Data management and control method, system, device and equipment under cloud edge collaboration and medium

Abstract

The present disclosure relates to the technical field of electric power data, and particularly relates to a data management and control method, system, device, equipment and medium under cloud-edge collaboration, which comprises the following steps: a cloud server generates access keys and verification keys corresponding to each data level, sends the access keys corresponding to the data levels to user terminals of corresponding user identifiers, and sends each verification key to s edge servers; when a user terminal accesses electric power data of a target data level, the user terminal slices a secret value generated based on the access key of the target data level, and then distributes the secret value to the s edge servers; the edge servers exchange secret slices with each other, restore the secret value based on any t secret slices obtained, perform zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level, and control the user terminal to access the electric power data of the target data level based on each verification result. The technical scheme can meet the security access requirements of multiple users for electric power data.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of power data, in particular to a data management and control method, system, device and equipment under cloud-edge collaboration and a medium. BACKGROUND

[0002] Power grid dispatching is the core hub for maintaining the coordinated operation of power generation, power transmission, power transformation, power distribution and power consumption, and is also the key to providing open and shared comprehensive energy data services to the industry. The current power grid dispatching faces many challenges, such as the accumulation of operational risks and the acceleration of market-oriented reform. These problems need to use new technologies to improve the ability of ubiquitous information perception, comprehensive data middle platform, lean dispatching management, data deep application and value creation. Among them, the power grid data intelligent management and control technology is the basis for achieving the above goals.

[0003] With the widespread application of digital technology in the power system and the advancement of dispatching control cloud construction, the development of power grid dispatching business presents the basic characteristics of multiple business participants, frequent business interaction and large data exchange volume. Therefore, it is necessary to ensure the security of multi-party data sharing while meeting the reliability requirements of data interaction and sharing.

[0004] In the traditional power system, there is usually a control center to complete all power data management processes, but this is not suitable for a multi-party power system, because a single control center cannot meet the needs of multiple users accessing the data center at the same time due to resource limitations, and if the single control center is destroyed, the data security of each user will be threatened. Therefore, an intelligent management and control scheme is urgently needed to meet the security access needs of multiple users for power data. SUMMARY

[0005] To solve the problems in the related art, the embodiments of the present disclosure provide a data management and control method, system, device, equipment and medium under cloud-edge collaboration.

[0006] In a first aspect, the embodiments of the present disclosure provide a data management and control method under cloud-edge collaboration, comprising:

[0007] The cloud server generates an access key corresponding to each data level of the preset power data and a verification key corresponding to the access key;

[0008] The cloud server sends the access key corresponding to the data level to the user terminal of the user identifier corresponding to the data level according to the correspondence between each data level and the user identifier in the pre-stored access control list, and sends each verification key to s edge servers, where s is an integer greater than 2;

[0009] The user terminal generates a secret value corresponding to the target data level according to a pre-agreed generation algorithm based on the received access key corresponding to the target data level when accessing power data of the target data level;

[0010] The user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice;

[0011] The edge servers exchange the received secret slices with each other, and restore the secret value based on any t secret slices obtained, to obtain a restored secret value, wherein t is a secret restoration threshold, and 2≤t≤s;

[0012] The edge servers perform zero-knowledge proof verification based on the restored secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge servers; and the access of the user terminal to the power data of the target data level is controlled based on the verification results of the s edge servers.

[0013] In a possible implementation, the method further includes:

[0014] The cloud server determines the data level of the power data according to the type and sensitivity of the power data;

[0015] When a user registers with the cloud server, the cloud server configures a user identifier and a user authority for the registered user, and updates the access control list according to the user authority of the registered user, wherein the access control list records the correspondence between each data level and the user identifier, and the user authority is used to limit the data levels accessible by the registered user.

[0016] In a possible implementation, the secret value corresponding to the target data level is generated according to a pre-agreed generation algorithm based on the received access key corresponding to the target data level, including:

[0017] The user terminal calculates the secret value x corresponding to the target data level i according to the following formula: i i i i

[0018]

[0019] wherein r is a random number generated by the user terminal, G is a pre-defined group G, vk i i *G, sk​​​​​i a secret value corresponding to the target data level i i a verification key corresponding to the target data level i

[0020] In a possible implementation, the user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to s edge servers to request access to the power data of the target data level, including:

[0021] The user terminal sends a parameter request to the cloud server;

[0022] The cloud server generates t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers in response to the received parameter request, and sends the t-1 random numbers and the s non-zero numbers to the user terminal;

[0023] The user terminal uses the t-1 random numbers to construct the following secret sharing polynomial:

[0024] f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, where j is the secret value corresponding to the target data level;

[0025] The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices;

[0026] The user terminal sends a data access request to each edge server respectively, each data access request carrying a secret slice, the secret slices in the data access requests of different edge servers being different, and the data access request being used to request access to the power data of the target data level.

