Efficient and safe data sharing method based on threshold encryption under cloud edge fusion

Abstract

The invention provides an efficient and safe data sharing method based on threshold encryption under cloud edge fusion, which comprises the following steps: S1, connecting a fixed terminal and a mobile terminal to a nearest edge node through a network, and uploading data or requesting data; s2, a service network module establishes a network of a cloud edge fusion architecture, nodes are divided into cloud data center nodes and edge nodes, and the edge nodes are divided into areas; and S3, the block chain network module establishes block chains of which the number is the same as that of regions of the service network module, and in each block chain, the number of peer nodes of which the number is the same as that of region edge nodes is established. Through the data sharing scheme provided by the invention, the data request can be accelerated and the phenomenon of data redundant storage can be reduced under the condition of ensuring the data security.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things, and in particular, to a method for efficient and secure data sharing based on threshold encryption under cloud-edge fusion. Background Art

[0002] With the explosive growth of science and technology, the Internet of Things (IoT) has developed rapidly in recent years. More and more devices have been integrated into all aspects of our daily lives, realizing the comprehensive interconnection of human-computer interaction, bringing profound changes and impacts.

[0003] The problem of securely sharing IoT data is further exacerbated by the fragmented nature of IoT devices, which often operate at the edge of the network and may move across a wide area. The data generated by these devices poses new challenges in data security and sharing. Traditional centralized data management approaches have proven insufficient to meet the security and privacy needs of the rapidly growing IoT environment.

[0004] In order to build a trustworthy system, eventually, all eyes turned to blockchain as a solution. One of the key aspects that makes blockchain technology so valuable as a tool for building trust is its decentralized architecture. With no central authority controlling the network, users can be sure that their data is protected from tampering and manipulation. Another important feature of blockchain technology is its transparency. All transactions and data stored on the blockchain are publicly accessible, allowing for greater transparency and accountability in a variety of applications.

[0005] Despite the many benefits of blockchain, its shortcomings such as low processing speed, scalability issues, and limited privacy are becoming more and more apparent as blockchain technology is widely used. The integration of blockchain and edge computing provides a solution to these problems. Edge computing has been shown to improve the processing speed and scalability of blockchain systems by offloading tasks from centralized networks to decentralized edge nodes. This can reduce network congestion and speed up transaction processing. In addition, combining blockchain and edge computing can achieve decentralized and distributed systems that are more resilient to failures and security vulnerabilities. For problems such as the huge amount of data stored by edge nodes and the difficulty of data management business logic between edge nodes, they can be managed by central nodes.

[0006] Patent document CN213365514U discloses a safe and efficient big data sharing and processing platform, including a data collection terminal, which includes a data collection terminal, an information output terminal of a data initial classification module connected to a data display screen, a data wireless transmission module connected to an external big data cloud processor, a data decryption device connected to a cloud processor, and an input terminal of the cloud processor also connected to a data collection classification module and a data storage module. However, this invention does not solve the problem of privacy leakage in single-point storage. Summary of the invention

[0007] In view of the defects in the prior art, the object of the present invention is to provide an efficient and secure data sharing method based on threshold encryption under cloud-edge fusion.

[0008] According to the present invention, a method for efficiently and securely sharing data based on threshold encryption under cloud-edge fusion is provided, comprising:

[0009] Step S1: The fixed terminal and the mobile terminal are connected to the nearest edge node through the network and perform data upload or data request operations;

[0010] Step S2: The service network module establishes a network of cloud-edge fusion architecture, where nodes are divided into cloud data center nodes and edge nodes, and edge nodes are divided into regions;

[0011] Step S3: The blockchain network module establishes the same number of blockchains as the number of service network module regions, and in each blockchain, establishes the same number of peer nodes as the number of regional edge nodes.

[0012] Preferably, in step S2:

[0013] The central node stores the metadata information of ciphertext and keys, and assists in the migration of data between edge nodes and central nodes. The central node is used for metadata management, data storage and cross-regional data processing, data and request forwarding services, connecting multiple regions into a whole.

[0014] The central node establishes a message queue, a key, a metadata database of ciphertext, and a functional module; the functional module of the central node processes the incoming and forwarding of data.

[0015] Preferably, multiple edge nodes are arranged in one area, and all edge nodes are connected to each other and to the central node;

[0016] The terminal interacts with the edge node in the service network module. The terminal connects to the nearest edge node through the network and uploads or requests data. For physical layer devices in different areas, the same data can be obtained through this operation.

[0017] The edge node contains a functional module for managing data, a database for storing ciphertext information and key information, and a message queue as an entry point;

[0018] The functional module of the edge node provides privacy data upload and request services to the connected clients, and handles data forwarding and migration tasks; in the upload service, threshold encryption technology is used to shard the keys and distribute them to different nodes, ensuring that a single node cannot steal secrets; in the download service, local processing is faster than consensus processing, and the computing power of the edge node is used to connect each edge node to the blockchain network as a consensus node of the blockchain and participate in the consensus of the blockchain.

