Data aggregation method, device, storage medium and electronic device

Abstract

The present specification discloses a method, device, storage medium and electronic device for data aggregation, including: receiving mask data sent by each smart device and the label value corresponding to each mask data. According to each mask data and each label value, based on a pre-constructed aggregation tree, aggregate each mask data to determine the mask result. Then, receive the mask bit share of the mask result sent by each smart device and the message verification corresponding to the mask bit share, and verify each mask bit share according to the message verification code corresponding to each mask bit share. When the verification passes, decrypt the mask result according to each mask bit share, determine the aggregation result, ensure the accuracy of each mask bit share sent by each smart device, and use each mask bit share that has passed the verification to decrypt the mask result to ensure the accuracy of the aggregation result.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, storage medium and electronic device for data aggregation. Background Art

[0002] With the continuous development of science and technology, data aggregation has received widespread attention. Data aggregation is a technology that combines data from different data sources and is commonly used in IoT scenarios.

[0003] At present, smart devices that provide services to users, such as smart phones, smart meters, and smart watches, can collect user data generated when users use smart devices. However, the user data collected by each smart device is different. In order to better provide services to users, the user data collected by smart devices can be aggregated, and the aggregated data can be analyzed, and then services can be provided to users based on the analysis results. However, user data often contains the user's private data. When aggregating based on the collected user data, each smart device needs to ensure that the user's private data is not leaked. Therefore, how to aggregate data while protecting user privacy is an important issue.

[0004] Based on this, this specification provides a method for data aggregation. Summary of the invention

[0005] This specification provides a data aggregation method, device, storage medium and electronic device to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This specification provides a method for data aggregation, which is applied to an aggregation center and includes:

[0008] Receiving mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share on the to-be-aggregated data, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function;

[0009] According to the mask data and the label values, based on a pre-constructed aggregation tree, the mask data are aggregated to determine a mask result;

[0010] Receiving a mask bit share of the mask result and a message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result;

[0011] Verifying each mask bit share according to a message authentication code corresponding to each mask bit share;

[0012] When the verification is passed, the mask result is decrypted according to the bit shares of each mask to determine the aggregation result.

[0013] Optionally, the aggregation tree includes a plurality of operation nodes, each of which includes a plurality of XOR operation units;

[0014] According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including:

[0015] According to the mask data and the label values, for each operation node in the pre-constructed aggregation tree, and in turn for each XOR operation unit in the operation node, determine the mask data and the label value input to the XOR operation unit;

[0016] Performing an XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and performing an XOR operation on the determined label value to determine the label value output by the XOR operation unit;

[0017] The mask data output by the XOR operation unit is used as the mask data of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node;

[0018] The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0019] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0020] Receive the mask data sent by each smart device and the label value corresponding to each mask data, including:

[0021] Send the pre-built aggregation tree to each smart device;

[0022] Receiving the unit ciphertext, mask data and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device;

[0023] According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including:

[0024] According to the mask data and the label values, for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the mask data input to the AND operation unit, and determine the unit ciphertext corresponding to the AND operation unit according to the determined mask data;

[0025] Determine the label value input to the AND operation unit, and determine the mask data and label value output by the AND operation unit according to the determined label value and the unit ciphertext;

[0026] The mask data output by the AND operation unit is used as the mask data of the next AND operation unit input to the AND operation unit, and the label value output by the AND operation unit is used as the label value of the next AND operation unit input to the AND operation unit, until the mask data and label value output by the last AND operation unit are determined, the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the label value output by the last AND operation unit is used as the label value output by the operation node;

[0027] The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0028] Optionally, the AND operation unit corresponds to a number of unit ciphertexts;

[0029] Determining the mask data and the label value output by the AND operation unit according to the determined label value and the unit ciphertext, specifically includes:

[0030] For each unit ciphertext, determine the mask data to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined label value and the unit ciphertext;

[0031] Determine a key of a message authentication code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computation preprocessing function, and perform calculation according to the key and the mask data to be verified output by the AND operation unit to determine a first calculation result;

[0032] Determining whether each first calculation result is consistent with a message verification code corresponding to each mask data to be verified;

[0033] If yes, each mask data to be verified is used as mask data output by the AND operation unit;

[0034] If not, the smart device corresponding to the mask data to be verified that failed the verification is determined, and a verification failure message is sent to the determined smart device.

[0035] Optionally, verifying each mask bit share according to a message verification code corresponding to each mask bit share specifically includes:

[0036] For each mask bit share, determine a key and a message authentication code corresponding to the mask bit share generated based on the multi-party secure computing preprocessing function, and perform calculations based on the key and the mask bit share to determine a second calculation result;

[0037] The mask bit shares are verified according to the second calculation results corresponding to the mask bit shares and the message verification codes corresponding to the mask bit shares.

[0038] This specification also provides a data aggregation method, which is applied to a smart device and includes:

[0039] Determine the data to be aggregated;

[0040] Generate mask bit shares using a secure multi-party computing preprocessing function according to a topological structure of an aggregation tree, wherein the aggregation tree is pre-constructed by an aggregation center;

[0041] Processing the data to be aggregated according to the mask bit share, determining mask data, and generating a label value corresponding to the mask data;

[0042] Sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device;

[0043] Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result.

[0044] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0045] Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes:

[0046] For each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the share of verifiable mask bits and the label value input to the AND operation unit;

[0047] Using the secure multi-party computation preprocessing function, determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit;

[0048] Determine a unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit;

[0049] The unit ciphertext corresponding to the operation unit of each operation node in the aggregation tree, the mask data and the label value corresponding to the mask data are sent to the aggregation center.

[0050] Optionally, the computing node further includes a plurality of XOR computing units;

[0051] Determine the verifiable mask bit share and label value input to the AND operation unit, including:

[0052] When the previous operation unit of the AND operation unit is an XOR operation unit, determining a verifiable mask bit share and a label value input to the previous operation unit of the AND operation unit;

[0053] Determine the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share input to the previous operation unit of the AND operation unit, and use it as the verifiable mask bit share input to the AND operation unit;

[0054] According to the label value of the previous operation unit input to the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined and used as the label value input to the AND operation unit.

[0055] Optionally, the computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND operation unit includes a first verifiable mask bit share and a second verifiable mask bit share;

[0056] Determining a unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, specifically includes:

[0057] Determine a first value according to the first numerical value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value according to the second numerical value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the operation node;

[0058] receiving a third value and a fourth value sent by the other smart device, aggregating the received third value and the first value to determine a first total value, and aggregating the received fourth value and the second value to determine a second total value;

[0059] Determine the mask data to be verified output by the AND operation unit according to the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit;

[0060] The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0061] Optionally, sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes:

[0062] The mask data is sent to other smart devices except the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and the mask data and the label values ​​corresponding to the mask data are sent to the aggregation center.

[0063] This specification provides a data aggregation device, which is applied to an aggregation center and includes:

[0064] A first receiving module is used to receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share on the data to be aggregated, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function;

[0065] An aggregation module, configured to aggregate the mask data according to the mask data and the label values ​​based on a pre-built aggregation tree to determine a mask result;

[0066] A second receiving module is used to receive the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share, wherein each mask bit share is used to decrypt the mask result;

[0067] A verification module, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share;

[0068] The decryption module is used to decrypt the mask result according to the bit shares of each mask to determine the aggregation result when the verification is passed.

[0069] This specification also provides a data aggregation device, which is applied to a smart device and includes:

[0070] A determination module, used to determine the data to be aggregated;

[0071] A generation module, configured to generate a mask bit share according to a topological structure of an aggregation tree and using a secure multi-party computing preprocessing function, wherein the aggregation tree is pre-constructed by an aggregation center;

[0072] An encryption module, used to process the data to be aggregated according to the mask bit share, determine the mask data, and generate a label value corresponding to the mask data;

[0073] A sending module, used for sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value sent by each smart device;

[0074] The mask module is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result according to each mask bit share and the mask result.

