Cloud edge-end collaborative management method, device and equipment

Abstract

The invention discloses a cloud side-end collaborative management method, device and equipment, and relates to the technical field of data management, and the method comprises the steps: receiving initial data sent by a terminal layer; performing signature operation on the initial data through a preset private key to generate target signature data; performing encryption operation on the initial data through a preset public key to generate encrypted data; and sending the target signature data and the encrypted data to an edge layer. According to the invention, the encryption operation and signature operation of the data are carried out on the cloud edge layer, so that the security and integrity of data transmission are ensured, and the reliability of data transmission is improved.

Description

Technical Field

[0001] The present application relates to the field of data management technology, and in particular to cloud-edge-terminal collaborative management methods, devices and equipment. Background Art

[0002] Industrial big data has the characteristics of massive, multi-source, distributed, sparse value density, and extremely high timeliness requirements. Traditional cloud computing has a strong resource service advantage and is suitable for processing long-term, resource-intensive tasks, such as massive data mining and intelligent algorithm training. Data is an important production factor in industry. Some important data contains important information about the core value of industry, and security factors need to be considered. In the era of the Internet of Things, interference, deception, network attacks and other means pose a huge threat to data security. There is a possibility that the integrity and authenticity of data will be destroyed during the transmission process, which will also affect the reliability of the received data.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a cloud-edge-end collaborative management method, device and equipment, aiming to solve the technical problem that the integrity and authenticity of data are destroyed during the data transmission process.

[0005] To achieve the above objectives, the present application proposes a cloud-edge-device collaborative management method, which is applied to the cloud layer and includes the following steps:

[0006] Receive the initial data sent by the terminal layer;

[0007] Performing a signing operation on the initial data using a preset private key to generate target signature data;

[0008] Performing an encryption operation on the initial data using a preset public key to generate encrypted data;

[0009] The target signature data and the encrypted data are sent to an edge layer.

[0010] In one embodiment, the step of performing a signing operation on the initial data using a preset private key to generate target signature data includes:

[0011] receiving the initial data, and performing signature preprocessing on the initial data;

[0012] Performing a hash operation on the initial data after signature preprocessing to generate hash data;

[0013] The hash data is digitally signed using a preset private key to generate target signature data.

[0014] In one embodiment, the cloud-edge-device collaborative management method is applied to the edge layer, and the method includes:

[0015] Receive target signature data and encrypted data sent by the cloud;

[0016] Performing a signature verification operation on the target signature data to obtain a target signature verification result;

[0017] The encrypted data is processed based on the target signature verification result to obtain the target data.

[0018] In one embodiment, the step of performing a signature verification operation on the target signature data to obtain a target signature verification result includes:

[0019] Performing a signature verification operation on the target signature data using a preset public key to generate signature verification data;

[0020] The signature verification data is compared with the target signature data to obtain a target signature verification result.

[0021] In one embodiment, the step of processing the encrypted data based on the target signature verification result to obtain the target data includes:

[0022] If the target signature verification result is verification failure, generating error log data based on the encrypted data;

[0023] If the target signature verification result is verification passed, the encrypted data is decrypted using a preset private key to obtain the initial data.

[0024] In one embodiment, the cloud-edge-device collaborative management method is applied to the terminal layer, and the method includes:

[0025] Collecting preprocessed data and storing the preprocessed data close to the source;

[0026] Processing the preprocessed data accordingly to obtain initial data;

[0027] The initial data is sent to the cloud layer so that the cloud layer can perform signing and encryption operations on the initial data to generate target signature data and encrypted data; the target signature data and encrypted data are sent to the edge layer so that the edge layer can perform verification operations on the target signature data to obtain a target verification result; the encrypted data is processed based on the target verification result to obtain the target data.

[0028] In one embodiment, the step of performing corresponding processing on the preprocessed data to obtain initial data includes:

[0029] Assigning corresponding topics to the hot data in the preprocessed data, and generating a corresponding data warehouse;

[0030] Performing correlation verification and clustering integration operations on multi-source heterogeneous same-topic data in the preprocessed data to generate normalized topic data;

[0031] A knowledge graph is constructed for the situation data in the preprocessed data to generate a related data graph.

[0032] In one embodiment, after the step of performing corresponding processing on the preprocessed data to obtain initial data, the step further includes:

[0033] The computationally intensive and time-sensitive tasks contained in the preprocessed data are unloaded to the edge layer through data unloading.

[0034] In addition, to achieve the above objectives, the present application also proposes a cloud-edge-device collaborative management device, the cloud-edge-device collaborative management device comprising:

[0035] A data receiving module, used for receiving the initial data sent by the terminal layer;

[0036] A data signature module, used to sign the initial data using a preset private key to generate target signature data;

[0037] A data encryption module, used to perform an encryption operation on the initial data using a preset public key to generate encrypted data;

[0038] A data sending module is used to send the target signature data and the encrypted data to the edge layer.