[0027] In a possible implementation, the edge servers exchange the received secret slices with each other, and recover the secret value based on any t secret slices to obtain a recovered secret value, including:

[0028] For an edge server, the edge server exchanges the received secret slices with other edge servers to obtain at least t secret slices;

[0029] The edge server recovers t-1 random numbers in the secret sharing polynomial based on any t secret slices;

[0030] The edge server uses the t-1 random numbers to construct a secret sharing polynomial f(x), and brings x = 0 into the secret sharing polynomial f(x) to obtain a recovered secret value (R, c, z).

[0031] In a possible implementation, the edge server performs zero-knowledge proof verification based on the recovered secret value and the verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server, including:

[0032] The edge server verifies whether c in the recovered secret value is equal to hash(R, vk i ), vk i is the verification key corresponding to the target data level i;

[0033] If c is equal to hash(R, vk i ), the edge server verifies whether z*G is equal to R+c*vk i , G is a predefined group G;

[0034] If z*G is equal to R+c*vk i , the verification result of the edge server is that the user end has an access key to access the power data of the target data level; otherwise, the verification result of the edge server is that the user end does not have an access key to access the power data of the target data level.

[0035] In a second aspect, the disclosure provides a data management method in cloud-edge collaboration, applied to a user end, including:

[0036] When accessing power data of a target data level, generating a secret value corresponding to the target data level according to a pre-received access key corresponding to the target data level;

[0037] Slicing the secret value corresponding to the target data level to obtain s secret slices;

[0038] Distributing the s secret slices to s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice;

[0039] When the s edge servers perform permission verification based on the secret slices and allow the user end to access the power data of the target data level, accessing the power data of the target data level.

[0040] In a possible implementation, the secret value corresponding to the target data level is generated according to the pre-received access key corresponding to the target data level, including:

[0041] Calculating the secret value x i corresponding to the target data level i according to the following formula: i , c i, z i ):

[0042]

[0043] wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to a target data level i, and vk i is a verification key corresponding to the target data level i.

[0044] In a possible implementation, the slicing of the secret value corresponding to the target data level to obtain s secret slices includes:

[0045] sending a parameter request to a cloud server;

[0046] receiving t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers returned by the cloud server in response to the parameter request;

[0047] constructing the following secret sharing polynomial using the t-1 random numbers:

[0048] f(x) = a t-1 x t-1 +... + a2x 2 + a1x + j, wherein j is the secret value corresponding to the target data level;

[0049] obtaining s secret slices by bringing the s non-zero numbers into the secret sharing polynomial.

[0050] In a third aspect, a data management method in cloud-edge collaboration is provided in the embodiments of the present disclosure, and the method is applied to an edge server and includes:

[0051] receiving a data access request carrying a secret slice sent by a user terminal, the data access request being used to request access to power data of a target data level;

[0052] exchanging the secret slice sent by the user terminal with other edge servers;

[0053] recovering a secret value based on any t secret slices of the user terminal, to obtain a recovered secret value, wherein t is a secret recovery threshold, 2≤t≤s, and s is the total number of edge servers;

[0054] performing zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server.

[0055] controlling the user terminal to access the target data level of power data based on the verification result of the s edge servers.

[0056] In a possible implementation, the secret value recovery based on any t secret slices of the user terminal includes:

[0057] recovering t-1 random numbers {a1, a2,..., a t-1} in the secret sharing polynomial based on any t secret slices of the user terminal; the secret sharing polynomial is f(x) = a t-1 x t-1 +... a2x 2 + a1x + j.

[0058] constructing a secret sharing polynomial f(x) using the t-1 random numbers, and bringing x = 0 into the secret sharing polynomial f(x) to obtain the recovered secret value j = (R, c, z).

[0059] In a possible implementation, the zero-knowledge proof verification based on the recovered secret value and the verification key corresponding to the target data level according to the pre-agreed verification algorithm includes:

[0060] verifying whether c in the recovered secret value is equal to hash(R, vk i ), where vk i is the verification key corresponding to the target data level i.

[0061] If c is equal to hash(R, vk i ), verifying whether z*G is equal to R + c*vk i , where G is a predefined group G.

[0062] If z*G is equal to R + c*vk i , the verification result is that the user terminal has the access key for accessing the target data level of power data; otherwise, the verification result is that the user terminal does not have the access key for accessing the target data level of power data.