[0075] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data aggregation method is implemented.

[0076] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned data aggregation method when executing the program.

[0077] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0078] The data aggregation method provided in this specification first receives the mask data sent by each smart device and the label value corresponding to each mask data. According to each mask data and each label value, based on a pre-built aggregation tree, each mask data is aggregated to determine the mask result. Then, the mask bit share of the mask result sent by each smart device and the message verification corresponding to the mask bit share are received, and each mask bit share is verified according to the message verification code corresponding to each mask bit share. When the verification passes, the mask result is decrypted according to each mask bit share to determine the aggregation result.

[0079] It can be seen from the above method that when performing data aggregation, the present application receives the mask data sent by each smart device and the label value corresponding to each mask data. According to each mask data and each label value, based on the pre-built aggregation tree, each mask data is aggregated to determine the mask result. Then, the mask bit share of the mask result sent by each smart device and the message verification corresponding to the mask bit share are received, and each mask bit share is verified according to the message verification code corresponding to each mask bit share. When the verification is passed, the mask result is decrypted according to each mask bit share, the aggregation result is determined, the accuracy of each mask bit share sent by each smart device is ensured, and the mask result is decrypted using each mask bit share that has passed the verification to ensure the accuracy of the aggregation result. BRIEF DESCRIPTION OF THE DRAWINGS

[0080] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0081] Figure 1 A flowchart of a data aggregation method provided in this specification;

[0082] Figure 2 A schematic diagram of a polymerization tree provided in this specification;

[0083] Figure 3 A flowchart of another data aggregation method provided in this specification;

[0084] Figure 4 A schematic diagram of a data aggregation device structure provided in this specification;

[0085] Figure 5 A schematic diagram of another data aggregation device structure provided in this specification;

[0086] Figure 6 A method corresponding to the Figure 1 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0087] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0088] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0089] Figure 1 is a flowchart of a data aggregation method provided in this specification, Figure 1 The method shown is applied to the aggregation center and specifically includes the following steps:

[0090] S100: Receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data after the smart device processes the aggregated data based on the mask bit share, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function.

[0091] In this specification, in order to better provide services to users, the aggregation center can aggregate the user data collected by the smart device, analyze the aggregated data, and then provide services to users based on the analysis results. For example, in the vehicle dispatching scenario, each building in the area to be dispatched has one or more smart devices for collecting user data. The smart device can be an image acquisition device such as a camera or a video camera in the building. The user data includes information such as the collected user's image, the number of users, the time when the user arrives at the building, and the time when the user leaves the building. The vehicle dispatching system (i.e., the aggregation center) can aggregate the user data collected by each smart device, analyze the aggregated data, and determine the analysis results. The analysis results can be the user flow in the area to be dispatched in each time period. According to the determined analysis results, the vehicle is reasonably dispatched to the area to be dispatched. However, the user data may contain the privacy data of the user or the building where the smart device is located, such as the user's personal information, the user's image, and other information. Therefore, when performing data aggregation, if the smart device directly sends the collected user data to the aggregation center, the aggregation center can know the specific data collected by each smart device, which will leak the privacy of the user or the privacy of the smart device.

[0092] Based on this, the device for data aggregation can receive the mask data sent by each smart device and the label value corresponding to each mask data, wherein the device for data aggregation is an aggregation center, which can be a system, a server, or an electronic device such as a desktop computer or a laptop computer. For the convenience of description, the following only takes the aggregation center as the execution subject to describe the method of data aggregation provided in this specification. Smart devices are any devices that can collect data. In different data aggregation scenarios, smart devices may be the same or different. Similarly, the aggregation centers may be the same or different. In the vehicle dispatching scenario, the aggregation center may be a vehicle dispatching system or a service provider that can dispatch vehicles. Smart devices may be image acquisition devices such as cameras and video cameras in the area to be dispatched. In the smart grid scenario, the aggregation center may be a power center, and the smart device may be an electric meter in the user's residence. For the convenience of description, the following is an example of the aggregation center and the smart device. The mask data is the data processed by the smart device based on the mask bit share to be aggregated, and the mask bit share is generated by the smart device based on the secure multi-party computing preprocessing function, and the label value corresponding to the mask data is a bit string randomly generated by the smart device based on the mask data. The secure multi-party computing preprocessing function is a function in the existing secure multi-party computing library. The secure multi-party computing preprocessing function can generate global keys for each smart device and the aggregation center based on the aggregation tree, the mask bit shares of the data input to each operation node in the aggregation tree, the mask bit shares of the data output by each operation node in the aggregation tree, the message verification code of each mask bit share that needs to be verified, and the key corresponding to each verification code.

[0093] In this specification, due to different scenarios of data aggregation application, the data collected by the smart device may be different, and the data to be aggregated may also be different. In the vehicle dispatch scenario, the user data collected by the smart device includes information such as the collected images of the users, the number of users, the time when the users arrive at the building, and the time when the users leave the building. Therefore, the data to be aggregated can be the above-mentioned user data, or it can be part of the user data such as the number of the above-mentioned users, and this specification does not limit it. In the smart grid scenario, the user data collected by the smart device includes information such as user information, the user's electricity consumption, the user's address, and the user's electricity consumption time period. Therefore, the data to be aggregated can be the above-mentioned user data, or it can be part of the user data such as the user's electricity consumption, and this specification does not specifically limit it. In addition, since the data to be aggregated contains the user's privacy data, the smart device can first mask the data to be aggregated, and then send the masked data to be aggregated (i.e., masked data) to the aggregation center to ensure that the user's privacy data contained in the data to be aggregated is not leaked.

[0094] Specifically, each smart device can generate a mask bit share based on a secure multi-party computing preprocessing function, determine the data to be aggregated, and use the mask bit share to process the data to be aggregated, determine the mask data, and generate a label value corresponding to the mask data, and send the mask data and the corresponding label value to the aggregation center. The aggregation center receives the mask data sent by each smart device and the label value corresponding to each mask data. Among them, the label value can be a bit string randomly generated by the smart device based on the mask data. When the bit value of the mask data is 0, the smart device can randomly generate a K-bit bit string as the label value. When the bit value of the mask data is 1, the smart device can perform an XOR operation on the bit string generated when the bit value is 0 and a pre-stored global key, and use the result of the XOR operation as the label value. K is a natural number. The global key can be generated by the smart device in advance based on a secure multi-party computing preprocessing function.

[0095] S102: According to the mask data and the label values, based on a pre-constructed aggregation tree, the mask data are aggregated to determine a mask result.

[0096] The aggregation center aggregates each mask data according to each mask data and each label value based on the pre-constructed aggregation tree to determine the mask result. Among them, the aggregation tree is pre-constructed by the aggregation center based on the number of smart devices that perform data aggregation. The leaf nodes in the aggregation tree represent the data to be aggregated corresponding to each smart device, and each leaf node represents the data to be aggregated of an intelligent device. All nodes except the leaf nodes in the aggregation tree are operation nodes, which are used to perform XOR operations, AND operations, etc. on the data input to the operation node. The result output by the root node in the aggregation tree is the result of data aggregation of the data to be aggregated of each smart device. For the upstream node (i.e., the operation node) of the leaf node in the aggregation tree, there are two smart devices whose data to be aggregated are input into the upstream node, but for the upstream node of the upstream node, there can be four smart devices inputting data into the upstream node of the upstream node. Therefore, the aggregation tree contains several operation nodes, and at least two smart devices input data into the operation node.