[0039] In addition, to achieve the above-mentioned objectives, the present application also proposes a cloud-edge-end collaborative management device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the cloud-edge-end collaborative management method as described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the cloud-edge collaborative management method described above are implemented.

[0041] One or more technical solutions proposed in this application have at least the following technical effects:

[0042] The embodiments of the present application propose a cloud-edge-terminal collaborative management method, device and equipment, including the cloud-edge-terminal collaborative management method applied to the cloud layer: receiving the initial data sent by the terminal layer; signing the initial data with a preset private key to generate target signature data; encrypting the initial data with a preset public key to generate encrypted data; sending the target signature data and the encrypted data to the edge layer. The cloud-edge-terminal collaborative management method is applied to the edge layer: receiving the target signature data and encrypted data sent by the cloud layer; verifying the target signature data to obtain a target verification result; processing the encrypted data based on the target verification result to obtain the target data. The cloud-edge-terminal collaborative management method is applied to the terminal layer: collecting preprocessed data, and storing the preprocessed data close to the source; performing corresponding processing on the preprocessed data to obtain initial data; sending the initial data to the cloud layer so that the cloud layer can sign and encrypt the initial data to generate target signature data and encrypted data, and sending the target signature data and the encrypted data to the edge layer so that the edge layer can verify the target signature data to obtain the target verification result, and the encrypted data is processed based on the target verification result to obtain the target data. The present application ensures the security and integrity of data transmission and improves the reliability of data by performing encryption and signing operations on data at the cloud layer and verification and decryption operations at the edge layer; improves the efficiency of data processing and the rate of data transmission by performing close-to-source storage at the edge layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1 A flowchart of the first embodiment of the cloud-edge-device collaborative management method of the present application is provided;

[0046] Figure 2 A flowchart of the signature operation provided for the cloud-edge-device collaborative management method embodiment of the present application;

[0047] Figure 3 A flowchart of the signature verification operation provided for the cloud-edge-device collaborative management method embodiment of the present application;

[0048] Figure 4 Flow diagram provided for the sixth embodiment of the cloud-edge-device collaborative management method of this application

[0049] Figure 5 This is a schematic diagram of the module structure of the cloud-edge-device collaborative management device in an embodiment of the present application;

[0050] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the cloud-edge-device collaborative management method in the embodiment of the present application.

[0051] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0053] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0054] The main solution of the embodiment of the present application is: including the cloud-edge-terminal collaborative management method applied to the cloud layer: receiving the initial data sent by the terminal layer; signing the initial data with a preset private key to generate target signature data; encrypting the initial data with a preset public key to generate encrypted data; sending the target signature data and the encrypted data to the edge layer. The cloud-edge-terminal collaborative management method is applied to the edge layer: receiving the target signature data and encrypted data sent by the cloud layer; verifying the target signature data to obtain the target verification result; processing the encrypted data based on the target verification result to obtain the target data. The cloud-edge-terminal collaborative management method is applied to the terminal layer: preprocessed data is collected and stored close to the source; the preprocessed data is processed accordingly to obtain initial data; the initial data is sent to the cloud layer so that the cloud layer can sign and encrypt the initial data to generate target signature data and encrypted data, and the target signature data and encrypted data are sent to the edge layer so that the edge layer can verify the target signature data to obtain a target verification result, and the encrypted data is processed based on the target verification result to obtain the target data.

[0055] At present, data is an important production factor of industry. Some important data contains important information of the core value of industry, and security factors need to be considered as the key factor. In the era of the Internet of Things, interference, deception, network attacks and other means pose a huge threat to data security. In order to ensure the security of data, traditional security strategies often use closed means for core data to solve data security problems from the source, but this also brings inconvenience to data applications.

[0056] This application ensures the security and integrity of data transmission and improves data reliability by performing data encryption and signing operations at the cloud layer and signature verification and decryption operations at the edge layer; it improves data processing efficiency and data transmission rate by performing close-to-source storage at the edge layer.

[0057] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a cloud-edge-end collaborative management device, etc. The following takes the cloud-edge-end collaborative management device as an example to illustrate this embodiment and the following embodiments.

[0058] Based on this, the embodiment of the present application provides a cloud-edge-end collaborative management method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the cloud-edge-device collaborative management method of the present application. The cloud-edge-device collaborative management method is applied to the cloud layer. The method includes the following steps S10 to S40:

[0059] Step S10, receiving initial data sent by the terminal layer.

[0060] It should be noted that the cloud layer is a technical service that uses network remote services to store, manage and process data, deploys large-scale distributed computing cluster resources and big data centers, and mainly carries out global data asset operation and maintenance, industrial big data mining and analysis, AI model training, expert knowledge rule production, etc. At the same time, through a unified resource management system, it realizes unified management and scheduling of cloud, edge and end computing storage resources, dynamically carries out multi-level synchronization of data and models, and pushes service caches to the edge layer, publishes high-value small data such as AI models / rules / algorithm packages to the edge or end, and realizes cloud training and edge intelligence; the cloud layer allows users to access various applications and services through the Internet without installing any software on local computers or networks. The cloud layer provides on-demand access to shared computing resources and data services, and users can access the resources and services of the cloud layer at any time, any place, and through any device.