[0063] In a fourth aspect, the disclosure provides a data management method in cloud-edge collaboration, applied to a cloud server, and including:

[0064] generating an access key corresponding to each data level of power data and a verification key corresponding to the access key according to a preset data level of power data.

[0065] According to the correspondence between each data level and a user identifier in a pre-stored access control list, the access key corresponding to the data level is sent to the user terminal of the user identifier corresponding to the data level, and each verification key is sent to the s edge servers, so that the edge servers verify whether the user terminal has the access key of the access to the power data of the corresponding data level based on the verification key by using zero-knowledge proof, and s is an integer greater than 2.

[0066] In a possible implementation, the method further includes:

[0067] According to the kind and sensitivity of the power data, the data level of the power data is determined;

[0068] When a user registers in the cloud server, the registered user configures a user identifier and a user authority, and updates the access control list according to the user authority of the registered user, the access control list records the correspondence between each data level and a user identifier, and the user authority is used to limit the data level that the registered user can access.

[0069] In a fifth aspect, the disclosure provides a data management and control system under cloud-edge collaboration, including a cloud server, s edge servers and a user terminal:

[0070] The cloud server is configured to generate an access key corresponding to each data level and a verification key corresponding to the access key according to a pre-set data level of power data; according to the correspondence between each data level and a user identifier in a pre-stored access control list, the access key corresponding to the data level is sent to the user terminal of the user identifier corresponding to the data level, and each verification key is sent to the s edge servers, and s is an integer greater than 2;

[0071] The user terminal is configured to, when accessing power data of a target data level, generate a secret value corresponding to the target data level based on the received access key corresponding to the target data level according to a pre-agreed generation algorithm; slice the secret value corresponding to the target data level to obtain s secret slices, and distribute the s secret slices to the s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice.

[0072] The edge server is configured to exchange the received secret slices with each other, perform secret value recovery based on any t secret slices, and obtain a recovered secret value, wherein t is a secret recovery threshold, 2≤t≤s; perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server; and control the user end to access the power data of the target data level based on the verification results of the s edge servers.

[0073] In a possible implementation, the cloud server is further configured to:

[0074] determine a data level of the power data according to a kind and a sensitivity of the power data;

[0075] When a user registers with the cloud server, the cloud server configures a user identifier and a user authority for the registered user, and updates the access control list according to the user authority of the registered user, wherein the access control list records a correspondence between each data level and a user identifier, and the user authority is used to limit the data levels accessible by the registered user.

[0076] In a possible implementation, the part in the user end that generates, according to a pre-agreed generation algorithm, a part of the secret value corresponding to the target data level based on the received access key corresponding to the target data level is configured to:

[0077] The user end calculates the secret value x corresponding to the target data level i according to the following formula: i i i i

[0078]

[0079] wherein r is a random number generated by the user end, G is a pre-defined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, and vk i is a verification key corresponding to the target data level i.

[0080] In a possible implementation, the part in the user end that slices the secret value corresponding to the target data level into s secret slices and distributes the s secret slices to s edge servers to request access to the power data of the target data level is configured to:

[0081] The user end sends a parameter request to the cloud server;​​​​

[0082] The cloud server generates t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers in response to the received parameter request; and sends the t-1 random numbers and the s non-zero numbers to the user terminal;

[0083] The user terminal uses the t-1 random numbers to construct the following secret sharing polynomial:

[0084] f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, where j is a secret value corresponding to the target data level;

[0085] The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices;

[0086] The user terminal sends a data access request to each edge server respectively, each data access request carrying a secret slice, the secret slices in the data access requests of different edge servers being different, and the data access request being used to request access to the power data of the target data level.

[0087] In a possible implementation, the edge servers exchange the received secret slices with each other, and recover the secret value based on any t secret slices to obtain a part of the recovered secret value, which is configured as:

[0088] The edge servers exchange the received secret slices with each other to obtain at least t secret slices;

[0089] The edge servers recover the t-1 random numbers in the secret sharing polynomial based on any t secret slices;

[0090] The edge servers use the t-1 random numbers to construct a secret sharing polynomial f(x), and bring x = 0 into the secret sharing polynomial f(x) to obtain the recovered secret value (R, c, z).

[0091] In a possible implementation, the edge servers perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, and a part of the verification result of the edge server is configured as:

[0092] Verify whether c in the recovered secret value is equal to hash(R, vk i ), where vk i is a verification key corresponding to the target data level i.