[0097] For example, Figure 2 As shown, Figure 2This is a schematic diagram of an aggregation tree provided in this specification. Assume that there are n smart devices performing data aggregation, namely smart device D1 to smart device Dn, and the corresponding input of each smart device is v1 to vn. v1 to vn are used as leaf nodes of the aggregation tree. Since the data aggregation process can be v1+v2+v3+v4+...+vn, it can also be expressed as (v1+v2)+(v3+v4)+...+(vn-1+vn)=[(v1+v2)+(v3+v4)]+...+(vn-1+vn)], so at the bottom layer of the aggregation tree, every two leaf nodes serve as inputs of their upstream nodes, for example, v1 and v2 as leaf nodes serve as inputs of their upstream nodes, and the upstream nodes are operation nodes. In the process from the upstream nodes of the leaf nodes of the aggregation tree to the top layer, the outputs of every two operation nodes serve as inputs of their upstream nodes. Figure 2 The nodes with a "+" in the box represent the operation nodes in the aggregation tree.

[0098] Specifically, the aggregation center determines the mask data and label value input to each operation node in the pre-constructed aggregation tree according to each mask data and each label value, and determines the mask data output by the operation node according to the mask data input to the operation node, and determines the label value output by the operation node according to the label value input to the operation node. After that, the mask data output by the operation node is used as the mask data input to the next operation node of the operation node, and the label value output by the operation node is used as the label value input to the next operation node of the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result of the output of the aggregation tree. Among them, the next operation node of the operation node is an operation node that uses the mask data and label value output by the operation node as input. When determining the mask data and label value input to the operation node, if the operation node is an upstream operation node of a leaf node in the aggregation tree, the mask data and label value input to the operation node are determined from the received mask data and label values. If the operation node is not an upstream operation node of a leaf node in the aggregation tree, the mask data output by the previous operation node of the operation node is determined to be the mask data input to the operation node, and the label value output by the previous operation node of the operation node is determined to be the label value input to the operation node.

[0099] In the present specification, an operation node may include an XOR operation unit, and an operation node may include one or more XOR operation units. Therefore, when each operation node includes several XOR operation units, when the mask data and the label values ​​are aggregated based on a pre-built aggregation tree to determine the mask result, the aggregation center may determine the mask data and the label value input to the XOR operation unit for each operation node in the aggregation tree and for each XOR operation unit in the operation node in turn according to the mask data and the label value, perform XOR operation on the determined mask data, determine the mask data output by the XOR operation unit, and perform XOR operation on the determined label value, and determine the label value output by the XOR operation unit. Afterwards, the mask data output by the XOR operation unit is used as the mask data of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node. Afterwards, the mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0100] Wherein, if the XOR operation unit is the first operation unit in the operation node, the mask data and label value input to the XOR operation unit are the mask data and label value input to the operation node. If the XOR operation unit is not the first operation unit in the operation node, the mask data and label value input to the XOR operation unit are the mask data and label value output by the previous XOR operation unit of the XOR operation unit.

[0101] In this specification, an operation node may include an AND operation unit, and an operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, when the mask data and the label values ​​are aggregated based on the pre-built aggregation tree to determine the mask result, the aggregation center may determine the mask data input to the AND operation unit for each operation node in the aggregation tree and for each AND operation unit in the operation node in turn according to the mask data and the label values, and determine the unit ciphertext corresponding to the AND operation unit according to the determined mask data. After that, the label value input to the AND operation unit is determined, and the mask data and label value output by the AND operation unit are determined according to the determined label value and the unit ciphertext. Then, the mask data output by the AND operation unit is used as the mask data input to the next AND operation unit of the AND operation unit, and the label value output by the AND operation unit is used as the label value input to the next AND operation unit of the AND operation unit, until the mask data and label value output by the last AND operation unit are determined, the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the label value output by the last AND operation unit is used as the label value input to the operation node. After that, the mask data output by the operation node is used as the mask data input to the next operation node of the operation node, and the label value output by the operation node is used as the label value input to the next operation node of the operation node, until the mask data and label value input by the last operation node are determined, the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0102] Wherein, if the AND operation unit is the first operation unit in the operation node, the mask data and label value input to the AND operation unit are the mask data and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the mask data and label value input to the AND operation unit are the mask data and label value output by the previous AND operation unit of the AND operation unit.

[0103] The above-mentioned unit ciphertext is determined by each smart device based on the aggregation tree and sent to the aggregation center. Therefore, in the above-mentioned step S100, the aggregation center can send the pre-built aggregation tree to each smart device, and then receive the unit ciphertext, mask data and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device. Among them, when sending the pre-built aggregation tree to each smart device, the aggregation center can send an aggregation request to each smart device, and the aggregation request contains the aggregation tree, and the aggregation request is to prompt the smart device to send the data to be aggregated to the aggregation center, so that the aggregation center can perform data aggregation. Each of the above-mentioned operation units has a corresponding unit ciphertext, and each smart device can generate a corresponding unit ciphertext for each operation unit in the aggregation tree.

[0104] In addition, when the smart device generates the corresponding unit ciphertext for each operation unit in the aggregation tree, it is necessary to determine the bit value of the mask data input into the operation unit. The bit value can be 0 or 1. Since there are two mask data inputs into the operation unit, there are four combinations of the bit values ​​of the mask data input into the operation unit, namely 00, 01, 10 and 11. Each combination corresponds to a unit ciphertext, so each unit ciphertext corresponding to the operation unit can be generated based on multiple combinations, and the unit ciphertext corresponding to each combination can be generated by each smart device, that is, there are several unit ciphertexts corresponding to the operation unit.

[0105] Based on this, when determining the unit ciphertext corresponding to the operation unit according to the determined mask data, the aggregation center can determine the combination of the bit values ​​corresponding to the mask data according to the determined mask data, and determine the unit ciphertexts corresponding to the operation unit from the unit ciphertexts of the operation unit sent by each smart device according to the determined combination, that is, the number of unit ciphertexts corresponding to the operation unit. For example, smart devices D1 and D2 respectively sent 4 unit ciphertexts of operation unit A to the aggregation center, and the 4 unit ciphertexts were determined based on 4 combinations (i.e., 00, 01, 10, and 11), so the aggregation center can receive a total of 8 unit ciphertexts of operation unit A. The aggregation center can determine the combination of bit values ​​corresponding to the mask data based on the determined mask data. Assuming that the bit values ​​corresponding to the determined mask data are 0 and 1 respectively, the combination of bit values ​​is 01. The aggregation center can determine the unit ciphertext corresponding to the combination 01 from the 8 unit ciphertexts of operation unit A sent by smart devices D1 and D2 based on the combination 01. Therefore, the aggregation center can determine two unit ciphertexts corresponding to the operation unit A, that is, two unit ciphertexts corresponding to the operation unit A.

[0106] When determining the mask data and label value output by the AND operation unit according to the determined label value and the unit ciphertext, the aggregation center can determine the first mask data and the first label value output by the AND operation unit corresponding to each unit ciphertext according to the determined label value and the unit ciphertext. Afterwards, each first mask data is used as the mask data output by the AND operation unit, and each first label value is used as the label value output by the AND operation unit.

[0107] In this specification, the operation node may also include several AND operation units and several XOR operation units. Therefore, when the mask data and the label values ​​are aggregated based on a pre-built aggregation tree to determine the mask result, the aggregation center can determine the type of the operation unit for each operation node in the aggregation tree and for each operation unit in the operation node in turn. When the operation unit is an XOR operation unit, the mask data and label value output by the XOR operation unit are determined according to the above process, which will not be repeated here, and the determined mask data and label value are used as the mask data and label value of the next operation unit input to the XOR operation unit. When the operation unit is an AND operation unit, the mask data and label value output by the AND operation unit are determined according to the above process, which will not be repeated here, and the determined mask data and label value are used as the mask data and label value of the next operation unit of the AND operation unit, until the mask data and label value output by the last operation unit are determined, the mask data output by the last operation unit is used as the mask data output by the operation node, and the label value output by the last operation unit is used as the label value output by the operation node. Afterwards, the mask data output by the operation node is used as the mask data input to the next operation node of the operation node, and the label value output by the operation node is used as the label value input to the next operation node of the operation node, until the mask data and label value output by the last operation node are determined, the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0108] S104: Receive the mask bit share of the mask result and the message verification code corresponding to the mask bit share sent by each smart device, wherein each bit share is used to decrypt the mask result.