[0061] In addition, it should be noted that the terminal layer refers to the interface for human-machine interaction, and is also the terminal device in the edge computing system. These devices include but are not limited to mobile phones, smart home appliances, various sensors, cameras, etc. The terminal layer is responsible for comprehensive perception, that is, collecting data from various physical worlds and transmitting it to the edge layer or cloud layer for processing. In the industrial field, the terminal layer refers to massive industrial equipment, which has edge-end collaboration and online computing capabilities.

[0062] In addition, it should be noted that the initial data refers to data collected by terminal devices, cleaned and preprocessed by the terminal layer, and then sent to the cloud layer.

[0063] Among them, data cleaning and preprocessing technology mainly solves the noise, inconsistency, incompleteness and high-dimensional problems of basic data, status data and simulation data from the cloud-edge data processing and transmission process. It processes noisy data, abnormal data, duplicate data and data with missing key attributes through data cleaning, standardization, sampling and other processes to achieve the basic goals of removing anomalies, correcting errors and filling in missing data. Through data preprocessing methods such as feature selection, format transformation, dimensionality reduction, and permission marking, it provides data that meets usage expectations for subsequent data fusion, mining and situation prediction.

[0064] Specifically, the terminal layer collects the initial data to be transmitted through sensors, controllers or other data acquisition devices; selects a suitable transmission method to encapsulate the collected initial data into data packets suitable for transmission, and sends them to the cloud layer through the configured transmission method; the cloud layer receives the initial data sent by the terminal layer, verifies the received data, and ensures the integrity and accuracy of the data.

[0065] Step S20, signing the initial data using a preset private key to generate target signature data.

[0066] It should be noted that the target signature data refers to the signature data generated by hashing the initial data through a hash algorithm, and then performing a signature operation on the hash data through a preset private key.

[0067] Among them, the hash algorithm refers to the SM3 algorithm. The SM3 algorithm is a hash algorithm, also known as a message digest algorithm or hash algorithm. It is a cryptographic hash function standard issued by the China National Cryptography Administration. It is mainly used to generate digital signatures for messages and files to ensure the integrity and non-repudiation of information.

[0068] Among them, the preset private key for the signature operation (i.e., the signature private key) in this application refers to the private key generated based on the principle of elliptic curve cryptography ECC (Elliptic Curve Cryptography) in the SM2 algorithm, which is used to perform a signature operation on the hash data after the initial data passes through the hash algorithm to generate the target signature data. The signature data can be used to verify the integrity of the message and the authenticity of the source. The generation of the private key is based on a strong random number generator to ensure the randomness and unpredictability of the private key; correspondingly, there is a preset signature verification public key (a public key used for signature verification operations), which is generated based on the signature private key and the point multiplication operation of the elliptic curve in the SM2 algorithm, and is used to verify the validity of the target signature data, thereby ensuring the integrity of the transmitted data and the authenticity of the source. In one embodiment of the present application, the signature private key, the signature verification public key, the encryption public key, and the decryption private key are all generated by the SM2 algorithm.

[0069] Specifically, the initial data is received and signature preprocessing is performed on the initial data; a hash operation is performed on the initial data after signature preprocessing to generate hash data; and the hash data is digitally signed by a preset private key to generate target signature data.

[0070] Step S30, encrypting the initial data using a preset public key to generate encrypted data.

[0071] It should be noted that the preset public key used for encryption operations (i.e., encryption public key) refers to the decryption private key (private key used for decryption operations), which is generated based on the public key corresponding to the elliptic curve in the SM2 algorithm, and is used to encrypt the transmitted data. The sender uses the recipient's public key to encrypt the message, and only the recipient with the corresponding private key can decrypt the message.

[0072] In addition, it should be noted that the encrypted data refers to data generated after the initial data is encrypted using a preset encryption public key.

[0073] Specifically, obtain the encryption public key generated by the SM2 algorithm. During the encryption operation, generate a random number K. Use the random number K and the elliptic curve base point G in the SM2 algorithm to perform an elliptic curve point multiplication operation, that is, multiply K by G to obtain the result point (kx, ky), which is recorded as C1. According to the length of the initial data and the coordinates (kx, ky) in C1, use the key derivation function (KDF) to generate a key stream of the same length as the initial data. In the SM2 algorithm, KDF is usually implemented based on the SM3 hash function. Perform an XOR operation on the generated key stream and the initial data to obtain the encrypted data, which is recorded as C2. Use the SM3 hash function to perform a hash operation on (kx||initial data||ky) to obtain a summary value, which is recorded as C3. Combine C1, C2 and C3 together to form the final encrypted data. According to the standard of the SM2 algorithm, the format of the encrypted data can be C1 C3C2 or C1C2C3 (depending on the specific implementation and version).

[0074] Step S40: sending the target signature data and the encrypted data to the edge layer.