[0093] if c equals hash(R, vk i ), then verify whether z*G equals R+c*vk i , G is a predefined group G;

[0094] if z*G equals R+c*vk i , the verification result of the edge server is that the user terminal has an access key to access the target data level of power data; otherwise, the verification result of the edge server is that the user terminal does not have an access key to access the target data level of power data.

[0095] In a sixth aspect, the disclosure provides a data management and control device under cloud-edge collaboration, applied to a user terminal, the device comprising:

[0096] A secret value generation module configured to generate a secret value corresponding to a target data level when accessing power data of the target data level according to a pre-received access key corresponding to the target data level;

[0097] A secret slice module configured to slice the secret value corresponding to the target data level to obtain s secret slices;

[0098] A secret distribution module configured to distribute the s secret slices to s edge servers to request access to power data of the target data level, and each edge server obtains one secret slice;

[0099] An access module configured to access power data of the target data level when the s edge servers perform permission verification based on the secret slices and allow the user terminal to access power data of the target data level.

[0100] In a possible implementation, the secret value generation module is configured to:

[0101] Calculate the secret value x corresponding to the target data level i according to the following formula i =(R i , c i , z i ):

[0102]

[0103] wherein r is a random number generated by the user terminal, G is a predefined group G, vk i =sk i *G, sk i is an access key corresponding to the target data level i, and vk ia verification key corresponding to a target data level i.

[0104] In a possible implementation, the secret slice module is configured to:

[0105] sending a parameter request to a cloud server;

[0106] receiving t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers returned by the cloud server in response to the parameter request;

[0107] constructing the following secret sharing polynomial using the t-1 random numbers:

[0108] f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, where j is a secret value corresponding to the target data level;

[0109] bringing the s non-zero numbers into the secret sharing polynomial to obtain s secret slices.

[0110] In a seventh aspect, the present disclosure provides a data management and control device under cloud-edge collaboration, applied to an edge server, and the device comprises:

[0111] a secret receiving module configured to receive a data access request carrying a secret slice sent by a user end, the data access request being used to request access to power data of a target data level;

[0112] a secret exchange module configured to exchange the secret slice sent by the user end with other edge servers;

[0113] a secret recovery module configured to recover a secret value based on any t secret slices of the user end to obtain a recovered secret value; wherein the t is a secret recovery threshold, 2≤t≤s, and s is the total number of edge servers;

[0114] a verification module configured to perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm to obtain a verification result of the edge server;

[0115] an access control module configured to control the user end to access the power data of the target data level based on the verification results of the s edge servers.

[0116] In a possible implementation, the secret recovery module is configured to:

[0117] recover t-1 random numbers {a1, a2,..., at-1} in the secret sharing polynomial based on any t secret slices of the user end t-1}; the secret sharing polynomial is f(x) = a t-1 x t-1 +... a2x 2 +a1x+j

[0118] construct a secret sharing polynomial f(x) using the t-1 random numbers, and bring x = 0 into the secret sharing polynomial f(x) to obtain a recovered secret value j = (R, c, z).

[0119] In a possible implementation, the verification module is configured to:

[0120] verify whether c in the recovered secret value is equal to hash(R, vk i ), vk i being a verification key corresponding to the target data level i;

[0121] if c is equal to hash(R, vk i ), verify whether z*G is equal to R + c*vk i , G being a predefined group G;

[0122] if z*G is equal to R + c*vk i , the verification result is that the user end has an access key for accessing the power data of the target data level; otherwise, the verification result is that the user end does not have an access key for accessing the power data of the target data level.

[0123] In an eighth aspect, the disclosure provides a data management and control device under cloud-edge collaboration, applied to a cloud server, the device comprising:

[0124] a key generation module configured to generate an access key corresponding to each data level and a verification key corresponding to the access key according to a preset data level of power data;

[0125] a key distribution module configured to send the access key corresponding to each data level to a user end of a user identifier corresponding to the data level according to a correspondence between each data level and the user identifier in a pre-stored access control list, and send each verification key to s edge servers, so that the edge servers verify whether the user end has an access key for accessing power data of a corresponding data level based on the verification key using zero-knowledge proof, s being an integer greater than 2.

[0126] In a possible implementation, the device further comprises:

[0127] The data level division module is configured to determine a data level of the power data according to a kind and a sensitive degree of the power data.

[0128] The list updating module is configured to register a user identifier and a user authority of a user when the user registers at the cloud server, and update the access control list according to the user authority of the registered user, the access control list recording a corresponding relationship between each data level and the user identifier, and the user authority being used to limit the data level accessible by the registered user.

[0129] In a ninth aspect, the embodiments of the present disclosure provide an electronic device, comprising a memory and a processor, wherein the memory is configured to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the method in any one of the second aspect to the fourth aspect.