[0019] Compared with the prior art, the present invention has the following beneficial effects:

[0020] 1. The present invention solves the adaptation problem in cloud-edge fusion scenarios;

[0021] 2. The present invention solves the problem of privacy leakage in single-point storage;

[0022] 3. The multi-region collaboration of the present invention reduces the storage size of files and speeds up the acquisition of ciphertext keys;

[0023] 4. Through the data sharing solution of the present invention, data requests can be accelerated and the phenomenon of redundant data storage can be reduced while ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0025] Figure 1 It is a schematic diagram of the system structure;

[0026] Figure 2 This is a schematic diagram of the ciphertext key upload process;

[0027] Figure 3 This is a schematic diagram of the ciphertext key download process;

[0028] Figure 4 Schematic diagram of the node local verification process. DETAILED DESCRIPTION

[0029] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0030] Embodiment 1:

[0031] In the existing work in the field, it is rarely mentioned to complete the data sharing system in combination with blockchain technology under the architecture of cloud-edge fusion. Therefore, the present invention proposes a trusted data sharing system based on cloud-edge fusion and blockchain. In this system, considering that data requests in actual environments require relatively low latency to ensure service quality, we propose the idea of ​​splitting a large alliance chain into multiple small alliance chains. In this case, the reliability of the system will decrease, but the occupancy rate of storage resources and the speed of consensus will be significantly improved. In addition, in order to further speed up the user's data acquisition speed and more flexible data control, the system acquires data based on attributes and does not require consensus. Finally, the distributed security authentication mechanism based on threshold encryption aims to improve the security of the system and solve the problem of collusion between users and nodes.

[0032] According to the present invention, a method for efficiently and securely sharing data based on threshold encryption under cloud-edge fusion is provided. Figure 1-Figure 4 As shown, including:

[0033] Step S1: The fixed terminal and the mobile terminal are connected to the nearest edge node through the network and perform data upload or data request operations;

[0034] Step S2: The service network module establishes a network of cloud-edge fusion architecture, where nodes are divided into cloud data center nodes and edge nodes, and edge nodes are divided into regions;

[0035] Step S3: The blockchain network module establishes the same number of blockchains as the number of service network module regions, and in each blockchain, establishes the same number of peer nodes as the number of regional edge nodes.

[0036] Preferably, in step S2:

[0037] The central node stores the metadata information of ciphertext and keys, and assists in the migration of data between edge nodes and central nodes. The central node is used for metadata management, data storage and cross-regional data processing, data and request forwarding services, connecting multiple regions into a whole.

[0038] The central node establishes a message queue, a key, a metadata database of ciphertext, and a functional module; the functional module of the central node processes the incoming and forwarding of data.

[0039] Preferably, multiple edge nodes are arranged in one area, and all edge nodes are connected to each other and to the central node;

[0040] The terminal interacts with the edge node in the service network module. The terminal connects to the nearest edge node through the network and uploads or requests data. For physical layer devices in different areas, the same data can be obtained through this operation.

[0041] The edge node contains a functional module for managing data, a database for storing ciphertext information and key information, and a message queue as an entry point;

[0042] The functional module of the edge node provides privacy data upload and request services to the connected clients, and handles data forwarding and migration tasks; in the upload service, threshold encryption technology is used to shard the keys and distribute them to different nodes, ensuring that a single node cannot steal secrets; in the download service, local processing is faster than consensus processing, and the computing power of the edge node is used to connect each edge node to the blockchain network as a consensus node of the blockchain and participate in the consensus of the blockchain.

[0043] Embodiment 2:

[0044] Embodiment 2 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0045] A data security sharing process based on threshold encryption under cloud-edge fusion, using the combined effects of threshold encryption and blockchain, proposes a data management and storage solution that is invisible to nodes. The cloud-edge fusion technology is used to enable blockchain consensus and data storage to occur in a local area, reducing the overall load of the system. When requesting data, cross-regional file requests can be made through data forwarding in the cloud data center based on metadata.

[0046] The present invention relates to a data security sharing solution in a cloud-edge fusion scenario, specifically a privacy data management and secure and efficient sharing solution based on threshold encryption in a mobile Internet of Things cloud-edge fusion scenario. The edge node is used to store the ciphertext of the privacy data and the key fragment, while the central node is used to store the metadata information of the ciphertext and the key, and assist the data migration task between each edge node and the central node.