[0075] It should be noted that the edge layer refers to the edge gateways, edge data centers, and edge computing resources deployed close to the terminal layer nodes, which realize the control, dynamic scheduling, multi-node collaboration, data cleaning, and data preprocessing of terminal access devices through resource allocation, data processing, and local decision-making. It also refers to the edge side of the cloud layer, including the infrastructure edge and the device edge. In edge computing, the edge layer is responsible for local data analysis and reasoning, reducing the computing pressure of the cloud layer and improving the speed and efficiency of data processing. The edge layer can give full play to the natural advantages of being close to the terminal, providing network transmission, computing power platform, and AI model / rule / algorithm package application services in real time, and synchronizing data processing results to the cloud layer and the terminal layer at the same time.

[0076] Intelligent edge computing technology is used in the edge layer. Intelligent edge computing involves two aspects: on the one hand, AI empowers edge computing, which specifically involves technical research on resource collaboration, data collaboration, intelligent collaboration, application management collaboration, and service collaboration. AI is used to solve various resource scheduling constraint optimization problems faced by edge computing to improve the coordination and reliability of multiple edge devices. On the other hand, it is the edge deployment framework of AI, which deploys and runs AI models at the edge layer, builds a model training and reasoning service framework for cloud-edge-end collaborative operation of AI, and obtains benefits in terms of performance, cost, privacy, efficiency, etc.

[0077] Specifically, the target signature data and encrypted data as well as the timestamp, data identifier, source address and target address are encapsulated in a data packet or message; the format of the data packet is adjusted according to the receiving requirements of the edge layer; a connection with the edge layer is established through the communication protocol, and the encapsulated data packet is sent to the edge layer through the established connection; and the edge layer is waited for to send a confirmation message to confirm that the data packet has been successfully received and processed.

[0078] This application ensures the security and integrity of data transmission by performing data signing and data encryption transmission at the cloud layer.

[0079] Based on the first embodiment, a second embodiment of the present application is proposed. The difference between the second embodiment of the present application and the first embodiment is that:

[0080] In this embodiment, the signing operation is performed on the initial data by using a preset private key to generate target signature data, including steps S21 to S23:

[0081] Step S21, receiving the initial data, and performing signature preprocessing on the initial data.

[0082] Step S22, performing a hash operation on the initial data after signature preprocessing to generate hash data.

[0083] Step S23, digitally sign the hash data using a preset private key to generate target signature data.

[0084] It should be noted that the signature preprocessing refers to preprocessing the initial data to ensure that the input data can meet the requirements of the hash operation. The signature preprocessing includes but is not limited to data cleaning, data padding, data formatting, data grouping and other preprocessing operations. Data cleaning includes but is not limited to removing invalid characters and format unification. The removal of invalid characters refers to deleting illegal or invalid characters that may exist in the input data, such as control characters, non-printing characters, etc. The format unification refers to ensuring that the format of the data meets the requirements of the hash algorithm. For example, for string data, a unified encoding format may be required; data padding refers to the requirement that some hash algorithms (such as the SHA series) require the length of the input data to meet specific requirements, such as the length must be a multiple of 512 bits. Therefore, the original data needs to be padded to meet these requirements. The padding method may be to add a "1" at the end of the data, then add a sufficient number of "0", and finally add an integer value representing the length of the original data (such as the SHA algorithm); data formatting refers to the need to convert non-binary data (such as strings, numbers, etc.) into binary format for hash operations. This usually involves encoding operations, such as encoding a string into binary data in UTF-8 format; data grouping means that within the hash algorithm, the padded data is usually divided into fixed-length groups (such as each group length is 512 bits in SHA-256).

[0085] Specifically, the initial data is received through the cloud layer, and the initial data is subjected to signature preprocessing such as data cleaning, data filling, data formatting, and data grouping, so that the initial data can meet the requirements of the hash operation; then the initial data after the signature preprocessing is subjected to a hash operation, and after the hash data is generated, a digital signature operation is performed to generate the target signature data.

[0086] Specifically, the initial data is received through the cloud layer, and the received initial data is verified. After verification, the initial data is subjected to signature preprocessing such as data cleaning, data filling, data formatting, and data grouping. According to the requirements of the signature algorithm, a suitable hash algorithm is selected, and the initial data after the signature preprocessing is input into the hash algorithm, and a hash operation is performed to generate hash data; a private key for digital signature is generated through the SM2 algorithm, and the digital signature operation is performed on the hash data using the private key to generate the target signature data.

[0087] For ease of understanding, the following Figure 2 Let's introduce the specific process of signature operation in detail. Figure 2 A flowchart of a signature operation provided for this application.

[0088] like Figure 2As shown, first, the initial data sent from the terminal layer is received through the cloud layer, and the initial data is pre-processed for signature; then, the initial data after the signature pre-processing is subjected to SM3 hash operation to generate hash data; and then, the hash data is digitally signed by a preset signature private key to generate target signature data.