[0109] S106: Verify each mask bit share according to the message verification code corresponding to each mask bit share.

[0110] S108: When the verification is passed, the mask result is decrypted according to the respective mask bit shares to determine an aggregation result.

[0111] The aggregation center can receive the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share. Afterwards, each mask bit share is verified according to the message verification code corresponding to each mask bit share. When the verification passes, the mask result is decrypted according to each mask bit share to determine the aggregation result. Among them, each smart device will send the mask bit share corresponding to the mask result to the aggregation center, and the mask bit share is used to decrypt the mask result finally output by the aggregation tree. The message verification code corresponding to the mask bit share is generated by the smart device based on the secure multi-party computing preprocessing function, and is used to verify whether the mask bit share sent by the smart device is accurate.

[0112] In addition, since the mask result is obtained by the aggregation center by aggregating the mask data of each smart device according to the operation nodes in the aggregation tree, each smart device can send a mask bit share to the aggregation center. Each mask bit share is a key generated by the smart device for the mask result output by the aggregation tree. Therefore, the aggregation center can decrypt the mask result output by the aggregation tree according to each mask bit share.

[0113] When verifying each mask bit share according to the message verification code corresponding to each mask bit share, the aggregation center can determine, for each mask bit share, the key and message verification code corresponding to the mask bit share generated based on the multi-party secure computing preprocessing function, and perform calculations based on the key and the mask bit share to determine the second calculation result. Afterwards, verify each mask bit share according to the second calculation result corresponding to each mask bit share and the message verification code corresponding to each mask bit share.

[0114] Among them, when calculating according to the key and the mask bit share to determine the second calculation result, the aggregation center can determine the global key generated based on the secure multi-party computing preprocessing function, and use the global key to encrypt the mask bit share, and perform an XOR operation on the encrypted result and the key determined in the above process, and use the result after the XOR operation as the second calculation result.

[0115] When verifying each mask bit share according to the second calculation result corresponding to each mask bit share and the message verification code corresponding to each mask bit share, when the second calculation result corresponding to each mask bit share and the message verification code corresponding to each mask bit share are consistent, it is determined that each mask bit share has passed the verification. When there is a second calculation result corresponding to the mask bit share and the message verification code corresponding to the mask bit share are inconsistent, it is determined that the mask bit share has failed the verification, and a verification failure message is sent to the smart device that sent the mask bit share that failed the verification.

[0116] When the mask result is decrypted according to each mask bit share to determine the aggregation result, the following formula can be used for calculation:

[0117]

[0118] Among them, z w represents the aggregation result, z′ w Represents the mask result, represents the exclusive OR operation, Represents the share of each mask bit sent by the smart device Di.

[0119] It can be seen from the above method that when the present application aggregates data, the aggregation center first receives the mask data sent by each smart device and the label value corresponding to each mask data. The mask data is the data after the smart device performs mask processing on the data to be aggregated, so that the privacy contained in the data to be aggregated of each smart device can be protected. Afterwards, according to each mask data and each label value, based on the pre-built aggregation tree, each mask data is aggregated to determine the mask result. The mask data of each smart device is aggregated through the aggregation tree to determine the mask result, which protects the privacy contained in the data to be aggregated of each smart device, and the aggregation center only knows the mask result, but does not know the specific data to be aggregated of each smart device. In addition, the speed of data aggregation is also accelerated and the time cost is reduced. Then, the mask bit share of the mask result sent by each smart device and the message verification corresponding to the mask bit share are received, so that the aggregation center can verify each mask bit share according to the message verification code corresponding to each mask bit share, and ensure the accuracy of each mask bit share sent by each smart device. When the verification is passed, the mask result is decrypted according to the share of each mask bit to determine the aggregation result, so that the aggregation center uses the verified mask bit share to decrypt the mask result to ensure the accuracy of the aggregation result. The aggregation center can only know the aggregation result of each smart device, but cannot know the specific data to be aggregated of each smart device, thereby ensuring the privacy of the data to be aggregated of each smart device.

[0120] In this specification, in order to ensure the accuracy of the aggregation result, the aggregation center can verify whether the mask data output by the AND operation unit is accurate during the data aggregation based on the aggregation number. Therefore, in the above step S102, when the mask data and label value output by the AND operation unit are determined according to the determined label value and the unit ciphertext, the aggregation center can determine the mask data to be verified (i.e., the above-mentioned first mask data), the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit for each unit ciphertext according to the determined label value and the unit ciphertext. Then determine the key of the message verification code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computing preprocessing function, and calculate according to the key and the mask data to be verified output by the AND operation unit to determine the first calculation result. Afterwards, determine whether each first calculation result is consistent with the message verification code corresponding to each mask data to be verified. If so, use each mask data to be verified as the mask data output by the AND operation unit. If not, determine the smart device corresponding to the mask data to be verified that failed the verification, and send a verification failure message to the determined smart device. The AND operation unit corresponds to a number of unit ciphertexts. The process of determining the first calculation result is similar to that of determining the second calculation result, which will not be repeated here.

[0121] When determining the mask data to be verified output by the AND operation unit, the tag value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined tag value and the unit ciphertext, the following formula can be used for calculation:

[0122]

[0123] in, Represents the unit ciphertext corresponding to the operation unit sent by the smart device Di to the aggregation center, t = z′ α , z′ α Represents the mask data input to the AND operation unit, s = z' β , z′ β Represents the mask data input to the AND operation unit, Indicates the label value input to the AND operation unit. Indicates the label value input to the AND operation unit. Indicates the mask data to be verified output by the AND operation unit, Indicates the mask data to be verified The corresponding message verification code, that is, the message verification code of the mask data to be verified output by the AND operation unit, Indicates the intermediate label value output by the AND operation unit. The message verification code representing the mask data to be verified of other smart devices Dj determined by the smart device Di is determined by the aggregation center according to the determined label value and the unit ciphertext. represents the key of the message authentication code of the mask data to be authenticated output by the AND operation unit and determined by other smart devices Dj and stored in the smart device Di, represents the mask data to be verified output by the AND operation unit determined by other smart devices Dj, Δ i represents the global key of the smart device Di, Represents the label value output by the AND operation unit. H(x) represents the hash function, γ represents the output of the AND operation unit, and s and t represent the two inputs of the AND operation unit respectively.

[0124] In this specification, after determining the mask data, the smart device can send the mask data to other smart devices other than itself and the aggregation center, and other smart devices can send the label value corresponding to the received mask data to the aggregation center. The label value is a K-bit bit string randomly generated by other smart devices based on the mask data, so one mask data corresponds to the label value generated by multiple smart devices. Therefore, in the above step S102, the aggregation center can receive each mask data sent by each smart device, and for each mask data, the aggregation center can receive the label value corresponding to the mask data sent by each smart device.

[0125] Based on this, in the above step S102, the aggregation center can perform data aggregation on each mask data based on the pre-built aggregation tree according to each mask data and each label value corresponding to each mask data, and determine the mask result output by the aggregation tree. The specific process is similar to the above process in which each mask data corresponds to a label value, except that each mask data corresponds to multiple label values, and the label value output by each XOR operation unit and each AND operation unit is a set containing multiple label values, and the specific process will not be repeated here.

