier of the first electronic device and a data identifier of the first data to be accessed. The first data belongs to a second electronic device. Both the first electronic device and the second electronic device are connected to an edge device, and the edge device is connected to a remote storage device. Based on the attribute identifier, verify whether the first electronic device meets the verification conditions corresponding to the second electronic device; If the first electronic device meets the verification conditions, the target private key corresponding to the second electronic device is obtained; wherein, the target private key is a private key pre-configured by the second electronic device for fully decrypting the first data; The target private key is sent to the edge device through the first electronic device, so that the edge device can use the target private key to independently decrypt the first data obtained from the remote storage device to obtain the second data in plaintext form, and send the second data to the first electronic device. The first electronic device does not participate in the decryption process.

2. The method according to claim 1, wherein the attribute identifier includes at least a time attribute and / or a spatial attribute, wherein the time attribute is related to the access time corresponding to the data access request; and the spatial attribute is related to the current device location of the first electronic device.

3. The method according to claim 1 or 2, wherein the preset identifier corresponding to the second electronic device includes at least one time range and at least one spatial range; in, The attribute identifier of the first electronic device matches the preset identifier corresponding to the second electronic device, including: The access time represented by the time attribute in the attribute identifier of the first electronic device falls within any of the stated time ranges; Furthermore, the terminal location represented by the spatial attribute in the attribute identifier of the first electronic device is within any of the aforementioned spatial ranges.

4. The method according to claim 1 or 2, wherein obtaining the target private key corresponding to the second electronic device includes: Based on the data identifier, obtain the device information of the second electronic device to which the first data belongs; Obtain the target private key corresponding to the device information from the preset key set.

5. The method according to claim 4, wherein the key set includes public key information and private key information corresponding to multiple second electronic devices; in, The public and private key information corresponding to the second electronic device is obtained in the following way: Upon receiving an encryption request from the second electronic device, obtain the security parameters of the second electronic device; The security parameters are processed to obtain the private key information and public key information corresponding to the second electronic device. The public key information is used to encrypt the data, and the private key information is used to decrypt the data.

6. The method according to claim 5, wherein the key set further includes a preset identifier corresponding to the second electronic device, the preset identifier being used to verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; wherein, The preset identifier is obtained by configuring the operation based on the received identifier.

7. A data processing method applied to an edge device, the edge device being connected to a plurality of electronic devices and the edge device being connected to a remote storage device, the method comprising: Receive a data access request sent by a first electronic device, wherein the data access request includes at least the attribute identifier of the first electronic device and the data identifier of the data to be accessed; Based on the data identifier, first data corresponding to the data identifier is obtained from the remote storage device; the first data belongs to the second electronic device. Upon receiving the target private key sent by the first electronic device, the first data is decrypted independently using the target private key to obtain the second data in plaintext form; wherein, the target private key is a private key pre-configured by the second electronic device for fully decrypting the first data; The target private key is sent to the first electronic device by the verification device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; The second data is sent to the first electronic device, which does not participate in the decryption process.

8. The method according to claim 7, further comprising: Receive a data storage request sent by the second electronic device, wherein the data storage request contains at least the second data and the public key information corresponding to the second electronic device; The public key information corresponding to the second electronic device is generated by the verification device based on the security parameters of the second electronic device and sent to the second electronic device. The second data is encrypted using the public key information to obtain the first data; The first data is sent to the remote storage device.

9. A verification device, comprising: A memory used to store computer programs and the data generated by the execution of said computer programs; A processor is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of first data to be accessed, the first data belonging to a second electronic device, both the first and second electronic devices being connected to an edge device, the edge device being connected to a remote storage device; verify whether the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; if the first electronic device meets the verification conditions, obtain a target private key corresponding to the second electronic device; wherein the target private key is a private key pre-configured by the second electronic device for fully decrypting the first data; send the target private key to the edge device through the first electronic device, so that the edge device independently uses the target private key to decrypt the first data obtained from the remote storage device to obtain second data in plaintext form, and sends the second data to the first electronic device, the first electronic device not participating in the decryption process.

10. An edge device connected to a plurality of electronic devices and connected to a remote storage device, the edge device comprising: A memory used to store computer programs and the data generated by the execution of said computer programs; A processor is configured to execute the computer program to: receive a data access request sent by a first electronic device, the data access request including at least an attribute identifier of the first electronic device and a data identifier of the data to be accessed; obtain first data corresponding to the data identifier from a remote storage device based on the data identifier; the first data belongs to a second electronic device; upon receiving a target private key sent by the first electronic device, independently decrypt the first data using the target private key to obtain second data in plaintext form; wherein the target private key is a private key pre-configured by the second electronic device for fully decrypting the first data; wherein the target private key is sent by a verification device to the first electronic device after verifying that the first electronic device meets the verification conditions corresponding to the second electronic device based on the attribute identifier; and send the second data to the first electronic device, without the first electronic device participating in the decryption process.

Images