[0089] Based on the second embodiment, a third embodiment of the present application is proposed. The difference between the third embodiment of the present application and the second embodiment is that:

[0090] In this embodiment, the cloud-edge-device collaborative management method is applied to the edge layer, and the method includes steps S10' to S30':

[0091] Step S10', receiving the target signature data and encrypted data sent by the cloud layer.

[0092] Specifically, the target signature data and encrypted data sent by the cloud layer through network communication are received.

[0093] Step S20', performing a signature verification operation on the target signature data to obtain a target signature verification result.

[0094] It should be noted that the target signature verification result refers to the result obtained by comparing the signature verification data with the target signature data.

[0095] Specifically, the target signature data is verified by a preset signature verification public key to generate signature verification data; the signature verification data is compared with the target signature data to obtain a target signature verification result.

[0096] Step S30', processing the encrypted data based on the target signature verification result to obtain target data.

[0097] It should be noted that the target data refers to the data obtained after the encrypted data is processed accordingly based on the target signature verification result. If the target signature verification result is a signature verification pass, it means that the received initial data has not been tampered with during the transmission process, and it is indeed sent by the sender with the corresponding private key, then the edge layer decrypts the received encrypted data to obtain the initial data, and continues to process the subsequent normal process; if the target signature verification result is a signature verification failure, it means that the received data may have been tampered with during the transmission process, or the signature is not generated by the claimed sender, then the edge layer generates error log data based on the encrypted data, that is, the target data of the relevant logs that record the signature verification failure in detail, promptly notifies the sender of the signature verification failure, and requires it to resend the data or provide new signature information, and notifies the system administrator, security personnel or relevant business personnel through email, SMS, instant messaging, etc., so that they can pay attention to and deal with this problem in a timely manner.

[0098] Specifically, if the target signature verification result is verification failure, error log data is generated based on the encrypted data; if the target signature verification result is verification success, the encrypted data is decrypted using the private key used for decryption operation (decryption private key) to obtain the initial data.

[0099] Based on the third embodiment, a fourth embodiment of the present application is proposed. The difference between the fourth embodiment of the present application and the third embodiment is that:

[0100] In this embodiment, the processing of the encrypted data based on the target signature verification result to obtain the target data includes steps S21' to S22':

[0101] Step S21', performing a signature verification operation on the target signature data using a preset public key to generate signature verification data.

[0102] It should be noted that the signature verification data refers to the data used for signature verification. First, the initial data after signature preprocessing is subjected to a hash operation to generate hash data, and then a series of mathematical calculations are performed on the hash data, the target signature data and the preset signature verification public key according to the signature verification rules of the SM2 algorithm. These mathematical calculations usually include point multiplication and modular operations on elliptic curves, and finally the signature verification data is generated.

[0103] In addition, it should be noted that the preset public key refers to the public key used for signature verification operation (signature verification public key), which is generated based on the point multiplication operation of the signature private key and the elliptic curve in the SM2 algorithm, and is used to verify the validity of the target signature data, thereby ensuring the integrity of the transmitted data and the authenticity of the source.

[0104] Step S22', comparing the signature verification data with the target signature data to obtain a target signature verification result.

[0105] It should be noted that the target signature verification result refers to the result obtained by comparing the signature verification data with the target signature data. When the signature verification data and the target signature data are the same after comparison, the target signature verification result is passed; when the signature verification data and the target signature data are not the same after comparison, the target signature verification result is failed.

[0106] For ease of understanding, the following Figure 3 Let's introduce the specific process of signature verification operation in detail. Figure 3 A flowchart of a signature verification operation provided for this application.

[0107] like Figure 3As shown, first, the target signature data is received by the edge layer, and the initial data is subjected to a hash operation to generate hash data. The initial data is the initial data obtained by directly receiving the initial data by the edge layer or decrypting the received encrypted data by using the decryption private key; then the signature verification public key is obtained, and the signature verification public key is generated by the cloud layer of the sending end based on the private key and the SM2 algorithm, and is directly sent by the sending end or transmitted through a certificate, and distributed through a public key infrastructure. In this application, the signature verification public key is generated based on the private key and the SM2 algorithm, and is transmitted through the certificate. The edge layer of the receiving end obtains the target certificate from the certificate pool, and after verifying that the target certificate is a legal certificate, the corresponding signature verification public key is extracted from the target certificate; then the signature verification public key is used to perform a signature verification operation on the hash data and the target signature verification data to generate signature verification data; finally, the signature verification data is compared with the target signature data to obtain the target signature verification result.

[0108] Based on the fourth embodiment, a fifth embodiment of the present application is proposed. The difference between the fifth embodiment of the present application and the fourth embodiment is that:

[0109] In this embodiment, the processing of the encrypted data based on the target signature verification result to obtain the target data includes steps S31' to S32':

[0110] Step S31': if the target signature verification result is verification failure, error log data is generated based on the encrypted data.

[0111] Step S32': if the target signature verification result is verification passed, the encrypted data is decrypted by a preset private key to obtain the initial data.

[0112] It should be noted that the error log data refers to the detailed record of the signature verification failure in the system log, including the time of failure, sender information, received signature data, etc.