[0130] In a tenth aspect, the embodiments of the present disclosure provide a computer readable storage medium having computer instructions stored thereon, and the computer instructions are executed by a processor to implement the method in any one of the second aspect to the fourth aspect.

[0131] According to the technical scheme provided by the embodiment of the present disclosure, the cloud server can generate an access key corresponding to each data level of the power data and a verification key corresponding to the access key according to a preset data level of the power data, and send the access key corresponding to the data level to a user terminal corresponding to a user identifier of the data level according to a correspondence between each data level and the user identifier in a pre-stored access control list, and send each verification key to s edge servers; the user terminal generates a secret value corresponding to the data level according to the received access key corresponding to the data level; when accessing power data of a target data level, the user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to the s edge servers, and each edge server obtains one secret slice; the edge servers exchange the secret slices with each other, and restore the secret value based on any t secret slices obtained, wherein t is a secret restoration threshold, and 2≤t≤s; the edge servers perform zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level, and control the user terminal to access the power data of the target data level based on the verification results of the s edge servers; in this way, the method provided by the present disclosure is implemented based on a cloud-edge architecture, the cloud server distributes related keys and configures the data level and user permission of the corresponding power data, the verification process is expanded to the edge servers based on a secret sharing scheme, joint authentication is performed through multiple edge servers to determine whether the user terminal can access the power data of the related data level, the privacy data sharing challenge in the multi-party participation scene is effectively addressed with the assistance of the edge servers, the resource limitation problem of a single control center in the prior art is solved, and efficient data sharing within a controllable range is realized. The above scheme uses zero-knowledge proof technology and secret sharing technology to enable users accessing the power data to prove that they have the permission to access the power data of the corresponding data level without providing their real credentials (only the corresponding secret slices need to be sent), and the secret slice technology requires multiple edge servers to cooperate to restore the secret value generated by the user. Even if a small part of the edge servers are attacked and the secret slices possessed by them are leaked, the secret value cannot be restored, ensuring the anti-collusion security of user authentication under the cloud-edge collaborative architecture, and preventing the possibility of collusion between part of the edge servers and users without permission. In this way, the distributed verification process can be realized without revealing the user access credentials, and the security access requirements of multiple users for the power data are ensured.

[0132] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0133] Other features, objects, and advantages of the present disclosure will become more apparent from the following detailed description of the non-limiting embodiments, taken in conjunction with the accompanying drawings. In the drawings:

[0134] Figure 1 A flow chart of a data management method in cloud-edge collaboration is shown.

[0135] Figure 2 A flow chart of a data management method in cloud-edge collaboration applied to a user terminal is shown.

[0136] Figure 3 A flow chart of a data management method in cloud-edge collaboration applied to an edge server is shown.

[0137] Figure 4 A flow chart of a data management method in cloud-edge collaboration applied to a cloud server is shown.

[0138] Figure 5 A structural block diagram of a data management system in cloud-edge collaboration is shown.

[0139] Figure 6 A structural block diagram of a data management apparatus in cloud-edge collaboration applied to a user terminal is shown.

[0140] Figure 7 A structural block diagram of a data management apparatus in cloud-edge collaboration applied to an edge server is shown.

[0141] Figure 8 A structural block diagram of a data management apparatus in cloud-edge collaboration applied to a cloud server is shown.

[0142] Figure 9 A structural block diagram of an electronic device according to an embodiment of the disclosure is shown.

[0143] Figure 10 A structural diagram of a computer system suitable for implementing the method of an embodiment of the disclosure is shown. DETAILED DESCRIPTION

[0144] Hereinafter, exemplary embodiments of the disclosure will be described in detail with reference to the accompanying drawings so as to be easily implemented by those skilled in the art. Also, parts irrelevant to the description of the exemplary embodiments are omitted in the accompanying drawings for the sake of clarity.

[0145] In the disclosure, it should be understood that terms such as "include" or "have" are intended to indicate that there are features, numbers, steps, actions, parts, or combinations thereof disclosed in the specification, and do not exclude the possibility that one or more other features, numbers, steps, actions, parts, or combinations thereof exist or are added.

[0146] It should be further noted that the embodiments in the present disclosure and the features in the embodiments can be combined with each other in the case of no conflict. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0147] Figure 1 A flowchart of a data management method in cloud-edge collaboration provided by an embodiment of the present disclosure is shown. As shown in Figure 1 , the method comprises the following steps S101-S106:

[0148] In step S101, the cloud server generates an access key corresponding to each data level and a verification key corresponding to the access key according to a preset data level of power data.