[0047] The edge node contains functional modules, databases, and message queues as entrances. The functional modules provide data upload and download services for clients, and handle data forwarding and migration tasks. In the upload service, threshold encryption technology is used to shard the keys and distribute them to different nodes, ensuring that a single node cannot steal secrets. In the download service, the characteristic that local processing is faster than consensus processing is used to ensure security while increasing efficiency. At the same time, the computing power of today's edge nodes is used to connect each edge node to the blockchain network as a consensus node of the blockchain, participate in the consensus of the blockchain, and increase the speed of consensus. The central node provides metadata management services, stores metadata, and forwards data and requests, ensuring the interconnection between regions and connecting multiple regions into a whole.

[0048] The present invention is applied to a wide-area distributed scenario of semi-trust (the node will help you forward, but it may steal data) to improve the security of private data distribution and the speed of data transmission. The details of the invention are as follows.

[0049] The entire system is divided into three levels:

[0050] 1) Physical network layer: In this layer, there will be a large number of terminals, such as mobile phones, computers, tablets, and even car computers. As people's requirements for real-time performance become higher and higher, private data still needs to be securely protected. In the current mobile Internet of Things scenario, mobile terminals will move in a large range of physical areas, and cross-regional traffic often makes data requests. The terminal only interacts with the edge nodes in the service network layer. Specifically, the terminal connects to the nearest edge node through the network and uploads or requests data. For physical layer devices in different areas, the same data can still be obtained through this operation. The regional division of the network service layer is imperceptible to the physical layer.

[0051] 2) Service network layer: In this network layer, a network with cloud-edge fusion architecture is established. In this network, nodes are divided into cloud data center nodes and edge nodes according to their responsibilities, and edge nodes are divided into regions. Multiple edge nodes can be set up in a region as needed. Each edge node has a message queue, a database for storing ciphertext information and key information, and a functional module for managing data.

[0052] All edge nodes are not only connected to each other, but also to cloud data center nodes. Cloud data centers have more powerful storage and computing capabilities. In the present invention, cloud data center nodes are mainly used for final data storage and cross-regional data processing. Therefore, the central node establishes a metadata database and functional modules for message queues, keys, and ciphertexts.

[0053] Functional module: The functional module of the central node is mainly used to process data input and data forwarding, while the functional module of the edge node is also used to provide privacy data upload and request services to the connected client.

[0054] 3) Blockchain network layer: At the blockchain network layer, the same number of blockchains as the number of service network layer regions will be established, and in each chain, the same number of peer nodes as the number of edge nodes in its region will be established. Physically, the peer nodes are in the same location as the edge nodes. PBFT consensus will be used for the blockchain, so each blockchain orderer node will be more than three.

[0055] Each blockchain also maintains two channels that all nodes join, one for recording user identity information and the other for recording file access control information.

[0056] Channel: A dedicated "subnet" for communication between two or more specific network members, used for private and confidential data transmission. That is, multiple nodes in the same channel maintain the same blockchain data ledger.

[0057] Embodiment 3:

[0058] Embodiment 3 is a preferred example of Embodiment 1, and is used to illustrate the present invention in more detail.

[0059] In a data sharing system, if the key of the ciphertext is directly stored in the node database, it will bring many security risks. Among them, the node can directly unlock the ciphertext stored by the user through the key in the database. Therefore, a secure key sharing method based on threshold encryption is invented.

[0060] The threshold encryption used in the present invention is Shamir key sharing:

[0061] Shamir key sharing is a key distribution method in which a key is divided into multiple parts and distributed to different participants. In this method, the key can be recovered only if certain conditions are met. This method uses polynomial interpolation.

[0062] f(x)=s+(a1*x)+(a2*x 2 )+…+(a t-1 *x t-1 )

[0063] In the above formula, s is the secret, and a1, a2, at-1 are randomly generated coefficients.

[0064] f(i)=s+(a1×i)+(a2×i 2 )+…+(a t-1 ×i t-1 )

[0065] The above is the value received by participant i. If the number of participants does not reach t, ​​s cannot be recovered. Therefore, to recover the key s, t or more participants are required. Because of this technology, the ciphertext stored in the node's local database will not be decrypted by a single key, reducing the risk of private data leakage.

[0066] Ciphertext key upload upload details (such as Figure 2 shown):

[0067] To reduce the overhead of encryption and decryption, the client first symmetrically encrypts the plaintext locally. For symmetric keys, the key is split into multiple parts using Shamir key sharing. Get the public keys of all nodes in the region and encrypt each key fragment. Communicate with the nearest server via websocket with tls (tls: transport layer security, an encryption protocol used to protect the privacy and security of network communications. Websocket: is a network protocol that enables full-duplex communication in a single TCP) and upload key access control information. The node connected to the client uploads the ciphertext locally and stores the file key fragment unlocked with its own key. The server forwards the key fragment to each node in the region. All nodes in the region store the file key fragment unlocked with their own keys. The server initiates consensus on key access control in the blockchain. The server sends the storage location of the ciphertext and the storage location of the key to the central node for storage

[0068] Cipher key request details (such as Figure 3 shown):

[0069] Since cross-region requests often occur in actual scenarios, a central node is needed to coordinate tasks in multiple regions. In multi-region scenarios, adding a central node can better allow nodes in a region to focus on tasks in their own region, thereby improving performance. Switching between regions is completed by the central node.