[0113] In addition, it should be noted that the preset private key is a private key used for decrypting encrypted data using the elliptic curve in the SM2 algorithm.

[0114] Specifically, if the target signature verification result is verification failure, error log data is generated based on the encrypted data, the sender is promptly notified of the signature verification failure, and is required to resend the data or provide new signature information, and the system administrator, security personnel or relevant business personnel are notified via email, SMS, instant messaging, etc., so that they can pay attention to and handle this problem in a timely manner; if the target signature verification result is verification success, the encrypted data is decrypted using a preset decryption private key to obtain the initial data, and subsequent normal processing operations are performed.

[0115] Reference Figure 4 , Figure 4 This is a flow chart of the sixth embodiment of the cloud-edge-end collaborative management method of the present application, and the cloud-edge-end collaborative management method is applied to the terminal layer.

[0116] Based on the fifth embodiment, a sixth embodiment of the present application is proposed. The difference between the sixth embodiment of the present application and the fifth embodiment is that:

[0117] In this embodiment, the cloud-edge-device collaborative management method is applied to the terminal layer, including steps S50 to S70:

[0118] Step S50, collecting pre-processed data, and storing the pre-processed data close to the source.

[0119] Step S60, performing corresponding processing on the pre-processed data to obtain initial data.

[0120] Step S70, sending the initial data to the cloud layer so that the cloud layer can perform signing and encryption operations on the initial data to generate target signature data and encrypted data, sending the target signature data and encrypted data to the edge layer so that the edge layer can perform verification operation on the target signature data to obtain a target verification result, and processing the encrypted data based on the target verification result to obtain the target data.

[0121] It should be noted that the pre-processed data refers to data collected by the terminal device and has not been cleaned and pre-processed. The near-source storage refers to storing data in a location close to the data source so that the data can be quickly accessed and processed. This strategy helps reduce delays and bandwidth consumption during data transmission and improves data processing efficiency.

[0122] Specifically, preprocessed data is collected through a terminal device, and the preprocessed data is processed accordingly to obtain initial data, and the corresponding processing includes but is not limited to data cleaning and data preprocessing; the initial data is then sent to the cloud layer, so that the cloud layer can perform signing operations and encryption operations on the initial data to generate target signature data and encrypted data, and the target signature data and the encrypted data are sent to the edge layer, so that the edge layer can perform verification operations on the target signature data to obtain a target verification result, and the encrypted data is processed based on the target verification result to obtain the target data.

[0123] The present application helps to reduce delays and bandwidth consumption during data transmission and improve data processing efficiency by storing the preprocessed data close to the source.

[0124] Based on the sixth embodiment, a seventh embodiment of the present application is proposed. The difference between the seventh embodiment of the present application and the sixth embodiment is that:

[0125] In this embodiment, the pre-processed data is processed accordingly to obtain initial data, including steps S61 to S63:

[0126] Step S61, assigning corresponding topics to the hot data in the preprocessed data, and generating a corresponding data warehouse.

[0127] Step S62, performing correlation verification and clustering integration operations on the multi-source heterogeneous same-topic data in the pre-processed data to generate normalized topic data.

[0128] Step S63, constructing a knowledge graph for the situation data in the preprocessed data to generate a related data graph.

[0129] It should be noted that the hot data refers to frequently accessed data; the data warehouse is a data system used for storage, analysis, and reporting, with the purpose of building an integrated data environment for analysis to provide decision support for enterprises. It has the characteristics of being subject-oriented, integrated, relatively stable, and reflecting historical changes.

[0130] In addition, it should be noted that the multi-source heterogeneous same-topic data refers to a data set that comes from different sources and has different structures or types, that is, multi-source heterogeneous, but revolves around the same topic or target; the normalized topic data refers to a data set with a unified format, scale and representation method obtained after a series of data cleaning, conversion, correlation verification and clustering integration steps when processing multi-source heterogeneous data. The purpose of this data set is to eliminate differences and conflicts between different data sources, improve data consistency and comparability, and thus facilitate subsequent data analysis and decision making.

[0131] In addition, it should be noted that the situation data refers to a data set that reflects the current state, development trend and changes in the surrounding environment of an object or system. It contains rich information, such as location information, time information, attribute information, relationship information, etc., which together constitute a comprehensive description of the situation of an object or system; the association data graph refers to a data visualization method that intuitively represents the elements (nodes) in the data set and the relationships (edges) between them in a graphical way.

[0132] Specifically, the hot data in the preprocessed data are assigned corresponding topics to generate a corresponding data warehouse; the multi-source heterogeneous same-topic data in the preprocessed data are subjected to correlation verification and clustering integration operations to generate normalized topic data; the situation data in the preprocessed data are subjected to knowledge graph construction to generate an associated data graph.

[0133] This application provides data that meets usage expectations for subsequent data fusion, data mining, and situation prediction by performing corresponding processing on hot data, multi-source heterogeneous same-subject data, and situation data in the preprocessed data.