[0126] In this specification, in the smart grid scenario, the aggregation center can be a power center, and the smart device can be an electric meter at the user's residence. The data to be aggregated can be the electricity consumption of the user's residence. The aggregation center can build an aggregation tree based on the number of smart devices, that is, the number of electric meters of the residents in the area to be aggregated (such as a community), and send it to each smart device. After that, each electric meter masks the collected user's electricity consumption, determines the mask data, and generates a corresponding label value based on the mask data, and sends the mask data and label value to the aggregation center. The aggregation center determines the mask result based on the aggregation tree according to the received mask data and label values. The aggregation center then decrypts the mask result according to the mask bit share corresponding to the mask result sent by each smart device, determines the aggregation result, that is, the overall electricity consumption of the area to be aggregated, and the aggregation center allocates electricity according to the overall electricity consumption of the area to be aggregated.

[0127] The above-mentioned use of the aggregation tree for data aggregation speeds up the data aggregation, and the data input into the aggregation tree is masked data (that is, the user's electricity consumption is obtained by masking), so that the aggregation center cannot know the specific user's electricity consumption collected by each meter, thereby protecting the user's privacy. Subsequently, the mask result can be decrypted according to the mask bit share corresponding to the mask result sent by the meter to determine the aggregation result, that is, the overall electricity consumption of the area to be aggregated.

[0128] Of course, in the vehicle dispatching scenario, the above-mentioned aggregation center can be a vehicle dispatching system, the smart device can be an image acquisition device in the area to be dispatched, and the data to be aggregated can be the number of users. The specific data aggregation process is similar to the above-mentioned data aggregation process in the smart grid scenario, so it will not be repeated here.

[0129] This specification also provides a method for data aggregation, which is applied to smart devices, such as Figure 3 As shown, Figure 3 is a flowchart of another data aggregation method provided in this specification, Figure 3 The method shown is applied to the aggregation center and specifically includes the following steps:

[0130] S200: Determine data to be aggregated.

[0131] S202: Generate mask bit shares using a secure multi-party computing preprocessing function according to a topological structure of an aggregation tree, wherein the aggregation tree is pre-constructed by an aggregation center.

[0132] S204: Process the data to be aggregated according to the mask bit share, determine mask data, and generate a label value corresponding to the mask data.

[0133] In order to protect the privacy contained in the data to be aggregated, the smart device can determine the data to be aggregated, and according to the topological structure of the aggregation tree, use the secure multi-party computing preprocessing function to generate a mask bit share, and then process the data to be aggregated according to the mask bit share, determine the mask data, and generate a label value corresponding to the mask data. Among them, the aggregation tree is constructed by the aggregation center according to the number of each smart device, and the leaf nodes in the aggregation tree represent the data to be aggregated corresponding to each smart device. All nodes except the leaf nodes in the aggregation tree are operation nodes, and the result output by the root node in the aggregation tree is the result of data aggregation of the data to be aggregated of each smart device. The data to be aggregated is the data collected by the smart device. The application scenario of data aggregation is different, the smart device may be different, and the data to be aggregated may also be different. The specific data of the smart device and the data to be aggregated in different scenarios is described in the above step S100, which will not be repeated here. The secure multi-party computing preprocessing function is a function in the existing secure multi-party computing library. The label value corresponding to the mask data generated above is that the smart device can randomly generate the label value based on the mask data.

[0134] Specifically, the smart device can respond to the aggregation request sent by the aggregation center, determine the aggregation tree pre-built by the aggregation center, and determine the data to be aggregated. Then, according to the topological structure of the aggregation tree, a secure multi-party computing pre-processing function is used to generate a mask bit share, and then the data to be aggregated is processed according to the mask bit share, the mask data is determined, and a label value corresponding to the mask data is generated. For example, in a smart grid scenario, the smart device can be an electric meter of a user's residence in a community, and the data to be aggregated can be the electricity consumption of the user's residence. The electric meter can determine the electricity consumption of the user's residence, and according to the topological structure of the aggregation tree, a secure multi-party computing pre-processing function is used to generate a mask bit share, and then the electricity consumption is processed according to the mask bit share to determine the masked electricity consumption, and a label value corresponding to the masked electricity consumption is generated.

[0135] In this specification, the above-mentioned steps S200 and S202 may be performed in any order or simultaneously.

[0136] S206: Send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the received mask data and label value sent by each smart device.

[0137] The smart center can send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device.

[0138] In this specification, the aggregation tree includes several operation nodes, and the operation node may include an AND operation unit. One operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, when sending the mask data and the label value corresponding to the mask data to the aggregation center, the intelligent device not only sends the mask data and the label value corresponding to the mask data to the aggregation center, but also needs to send the unit ciphertext corresponding to the AND operation unit in the aggregation tree to the aggregation center. Therefore, the intelligent device can determine the verifiable mask bit share and label value input to the AND operation unit for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, and use the secure multi-party computing preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit. Then, according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, determine the unit ciphertext corresponding to the AND operation unit. Then, the unit ciphertext, mask data and label value corresponding to the mask data in each operation unit in the aggregation tree are sent to the aggregation center.

[0139] The above-mentioned verifiable mask bit share includes the mask bit share, the message verification code corresponding to the mask bit share and the key of the message verification code corresponding to the mask bit share of other smart devices, and the other smart devices are devices other than the smart device itself.

[0140] If the operation node is an upstream operation node of a leaf node in the aggregation tree, the verifiable mask bit share input to the operation node is generated by the smart device using a secure multi-party computing preprocessing function, and the label value input to the operation node is a K-bit bit string randomly generated by the smart device or the result of an XOR operation between a randomly generated K-bit bit string and a global key. If the operation node is not an upstream operation node of a leaf node in the aggregation tree, the verifiable mask bit share output by the previous first operation node of the operation node is determined to be the verifiable mask bit share input to the operation node, and the label value output by the previous operation node of the operation node is determined to be the label value input to the operation node.

[0141] If the AND operation unit is the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit. When the previous operation unit of the AND operation unit is the AND operation unit, a secure multi-party computation preprocessing function is used to determine the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit, and the verifiable mask bit share output by the previous operation unit of the AND operation unit is used as the verifiable mask bit share input to the AND operation unit, and the label value output by the previous operation unit of the AND operation unit is used as the label value input to the AND operation unit.

[0142] In addition, the operation node may also include a plurality of XOR operation units, and the previous operation unit of the AND operation unit may also be an XOR operation unit. Therefore, when determining the verifiable mask bit share and label value input to the AND operation unit, when the previous operation unit of the AND operation unit is an XOR operation unit, the verifiable mask bit share and label value input to the previous operation unit of the AND operation unit are determined, and the verifiable mask bit share output by the previous operation unit of the AND operation unit is determined according to the verifiable mask bit share input to the previous operation unit of the AND operation unit, and is used as the verifiable mask bit share output by the AND operation unit. And, according to the label value input to the previous operation unit of the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined, and is used as the label value output by the AND operation unit.

[0143] Among them, when determining the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share input to the previous operation unit of the AND operation unit, the smart device can perform an XOR operation on the verifiable mask bit share input to the previous operation unit of the AND operation unit to determine the verifiable mask bit share output by the previous operation unit of the AND operation unit. Similarly, when determining the label value output by the previous operation unit of the AND operation unit according to the label value input to the previous operation unit of the AND operation unit, the smart device can perform an XOR operation on the label value input to the previous operation unit of the AND operation unit to determine the label value output by the previous operation unit of the AND operation unit.