[0149] In a possible implementation, the cloud server can divide the power data into a plurality of preset data levels according to a predetermined data classification system, and generate a pair of verification key and access key for each data level. For example, the access key corresponding to the data level i is sk i , the access key sk i corresponding verification key is vk i , vk i = sk i *G, wherein the group G=(g, p) is predefined, the generator g and the prime number p are predefined group parameters, and G is a public parameter previously negotiated by the cloud server, the edge server and the user terminal.

[0150] In step S102, the cloud server sends the access key corresponding to each data level to the user terminal of the user identifier corresponding to the data level according to the correspondence between each data level and the user identifier in the pre-stored access control list, and sends each verification key to the s edge servers.

[0151] In a possible implementation, the cloud server is previously constructed with an access control list, which records the correspondence between each data level and the user identifier. For example, the access control list can be as shown in Table 1:

[0152]

[0153] Table 1

[0154] In a possible implementation, the cloud server can send the access keys corresponding to the data levels to the user terminals of the user identifiers corresponding to the data levels. As shown in Table 1, the cloud server can send the access key sk1 corresponding to the data level 1 to the user terminals of h1, h2 and h3, send the access key sk2 corresponding to the data level 2 to the user terminals of h2 and h3, and so on. Meanwhile, the cloud server can send all the verification keys to the s edge servers.

[0155] In step S103, when accessing the power data of the target data level, the user terminal generates the secret value corresponding to the target data level based on the received access key corresponding to the target data level according to the pre-agreed generation algorithm.

[0156] In a possible implementation, some user terminals can access the power data of multiple data levels, and thus can receive multiple access keys. For example, the user terminal of h2 can access the power data of the data level 1 and the data level 2, and thus can receive the access key sk1 corresponding to the data level 1 and the access key sk2 corresponding to the data level 2.

[0157] In a possible implementation, when accessing the power data, the user terminal first determines the target data level of the power data to be accessed, and then generates the secret value corresponding to the target data level according to the pre-agreed generation algorithm. For example, when the user terminal of h2 accesses the power data of the data level 1, it can generate the secret value 1 corresponding to the data level 1 based on the sk1, and when it accesses the power data of the data level 2, it can generate the secret value 2 corresponding to the data level 2 based on the sk2.

[0158] In step S104, the user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to the s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice.

[0159] In a possible implementation, the secret slice mentioned herein refers to the secret sharing (Secret Sharing) technology in cryptography. The secret sharing technology is used to divide a secret (the secret value mentioned above) into multiple parts, each of which can be referred to as a “secret share” or a “secret slice”. Only when a predetermined number of secret slices are combined together, the original secret (i.e., the secret value mentioned above) can be recovered, and the predetermined number is a preset secret recovery threshold. This method can improve security, because a single secret slice does not contain enough information to recover the secret value, and even if it is leaked, it has no impact.

[0160] In a possible implementation, the user end can send a data access request to each of the s edge servers, and each data access request carries a secret slice. Thus, the s secret slices are distributed to the s edge servers, and each edge server is distributed with only one secret slice. The data access request is used to request the edge server to return the power data corresponding to the target data level.

[0161] In step S105, the edge servers exchange the received secret slices with each other, and perform secret value recovery based on any t secret slices to obtain a recovered secret value.

[0162] In the formula, t is a secret recovery threshold, and 2≤t≤s.

[0163] In a possible implementation, after obtaining the secret slice, the edge server can exchange the secret slice with other edge servers. Some edge servers may be attacked, have device failure, or have other problems, and thus cannot exchange the secret slice with other edge servers. Each normal edge server can obtain the secret slice of other normal edge servers through exchange. t is a secret recovery threshold, and 2≤t≤s. t is a predefined public parameter. The secret value can be recovered as long as any t secret slices are obtained. Therefore, if the secret value can be recovered, at least t edge servers are normal, and the secret value can be recovered by the at least t edge servers.

[0164] In step S106, the edge server performs zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server. The user end is controlled to access the power data of the target data level based on the verification results of the s edge servers.

[0165] In a possible implementation, zero-knowledge proof (ZKP) is a cryptographic protocol that allows one party to prove to another party that a certain statement is correct without providing any information other than its correctness. The present disclosure uses zero-knowledge proof to allow the user end to prove to the edge server that the user end has an access key to access the power data of the target data level, and only needs to provide the secret slice used to recover the secret value without providing the real credential of the user end.