[0070] The user who requests data establishes a connection with the nearest server through websocket and sends the file ID and user ID to the server. . The server authenticates whether the user is eligible to obtain the data through an efficient data authentication acquisition mechanism (the efficient data authentication acquisition mechanism will be introduced below). The server connected to the client will forward the request to the central node with the location information of the node connected to the client. The central node queries the location information of the key based on the FileID in the request (the id information of the ciphertext). The central node forwards the request and the location information of the request to all nodes in the area. All nodes perform authentication operations based on the request to be published in the local area. After all nodes verify, the key is sent back to the node connected to the client through the address attached to the request. The server connected to the client will query the ciphertext in the local database. If not, the server will query the central node with the address provided in the request. The central node forwards the download request to the server after querying the location of the ciphertext. The server sends the ciphertext to the node connected to the client according to the address carried in the request. The node then forwards the ciphertext and all key fragments to the client, and the client will complete the decryption operation locally.

[0071] In the traditional model, in order to ensure security, a record is usually agreed upon in the blockchain for each operation. (Consensus: In the blockchain network, nodes in the same channel need to maintain the same ledger, which requires them to discuss the same data, that is, discuss consistent data in the network and store it locally) In this case, once the number of consensus nodes increases, the delay will increase, and the real-time performance of the entire system will not meet the requirements. To this end, the present invention proposes an efficient data collection mechanism based on attributes, which not only meets the real-time requirements, but also provides good scalability by adding attributes.

[0072] like Figure 4 As shown in the figure, after receiving the request with UserID and FileID, the edge node will request the upper blockchain network to obtain the Attribute of UserID and the KeyAccess of FileID. After comparing these two attributes, if they match, the key fragment of the local database is queried according to FileID, encrypted according to the user's PublicKey, and then sent back to the edge node connected to the client.

[0073] UserID: user id,

[0074] Attribute: User attribute, that is, the role in the system, such as administrator, user, or department head, etc.

[0075] FileID: file id,

[0076] KeyAccess: A field that stores key control information, which is stored together with FileID and key fragments. The node can verify whether the user has the authority to obtain the key by comparing the information in this field with the user's identity attributes.

[0077] Those skilled in the art know that, in addition to implementing the system, device and its various modules provided by the present invention in a purely computer-readable program code, it is entirely possible to implement the same program in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded microcontrollers by logically programming the method steps. Therefore, the system, device and its various modules provided by the present invention can be considered as a hardware component, and the modules included therein for implementing various programs can also be considered as structures within the hardware component; the modules for implementing various functions can also be considered as both software programs for implementing the method and structures within the hardware component.

[0078] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. An efficient and secure data sharing method based on threshold encryption in cloud-edge fusion, It is characterized in that include: Step S1: The fixed terminal and the mobile terminal are connected to the nearest edge node through the network and perform data upload or data request operations; Step S2: The service network module establishes a network of cloud-edge fusion architecture, where nodes are divided into cloud data center nodes and edge nodes, and edge nodes are divided into regions; Step S3: The blockchain network module establishes the same number of blockchains as the number of service network module regions, and in each blockchain, establishes the same number of peer nodes as the number of regional edge nodes.

2. According to the method for efficient and secure data sharing based on threshold encryption under cloud-edge fusion described in claim 1, It is characterized in that In step S2: The central node stores the metadata information of ciphertext and keys, and assists in the migration of data between edge nodes and central nodes. The central node is used for metadata management, data storage and cross-regional data processing, data and request forwarding services, connecting multiple regions into a whole. The central node establishes a message queue, a key, a metadata database of ciphertext, and a functional module; the functional module of the central node processes the incoming and forwarding of data.

3. According to the method for efficient and secure data sharing based on threshold encryption under cloud-edge fusion according to claim 2, Features: Multiple edge nodes are set up in one area, and all edge nodes are connected to each other and to the central node; The terminal interacts with the edge node in the service network module. The terminal connects to the nearest edge node through the network and uploads or requests data. For physical layer devices in different areas, the same data can be obtained through this operation. The edge node contains a functional module for managing data, a database for storing ciphertext information and key information, and a message queue as an entry point; The functional module of the edge node provides privacy data upload and request services to the connected clients, and handles data forwarding and migration tasks; In the upload service, threshold encryption technology is used to shard the keys and distribute them to different nodes, ensuring that a single node cannot steal secrets; in the download service, local processing is faster than consensus processing, and at the same time, the computing power of edge nodes is used to connect each edge node to the blockchain network as a consensus node of the blockchain and participate in the consensus of the blockchain.

Images