[0144] The above triplet is three parameters generated by a secure multi-party computing preprocessing function, and the triplet includes a first numerical value, a second numerical value, and a third numerical value. The verifiable mask bit share input into the AND operation unit includes a first verifiable mask bit share and a second verifiable mask bit share. In addition, for each smart device, there are operation nodes to which the smart device belongs and operation nodes unrelated to the smart device in the aggregation tree. If the smart device directly inputs data or indirectly inputs data to a certain operation node in the aggregation tree, then the operation node is the operation node to which the smart device belongs, and the operation nodes other than the operation node to which the smart device belongs are operation nodes unrelated to the smart device. Continuing with the above example, assume Figure 2 The smart devices D1 and D2 in the figure both input data to a certain operation node in the upstream operation node, so the smart devices D1 and D2 both belong to the operation node, and the operation node that uses the data output by the operation node as input (i.e., indirect input) is also the operation node to which the smart devices D1 and D2 belong.

[0145] Based on this, the above-mentioned operation node may be an operation node to which the smart device belongs. When determining the unit ciphertext corresponding to the AND operation unit according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, the smart device may determine the first value according to the first numerical value in the triple and the first verifiable mask bit share input to the AND operation unit, and determine the second value according to the second numerical value in the triple and the second verifiable mask bit share input to the AND operation unit. Specifically, the following formula may be used for calculation:

[0146]

[0147]

[0148] in, represents the first value determined by the smart device Di, represents the first verifiable mask bit share of the input AND operation unit determined by the intelligent device Di, Represents the first value in the triplet determined by the smart device Di. represents the second value determined by the smart device Di, represents the second verifiable mask bit share of the input to the AND operation unit determined by the intelligent device Di, Represents the second value in the triplet determined by the smart device Di.

[0149] If the AND operation unit is the first operation unit in the operation node, and the operation node is the upstream operation node of the leaf node in the aggregation tree, the first verifiable mask bit share and the second verifiable mask bit share represent the verifiable mask bit shares of different smart devices input into the AND operation unit. For a certain smart device input into the AND operation unit, the smart device can generate a verifiable mask bit share input into the AND operation unit, and another verifiable mask bit share input into the AND operation unit can be directly set to 0. Therefore, if the above Input the verifiable mask bit share of the AND operation unit to the smart device Di, then The verifiable mask bit share for processing the aggregated data generated by the smart device Di based on the secure multi-party computing preprocessing function, The default value is 0; if the above Input the verifiable mask bit share of the AND operation unit to the smart device Di, then the above It can also default to 0. The verifiable mask bit share for processing the aggregated data may be generated by the smart device Di based on a secure multi-party computing pre-processing function.

[0150] Above or When it is not 0, or When the share of verifiable masked bits for processing the aggregated data generated by the smart device Di based on the secure multi-party computing preprocessing function is expressed by the following formula:

[0151]

[0152] in, represents the share of verifiable mask bits generated by the intelligent device Di and input into the operation node or the AND operation unit, represents the mask bit share generated by the smart device Di, express The corresponding message verification code, Indicates the key corresponding to the message authentication code corresponding to the mask bit share of the input operation node or the operation unit generated by other smart devices Dj. or It is only generated by the smart device Di and has nothing to do with other smart devices. In addition, in order to protect privacy, the smart device Di cannot or Inform other smart devices, and there is no need for mutual authentication between smart devices. Based on this, in order to save the storage cost and communication overhead of each smart device, each smart device does not need to store the data generated by other smart devices. or The corresponding message authentication code corresponds to the key, so the above Can default to 0.

[0153] Then, the first value and the second value are sent to other smart devices. The other smart devices are smart devices that belong to the computing node together with the smart device, that is, the other smart devices are smart devices other than the smart device (that is, the smart device Di, that is, the smart device as the execution subject) among the smart devices that input data to the computing node. The third value and the fourth value sent by other smart devices are received, and the received third value and the first value are aggregated to determine the first total value, and the received fourth value and the second value are aggregated to determine the second total value. Specifically, the following formula can be used for calculation:

[0154]

[0155]

[0156] Among them, d γ represents the first total value determined by the smart device Di, n represents the number of smart devices, represents the first value determined by the smart device Di, The third value is determined by the smart device Dn, and the third value is sent to the smart device Di. The determination process of the first value and the third value is similar, but they are determined locally by different smart devices. γ represents the second total value determined by the intelligent device Di, Represents the second value determined by the smart device Di. It represents the fourth value determined by the smart device Dn, and sends the third value to the smart device Di. The determination process of the second value is similar to that of the fourth value, but they are determined locally by different smart devices.

[0157] Afterwards, the mask data to be verified output by the AND operation unit is determined according to the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit. Specifically, the following formula can be used for calculation:

[0158]

[0159]

[0160] in, represents the third value in the triplet determined by the smart device Di, represents the mask data to be verified output by the AND operation unit determined by the intelligent device Di, It represents the verifiable mask bit share output by the AND operation unit determined by the smart device Di. The verifiable mask bit share output by the AND operation unit is generated by the smart device Di using a secure multi-party computing preprocessing function. In order to save storage costs, the key corresponding to the message verification code of other smart devices stored in the verifiable mask bit share output by the AND operation unit can be only the key corresponding to the message verification code of the other smart devices determined above, that is, the key corresponding to the message verification code of other smart devices other than the smart device (i.e., the smart device serving as the execution subject) among the smart devices that input data to the AND operation node is stored in the verifiable mask bit share output by the AND operation unit. The key corresponding to the message verification code of the smart device that does not input data to the AND operation node does not need to be stored and is directly defaulted to 0. t and s are bit values, and each t, ​​s∈{0,1}.

[0161] Afterwards, the unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit. Specifically, the following formula can be used for calculation:

[0162]

[0163] in, Indicates the unit ciphertext corresponding to the operation unit determined by the smart device Di. Since t can be 0 or 1, and s can be 0 or 1, there are 4 combinations of t and s, namely 00, 01, 10 and 11. Each combination corresponds to a unit ciphertext, so there are 4 unit ciphertexts corresponding to the operation unit. := is the assignment symbol, Indicates the label value input into the AND operation unit when the bit value determined by the smart device Di is t. It indicates the label value input to the AND operation unit when the bit value determined by the smart device Di is t, and γ indicates the output of the AND operation unit. The message verification code representing the mask data to be verified output by the AND operation unit, Indicates the label value output by the AND operation unit when the bit value determined by the smart device Di is 0, Δ i represents the global key of the smart device Di, It represents the key corresponding to the message verification code of the mask data to be verified output by the operation unit and determined by other smart devices Dj and stored in the smart device Di.

[0164] If the AND operation unit is the first operation unit in the first operation node, and the first operation node is the upstream operation node of the leaf node in the aggregation tree, the above and They are all K-bit bit strings randomly generated by the smart device Di, but the bit values ​​are t and s respectively.

[0165] In addition, the operation node mentioned above can also be an operation node unrelated to the smart device, so the verifiable mask bit share input to the operation node is 0, the generated triples of the AND operation unit are also 0, and the verifiable mask bit share output by the AND operation unit is also 0. And when determining the unit ciphertext corresponding to the AND operation unit according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, the smart device can determine the first value according to the first value in the triple and the first verifiable mask bit share input to the AND operation unit, and determine the second value according to the second value in the triple and the verifiable mask bit share input to the AND operation unit. Then, according to the first value, the second value, the triple, the verifiable mask bit share output by the AND operation unit, and the verifiable mask bit share input to the AND operation unit, the mask data to be verified output by the AND operation unit is determined. The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0166] In addition, the smart device can also send the mask data to other smart devices other than the smart device, so that the other smart devices generate the label value corresponding to the mask data and send it to the aggregation center. And, send the masked data and the label value corresponding to the masked data to the aggregation center. Among them, other smart devices other than the smart device can determine the label value corresponding to the mask data based on the received mask data, and send it to the aggregation center. The label value corresponding to the mask data is a K-bit bit string randomly generated by the other smart device based on the bit value of the mask data. The specific process is similar to the process of generating the label value in the above step S202, and will not be repeated here. Based on this, the aggregation center can receive the mask data sent by each smart device, as well as each label value corresponding to each mask data. Each label value is determined by each smart device and sent to the aggregation center.