[0166] In a possible implementation, the secret value is generated based on an access key of power data of the target data level, and the verification key corresponding to the target data level is generated based on the access key of the target data level. The verification algorithm between the secret value and the verification key can be pre-agreed through a zero-knowledge proof protocol based on the two generation algorithms. In this way, the edge server can use the pre-agreed verification algorithm to verify whether the restored secret value is correct using the verification key corresponding to the target data level. If correct, the verification result is that the user end has the access key; otherwise, the verification result is that the user end does not have the access key. If at least t edge servers are normally working, the at least t edge servers can restore the secret value and verify whether the user end has the access key.

[0167] In a possible implementation, the s edge servers have s verification results. When the user end has an access key of power data of the target data level, the normally working edge servers restore the correct secret value and verify whether the restored secret value is correct using the verification key corresponding to the target data level, and determine that the verification result is that the user end has the access key. When the edge server cannot normally work, or the secret slice sent by the user is modified, the verification result can be that the user end does not have the access key. Whether the user end is allowed to access the power data of the target data level can be determined based on the s verification results of the s edge servers. For example, a consensus protocol can be set to determine a consensus result of the s verification results, and the consensus result includes allowing or prohibiting the user end to access the power data of the target data level. For example, the consensus protocol can be that a predetermined number is set. When the number of verification results that the user end has the access key exceeds the predetermined number, the consensus result reached is that the user end is allowed to access the power data of the target data level. When the number of verification results that the user end does not have the access key does not exceed the predetermined number, the consensus result reached is that the user end is prohibited to access the power data of the target data level.

[0168] In a possible implementation, if it is determined based on the s verification results that the user end is allowed to access the power data of the target data level, the edge server or the cloud server that stores the power data of the target data level can send the power data of the target data level to the user end. Of course, if it is determined based on the s verification results that the user end is prohibited to access the power data of the target data level, a prohibition access notification can be sent to the user end, notifying the user end that the user cannot access the power data of the target data level. In this way, the edge server is used to assist in coping with the data access demand of multiple users, and the problem of limited resources of a single control center in the prior art is solved.

[0169] It should be noted that the data access record of the user terminal can be written into a blockchain, which is a distributed ledger technology allowing multiple participants (the cloud server, the edge server and the user terminal of the present disclosure) to jointly maintain a growing list of data access records, and can ensure the openness, transparency and audit of user data access.

[0170] In the present embodiment, the cloud server can generate an access key corresponding to each data level of the preset power data and a verification key corresponding to the access key, and send the access key corresponding to each data level to the user terminal corresponding to the user identifier according to the correspondence between each data level and the user identifier in the pre-stored access control list, and send each verification key to the s edge servers; the user terminal generates a secret value corresponding to the data level according to the received access key corresponding to the data level; when accessing power data of a target data level, the user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to the s edge servers, and each edge server obtains one secret slice; the edge servers exchange the secret slices with each other, and restore the secret value based on any t secret slices obtained, wherein t is a secret restoration threshold, 2≤t≤s; the edge servers perform zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level, and control the user terminal to access the power data of the target data level based on the verification results of the s edge servers; in this way, the method provided by the present disclosure is implemented based on a cloud-edge architecture, the cloud server distributes related keys and configures corresponding data levels and user permissions of the power data, extends the verification process to the edge servers based on a secret sharing scheme, performs joint authentication through multiple edge servers to determine whether the user terminal can access the power data of the relevant data level, effectively deals with the privacy data sharing challenge in the multi-party participation scenario with the assistance of the edge servers, solves the resource limitation problem of a single control center in the prior art, and realizes efficient sharing of data within a controllable range. The above scheme uses zero-knowledge proof technology and secret sharing technology to enable users accessing the power data to prove their access rights to the power data of the corresponding data level without providing their real credentials (only the corresponding secret slices need to be sent), and the secret slice technology requires multiple edge servers to cooperate to restore the secret value generated by the user. Even if a small part of the edge servers are attacked and their secret slices are leaked, the secret value cannot be restored, ensuring the anti-collusion security of user authentication under the cloud-edge collaborative architecture, and preventing the possibility of collusion between some edge servers and users without access rights. In this way, a distributed verification process can be realized without revealing the user access credentials, and the security access requirements of multiple users for the power data are ensured.

[0171] In a possible implementation, the method further includes:

[0172] The cloud server determines the data level of the power data according to the type and sensitivity of the power data.

[0173] When a user registers with the cloud server, the cloud server configures a user identifier and a user authority for the registered user, and updates the access control list according to the user authority of the registered user, the access control list recording the correspondence between each data level and the user identifier, and the user authority being used to limit the data level accessible by the registered user.

[0174] In this implementation, the cloud server can determine the data level of the power data according to the type and sensitivity of the power data, for example, the more sensitive the power data is, the higher the data level is, and so on.