[0134] Further, as an implementation manner, after the step of performing corresponding processing on the preprocessed data to obtain initial data, the step further includes:

[0135] Step S80 , unloading the computationally intensive and time-sensitive tasks contained in the preprocessed data to the edge layer by data offloading.

[0136] It should be noted that the computationally intensive and time-sensitive tasks are those that require both a large amount of computing resources and a fast response time. The data offloading refers to the operation of exporting data from the current system or platform and transmitting it to the target system or data exchange area during data processing and exchange. The terminal device on the terminal layer can offload the computationally intensive and time-sensitive tasks to the nearby edge nodes for execution, and then receive the processing results, so as to realize the migration of resource-intensive computing tasks from resource-constrained terminal devices to the edge layer. In view of the fact that the software and hardware environments between different edge nodes are usually heterogeneous, container technology is used to shield the differences between the operating system layer and the hardware layer, and the application services and dependent packages are packaged into a portable container. The sandbox mechanism is used to achieve outstanding coupling between them. Specifically, it involves computing business orchestration collaboration, virtual machines or lightweight container technologies to achieve computing task compatibility, deployment, scheduling, migration, and predictive maintenance.

[0137] Specifically, the terminal layer analyzes the preprocessed data to obtain computationally intensive and time-sensitive tasks, and the task data of the computationally intensive and time-sensitive tasks are directly unloaded to the edge layer through data offloading for subsequent data analysis and processing.

[0138] This application can improve the processing speed of tasks by directly offloading computationally intensive and time-sensitive tasks on the terminal layer to the edge layer through data offloading, and can also use the resources of the edge layer to share the computing pressure of the terminal layer and optimize resource utilization.

[0139] The cloud layer, edge layer and terminal layer in the cloud-edge layer in the cloud-edge collaborative management method of this application have all adopted data security and permission management technologies. Data security and permission management is divided into four main dimensions: data hierarchical permission management, big data encrypted transmission, big data recovery and destruction, and data traceability and identification. Data hierarchical permission management mainly supports hierarchical data services through data classification and grading, data permission management, and data desensitization. Data transmission encryption adopts national secret technology to ensure the security and reliability of data transmission through content encryption, network encryption, identity authentication, signature and signature verification. Big data recovery and destruction mainly ensure the reliable storage of data and rapid destruction in emergency situations through data backup, data disaster recovery, data recovery, and data destruction. Data traceability and identification mainly use technical means such as cloud-edge blockchain and digital certificates to ensure the reliability of data sources and avoid data risks caused by malicious attacks.

[0140] The cloud layer, edge layer and terminal layer in the cloud-edge-terminal collaborative management method of the present application have all adopted data synchronization and intelligent fusion technology. Data synchronization and intelligent fusion are based on three levels: pixel level, feature level and decision level. With the help of intelligent fusion algorithm modeling, machine learning framework support, spatiotemporal data distributed computing, spatiotemporal knowledge graph, spatiotemporal data intelligent application and other technologies, through spatiotemporal synchronization, feature extraction, association analysis and other processes, time calibration, spatial conversion, association analysis, and fusion enhancement of multi-source data on the same subject are realized. The fusion categories include multi-sensor fusion, multi-node data fusion and multi-source data fusion, which ensures the accurate, stable and reliable extraction of perceived spatiotemporal features and builds a powerful basic spatiotemporal situation benchmark.

[0141] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the cloud-edge-terminal collaborative management method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0142] This application also provides a cloud-edge collaborative management device, please refer to Figure 5 , the cloud-edge-end collaborative management device comprises:

[0143] The data receiving module 501 is used to receive the initial data sent by the terminal layer;

[0144] The data signature module 502 is used to perform a signature operation on the initial data using a preset private key to generate target signature data;

[0145] The data encryption module 503 is used to perform an encryption operation on the initial data using a preset public key to generate encrypted data;

[0146] The data sending module 504 is used to send the target signature data and the encrypted data to the edge layer.

[0147] The cloud-edge-end collaborative management device provided by the present application adopts the cloud-edge-end collaborative management method in the above-mentioned embodiment, which can solve the technical problem that the integrity and authenticity of data are destroyed during the data transmission process. Compared with the prior art, the beneficial effects of the cloud-edge-end collaborative management device provided by the present application are the same as the beneficial effects of the cloud-edge-end collaborative management method provided by the above-mentioned embodiment, and the other technical features in the cloud-edge-end collaborative management device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0148] The present application provides a cloud-edge-end collaborative management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the cloud-edge-end collaborative management method in the above-mentioned embodiment one.

[0149] Reference below Figure 6 , which shows a schematic diagram of the structure of a cloud-edge-end collaborative management device suitable for implementing an embodiment of the present application. The cloud-edge-end collaborative management device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The cloud-edge collaborative management device shown is merely an example and should not bring any limitations to the functions and scope of use of the embodiments of the present application.

[0150] like Figure 6As shown, the cloud-edge collaborative management device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the cloud-edge collaborative management device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the cloud-edge collaborative management device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a cloud-edge collaborative management device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or provided alternatively.