[0167] S208: Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result.

[0168] The smart device can determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result. Among them, the mask bit share is used to decrypt the mask result. The message verification code corresponding to the mask bit share is generated by the smart device based on the secure multi-party computing preprocessing function, and is used to verify whether the mask bit share sent by the smart device is accurate.

[0169] If the mask result output by the above-mentioned aggregation tree is the mask bit share stored in the verifiable mask bit share output by the last XOR operation unit in the aggregation tree, the smart device can determine the verifiable mask bit share output by the XOR operation unit according to the verifiable mask bit share input to the XOR operation unit, and send the mask bit share stored in the verifiable mask bit share and the message verification code corresponding to the mask bit share to the aggregation center. If the mask result output by the above-mentioned aggregation tree is the mask bit share stored in the verifiable mask bit share output by the last AND operation unit in the aggregation tree, the smart device can use a secure multi-party computing preprocessing function to generate the verifiable mask bit share output by the AND operation unit, and send the mask bit share stored in the verifiable mask bit share and the message verification code corresponding to the mask bit share to the aggregation center.

[0170] The above are one or more implementation methods of this specification. Based on the same idea, this specification also provides a corresponding data aggregation device, which is applied to the aggregation center, such as Figure 4 shown.

[0171] Figure 4 A schematic diagram of a data aggregation device provided in this specification includes:

[0172] A first receiving module 300 is used to receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share on the to-be-aggregated data, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function;

[0173] Aggregation module 302, configured to aggregate the mask data according to the mask data and the label values ​​based on a pre-built aggregation tree to determine a mask result;

[0174] A second receiving module 304 is used to receive the mask bit share of the mask result and the message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result;

[0175] A verification module 306, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share;

[0176] The decryption module 308 is used to decrypt the mask result according to the mask bit shares to determine the aggregation result when the verification is passed.

[0177] Optionally, the aggregation tree includes a plurality of operation nodes, each of which includes a plurality of XOR operation units;

[0178] The aggregation module 302 is specifically used to, according to the mask data and the label values, determine the mask data and the label value input to the XOR operation unit for each operation node in the pre-constructed aggregation tree, and for each XOR operation unit in the operation node in turn; perform XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and perform XOR operation on the determined label value to determine the label value output by the XOR operation unit; use the mask data output by the XOR operation unit as the mask data input to the next XOR operation unit of the XOR operation unit, and use the label value output by the XOR operation unit as the next XOR operation unit input to the XOR operation unit. The label value of the unit is determined until the mask data and the label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node; the mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and the label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0179] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0180] The first receiving module 300 is specifically used to send the pre-built aggregation tree to each smart device; receive the unit ciphertext of each operation unit in the aggregation tree, the mask data and the label value corresponding to the mask data sent by each smart device;

[0181] The aggregation module 302 is specifically used to, according to the mask data and the label values, determine the mask data input to the AND operation unit for each operation node in the aggregation tree and, in turn, for each AND operation unit in the operation node, and determine the unit ciphertext corresponding to the AND operation unit according to the determined mask data; determine the label value input to the AND operation unit, and determine the mask data and label value output by the AND operation unit according to the determined label value and the unit ciphertext; use the mask data output by the AND operation unit as the mask data input to the next AND operation unit of the AND operation unit, and use the label value output by the AND operation unit as the label value input to the next AND operation unit of the AND operation unit. The label value of the operation unit is determined until the mask data and the label value output by the last operation unit are determined, and the mask data output by the last operation unit is used as the mask data output by the operation node, and the label value output by the last operation unit is used as the label value output by the operation node; the mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and the label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0182] Optionally, the AND operation unit corresponds to a number of unit ciphertexts;

[0183] The aggregation module 302 is specifically used to determine, for each unit ciphertext, the mask data to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined label value and the unit ciphertext; determine the key of the message verification code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computing preprocessing function, and perform calculations based on the key and the mask data to be verified output by the AND operation unit to determine a first calculation result; determine whether each first calculation result is consistent with the message verification code corresponding to each mask data to be verified; if so, use each mask data to be verified as the mask data output by the AND operation unit; if not, determine the smart device corresponding to the mask data to be verified that failed the verification, and send a verification failure message to the determined smart device.

[0184] Optionally, the verification module 306 is specifically used to determine, for each mask bit share, a key and a message verification code corresponding to the mask bit share generated based on the multi-party secure computing preprocessing function, perform calculations based on the key and the mask bit share to determine a second calculation result; and verify each mask bit share based on the second calculation result corresponding to each mask bit share and the message verification code corresponding to each mask bit share.

[0185] This specification also provides a data aggregation device, which is applied to smart devices, such as Figure 5 As shown, Figure 5 A schematic diagram of another data aggregation device structure provided in this specification includes:

[0186] A determination module 400 is used to determine the data to be aggregated;

[0187] A generating module 402 is used to generate a mask bit share according to a topological structure of an aggregation tree by using a secure multi-party computing preprocessing function, wherein the aggregation tree is pre-constructed by an aggregation center;

[0188] The encryption module 404 is used to process the data to be aggregated according to the mask bit share, determine the mask data, and generate a label value corresponding to the mask data;

[0189] A sending module 406, configured to send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device;

[0190] The mask module 408 is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result.

[0191] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0192] The sending module 406 is specifically used to determine, for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, the verifiable mask bit share and the label value input to the AND operation unit; using the secure multi-party computation preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; determine the unit ciphertext corresponding to the AND operation unit according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; and send the unit ciphertext corresponding to each AND operation unit of each operation node in the aggregation tree, the mask data, and the label value corresponding to the mask data to the aggregation center.

[0193] Optionally, the computing node further includes a plurality of XOR computing units;

[0194] The sending module 406 is specifically used to, when the previous operation unit of the AND operation unit is an XOR operation unit, determine the verifiable mask bit share and label value of the previous operation unit input into the AND operation unit; determine the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share of the previous operation unit input into the AND operation unit, and use it as the verifiable mask bit share input into the AND operation unit; determine the label value output by the previous operation unit of the AND operation unit according to the label value of the previous operation unit input into the AND operation unit, and use it as the label value input into the AND operation unit.

[0195] Optionally, the computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND operation unit includes a first verifiable mask bit share and a second verifiable mask bit share;

[0196] The sending module 406 is specifically used to determine a first value according to the first numerical value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value according to the second numerical value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the operation node; receive a third value and a fourth value sent by the other intelligent devices, aggregate the received third value and the first value to determine a first total value, and aggregate the received fourth value and the second value to determine a second total value; determine the mask data to be verified output by the AND operation unit according to the first total value, the second total value, the triplet, the verifiable mask bit share output by the AND operation unit, and the verifiable mask bit share input to the AND operation unit; determine the unit ciphertext corresponding to the AND operation unit according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0197] Optionally, the sending module 406 is specifically used to send the mask data to other smart devices other than the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and send the mask data and the label values ​​corresponding to the mask data to the aggregation center.

[0198] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A method of data aggregation is provided.

[0199] This manual also provides Figure 6 The one shown corresponds to Figure 1 A schematic diagram of the electronic device. Figure 6 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 The method of data aggregation.

[0200] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0201] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0202] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0203] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0204] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0205] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0206] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0207] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0208] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0209] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0210] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0211] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0212] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0213] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0215] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0216] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A method for data aggregation, characterized in that: The method is applied to a aggregation center, and the method comprises: Receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share to be aggregated, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function; and the label value is a bit string randomly generated by the smart device based on the mask data; According to the mask data and the label values, based on a pre-constructed aggregation tree, the mask data are aggregated to determine a mask result; Receiving a mask bit share of the mask result and a message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result; Verifying each mask bit share according to a message authentication code corresponding to each mask bit share; When the verification is passed, the mask result is decrypted according to the respective mask bit shares to determine an aggregation result; According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including: According to each mask data and each label value, for each operation node in the pre-constructed aggregation tree, determine the mask data and label value input to the operation node; Determine the mask data output by the operation node according to the mask data input to the operation node, and determine the label value output by the operation node according to the label value input to the operation node; Using the mask data output by the operation node as the mask data input to the next operation node of the operation node, and using the label value output by the operation node as the label value input to the next operation node of the operation node, until the mask data and label value output by the last operation node are determined; The mask data output by the last operation node is used as the mask result of the output of the aggregation tree.

2. The method according to claim 1, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of XOR operation units; According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including: According to the mask data and the label values, for each operation node in the pre-constructed aggregation tree, and in turn for each XOR operation unit in the operation node, determine the mask data and the label value input to the XOR operation unit; Performing an XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and performing an XOR operation on the determined label value to determine the label value output by the XOR operation unit; The mask data output by the XOR operation unit is used as the mask data of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node; The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

3. The method according to claim 1, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of AND operation units; Receive the mask data sent by each smart device and the label value corresponding to each mask data, including: Send the pre-built aggregation tree to each smart device; Receiving the unit ciphertext, mask data and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device; According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including: According to the mask data and the label values, for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the mask data input to the AND operation unit, and determine the unit ciphertext corresponding to the AND operation unit according to the determined mask data; Determine the label value input to the AND operation unit, and determine the mask data and label value output by the AND operation unit according to the determined label value and the unit ciphertext; The mask data output by the AND operation unit is used as the mask data of the next AND operation unit input to the AND operation unit, and the label value output by the AND operation unit is used as the label value of the next AND operation unit input to the AND operation unit, until the mask data and label value output by the last AND operation unit are determined, the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the label value output by the last AND operation unit is used as the label value output by the operation node; The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

4. The method according to claim 3, characterized in that The AND operation unit corresponds to a number of unit ciphertexts; Determining the mask data and the label value output by the AND operation unit according to the determined label value and the unit ciphertext, specifically includes: For each unit ciphertext, determine the mask data to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined label value and the unit ciphertext; Determine a key of a message authentication code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computation preprocessing function, and perform calculation according to the key and the mask data to be verified output by the AND operation unit to determine a first calculation result; Determining whether each first calculation result is consistent with a message verification code corresponding to each mask data to be verified; If yes, each mask data to be verified is used as mask data output by the AND operation unit; If not, the smart device corresponding to the mask data to be verified that failed the verification is determined, and a verification failure message is sent to the determined smart device.

5. The method according to claim 1, characterized in that Verifying each mask bit share according to a message verification code corresponding to each mask bit share specifically includes: For each mask bit share, determine a key and a message authentication code corresponding to the mask bit share generated based on the secure multi-party computing preprocessing function, and perform calculations based on the key and the mask bit share to determine a second calculation result; The mask bit shares are verified according to the second calculation results corresponding to the mask bit shares and the message verification codes corresponding to the mask bit shares.

6. A method for data aggregation, characterized in that: The method is applied to a smart device, and the method comprises: Determine the data to be aggregated; Generate mask bit shares using a secure multi-party computing preprocessing function according to a topological structure of an aggregation tree, wherein the aggregation tree is pre-constructed by an aggregation center; According to the mask bit share, the data to be aggregated is processed to determine the mask data, and a label value corresponding to the mask data is generated; the label value is a bit string randomly generated by the smart device based on the mask data; The mask data and the label value corresponding to the mask data are sent to the aggregation center, so that the aggregation center determines the mask data and the label value input to each operation node in the pre-constructed aggregation tree in turn according to each mask data and each label value, determines the mask data output by the operation node according to the mask data input to the operation node, and determines the label value output by the operation node according to the label value input to the operation node, uses the mask data output by the operation node as the mask data input to the next operation node of the operation node, and uses the label value output by the operation node as the label value input to the next operation node of the operation node, until the mask data and the label value output by the last operation node are determined, and uses the mask data output by the last operation node as the mask result of the output of the aggregation tree; Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result.

7. The method according to claim 6, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of AND operation units; Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes: For each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the share of verifiable mask bits and the label value input to the AND operation unit; Using the secure multi-party computation preprocessing function, determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; Determine a unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit; The unit ciphertext corresponding to the operation unit of each operation node in the aggregation tree, the mask data and the label value corresponding to the mask data are sent to the aggregation center.

8. The method according to claim 7, characterized in that The operation node also includes a number of XOR operation units; Determine the verifiable mask bit share and label value input to the AND operation unit, including: When the previous operation unit of the AND operation unit is an XOR operation unit, determining a verifiable mask bit share and a label value input to the previous operation unit of the AND operation unit; Determine the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share input to the previous operation unit of the AND operation unit, and use it as the verifiable mask bit share input to the AND operation unit; According to the label value of the previous operation unit input to the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined and used as the label value input to the AND operation unit.

9. The method according to claim 7, characterized in that The computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND computing unit includes a first verifiable mask bit share and a second verifiable mask bit share; Determining a unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, specifically includes: Determine a first value according to the first value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value according to the second value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the operation node; receiving a third value and a fourth value sent by the other smart device, aggregating the received third value and the first value to determine a first total value, and aggregating the received fourth value and the second value to determine a second total value; Determine the mask data to be verified output by the AND operation unit according to the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit; The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

10. The method according to claim 6, characterized in that Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes: The mask data is sent to other smart devices except the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and the mask data and the label values ​​corresponding to the mask data are sent to the aggregation center.

11. A data aggregation device, characterized in that: The device is applied to a polymerization center, and comprises: A first receiving module is configured to receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share to be aggregated, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function; and the label value is a bit string randomly generated by the smart device based on the mask data; An aggregation module, configured to aggregate the mask data according to the mask data and the label values ​​based on a pre-built aggregation tree to determine a mask result; A second receiving module is used to receive the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share, wherein each mask bit share is used to decrypt the mask result; A verification module, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share; A decryption module, used to decrypt the mask result according to the bit shares of each mask to determine the aggregation result when the verification is passed; The aggregation module is specifically used to determine the mask data and label value input to each operation node in a pre-constructed aggregation tree in turn according to each mask data and each label value; determine the mask data output by the operation node according to the mask data input to the operation node, and determine the label value output by the operation node according to the label value input to the operation node; use the mask data output by the operation node as the mask data input to the next operation node of the operation node, and use the label value output by the operation node as the label value input to the next operation node of the operation node, until the mask data and label value output by the last operation node are determined; use the mask data output by the last operation node as the mask result of the output of the aggregation tree.

12. A data aggregation device, characterized in that: The device is applied to a smart device, and comprises: A determination module, used to determine the data to be aggregated; A generation module, configured to generate a mask bit share according to a topological structure of an aggregation tree and using a secure multi-party computing preprocessing function, wherein the aggregation tree is pre-constructed by an aggregation center; An encryption module, used to process the data to be aggregated according to the mask bit share, determine the mask data, and generate a label value corresponding to the mask data; the label value is a bit string randomly generated by the smart device based on the mask data; A sending module, used for sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask data and the label value input to each operation node in the pre-constructed aggregation tree according to each mask data and each label value, determines the mask data output by the operation node according to the mask data input to the operation node, and determines the label value output by the operation node according to the label value input to the operation node, and uses the mask data output by the operation node as the mask data input to the next operation node of the operation node, and uses the label value output by the operation node as the label value input to the next operation node of the operation node, until the mask data and the label value output by the last operation node are determined, and uses the mask data output by the last operation node as the mask result of the output of the aggregation tree; The mask module is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result according to each mask bit share and the mask result.

13. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 10 is implemented.

Images