[0151] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0152] The cloud-edge collaborative management device provided by the present application adopts the cloud-edge collaborative management method in the above embodiment, which can solve the technical problem that the integrity and authenticity of data are destroyed during the transmission process. Compared with the prior art, the beneficial effects of the cloud-edge collaborative management device provided by the present application are the same as the beneficial effects of the cloud-edge collaborative management method provided by the above embodiment, and the other technical features in the cloud-edge collaborative management device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0153] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0154] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0155] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the cloud-edge-terminal collaborative management method in the above-mentioned embodiment.

[0156] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0157] The above-mentioned computer-readable storage medium may be included in the cloud-edge-end collaborative management device; or it may exist independently without being installed in the cloud-edge-end collaborative management device.

[0158] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the cloud-edge-end collaborative management device, the cloud-edge-end collaborative management device: receives the initial data sent by the terminal layer; signs the initial data through a preset private key to generate target signature data; encrypts the initial data through a preset public key to generate encrypted data; and sends the target signature data and the encrypted data to the edge layer.

[0159] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0160] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0161] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0162] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned cloud-edge-end collaborative management method, and can solve the technical problem that the integrity and authenticity of data are destroyed during the transmission process. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the cloud-edge-end collaborative management method provided in the above-mentioned embodiment, and will not be repeated here.

[0163] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the cloud-edge-terminal collaborative management method as described above.

[0164] The computer program product provided by this application can solve the technical problem that the integrity and authenticity of data are destroyed during the transmission process. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the cloud-edge-end collaborative management method provided by the above embodiment, which will not be repeated here.

[0165] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A cloud-edge-device collaborative management method, characterized in that: The cloud-edge-device collaborative management method is applied to the cloud layer, and the method includes: Receive the initial data sent by the terminal layer; Performing a signing operation on the initial data using a preset private key to generate target signature data; Performing an encryption operation on the initial data using a preset public key to generate encrypted data; The target signature data and the encrypted data are sent to an edge layer.

2. The method according to claim 1, characterized in that The step of performing a signing operation on the initial data by using a preset private key to generate target signature data comprises: receiving the initial data, and performing signature preprocessing on the initial data; Performing a hash operation on the initial data after signature preprocessing to generate hash data; The hash data is digitally signed using a preset private key to generate target signature data.

3. A cloud-edge-device collaborative management method, characterized in that: The cloud-edge-device collaborative management method is applied to the edge layer, and the method includes: Receive target signature data and encrypted data sent by the cloud; Performing a signature verification operation on the target signature data to obtain a target signature verification result; The encrypted data is processed based on the target signature verification result to obtain the target data.

4. The method according to claim 3, characterized in that The step of performing a signature verification operation on the target signature data to obtain a target signature verification result comprises: Performing a signature verification operation on the target signature data using a preset public key to generate signature verification data; The signature verification data is compared with the target signature data to obtain a target signature verification result.

5. The method according to claim 3, characterized in that The step of processing the encrypted data based on the target signature verification result to obtain the target data comprises: If the target signature verification result is verification failure, generating error log data based on the encrypted data; If the target signature verification result is verification passed, the encrypted data is decrypted using a preset private key to obtain the initial data.

6. A cloud-edge-device collaborative management method, characterized in that: The cloud-edge-device collaborative management method is applied to the terminal layer, and the method includes: Collecting preprocessed data and storing the preprocessed data close to the source; Processing the preprocessed data accordingly to obtain initial data; The initial data is sent to the cloud layer so that the cloud layer can perform signing and encryption operations on the initial data to generate target signature data and encrypted data; the target signature data and encrypted data are sent to the edge layer so that the edge layer can perform verification operations on the target signature data to obtain a target verification result; the encrypted data is processed based on the target verification result to obtain the target data.

7. The method according to claim 6, characterized in that The step of performing corresponding processing on the preprocessed data to obtain initial data comprises: Assigning corresponding topics to the hot data in the preprocessed data, and generating a corresponding data warehouse; Performing correlation verification and clustering integration operations on multi-source heterogeneous same-topic data in the preprocessed data to generate normalized topic data; A knowledge graph is constructed for the situation data in the preprocessed data to generate a related data graph.

8. The method according to claim 6, characterized in that After the step of performing corresponding processing on the preprocessed data to obtain initial data, the following step further comprises: The computationally intensive and time-sensitive tasks contained in the preprocessed data are unloaded to the edge layer through data unloading.

9. A cloud-edge-device collaborative management device, characterized in that: The device comprises: A data receiving module, used for receiving the initial data sent by the terminal layer; A data signature module, used to sign the initial data using a preset private key to generate target signature data; A data encryption module, used to perform an encryption operation on the initial data using a preset public key to generate encrypted data; A data sending module is used to send the target signature data and the encrypted data to the edge layer.

10. A cloud-edge-device collaborative management device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the cloud-edge-terminal collaborative management method as described in any one of claims 1 to 8.

Images