[0175] In this implementation, when a new user registers with the cloud server, the cloud server can configure a user identifier and a user authority for the registered user according to the registration information input by the user, and then determine the data level accessible by the registered user based on the user authority of the registered user, and further add the user identifier of the registered user under the data level accessible by the registered user in the access control list, so that the access control list can be continuously updated as new users register.

[0176] This implementation sets different data access authorities for power-related users or lower-level unit users, realizes the access of power data of different data levels according to the user authorities, and guarantees the intelligent access and fine-grained control of power data.

[0177] In a possible implementation, the generating the secret value corresponding to the target data level based on the received access key corresponding to the target data level according to the pre-agreed generation algorithm includes:

[0178] The secret value corresponding to the target data level i is calculated according to the following formula i =(R i ,c i ,z i ):

[0179]

[0180] wherein r is a random number generated by the user end, G is a pre-defined group G, vk i =sk i *G, sk i is the access key corresponding to the target data level i, and vk ia verification key corresponding to the target data level i.

[0181] In this embodiment, when the user terminal accesses the power data of the target data level, the user terminal can first generate a random number r, G is a predefined group G, G is a predefined public parameter, and the user terminal, the cloud server and the edge server all store the group G. The user terminal, the cloud server and the edge server agree to use the formula vk i = sk i to generate an access key sk i corresponding to the verification key vk i , and also agree to use the above formula to generate a secret value x i .

[0182] In one possible embodiment, the user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to s edge servers to request access to the power data of the target data level, including:

[0183] The user terminal sends a parameter request to the cloud server;

[0184] The cloud server generates t-1 random numbers and s non-zero numbers in response to the received parameter request, and sends the t-1 random numbers and s non-zero numbers to the user terminal;

[0185] The user terminal uses the t-1 random numbers to construct the following secret sharing polynomial:

[0186] f(x) = a t-1 x t-1 +... a2x 2 +a1x+j, where j is the secret value;

[0187] The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices;

[0188] The user terminal sends a data access request to each edge server respectively, each data access request carrying a secret slice, the secret slices in the data access requests of different edge servers being different, and the data access request being used to request access to the power data of the target data level.

[0189] In this embodiment, after the user terminal generates the secret value corresponding to the target data level, the user terminal can send a parameter request to the cloud server, and the cloud server can generate t-1 random numbers {a1, a2,..., a t-1and s non-zero numbers, and sends the t-1 random numbers and the s non-zero numbers to the user terminal, and the user terminal can construct a secret sharing polynomial f(x) = a t-1 x t-1 +...a2x 2 +a1x+j, j is the secret value x i =(R i ,c i ,z i ), the s non-zero numbers can be denoted as x i，k , k is 1, 2,..., s, and the s non-zero numbers are brought into the secret sharing polynomial f(x) to obtain s secret slices {x i，k ,f(x i，k )}, since j is the secret value x i =(R i ,c i ,z i ), each secret slice includes three sub-slices respectively taking values of R i ,c i ,z i , and can be denoted as:

[0190]

[0191] In this embodiment, the user terminal sends one data access request to s edge servers respectively, each data access request carrying one secret slice, and the secret slices in the data access requests of different edge servers are different, so that the s secret slices are distributed to the s edge servers, and each edge server can only be distributed one secret slice.

[0192] In a possible implementation, the edge servers exchange the received secret slices with each other, and restore the secret value based on any t secret slices, to obtain a restored secret value, including:

[0193] For one edge server, the edge server exchanges secret slices with other edge servers, and obtains at least t secret slices;

[0194] The edge server restores the t-1 random numbers in the secret sharing polynomial based on any t secret slices;

[0195] The edge server constructs a secret sharing polynomial f(x) using the t-1 random numbers, and brings x = 0 into the secret sharing polynomial f(x) to obtain a restored secret value (R, c, z).

[0196] In this embodiment, for one edge server, the edge server exchanges secret slices with other edge servers, can obtain secret slices of other edge servers, if the edge servers are all normal, the edge server can exchange s-1 secret slices in addition to receiving the secret slice sent by the user end, so that a total of s secret slices are obtained; if some of the other edge servers have problems such as failure, the secret slices obtained by the edge server may be less than s secret slices, the secret slices obtained by the edge server must exceed t secret slices to recover the secret value, otherwise the process result.

[0197] In this embodiment, if the edge server obtains at least t secret slices, the edge server can select any t secret slices, bring the t secret slices into the secret sharing polynomial f(x), solve to obtain t-1 random numbers, for example, the t secret slices can be {x i,k , f(x i,k )} and k takes values of 1, 2,..., t; that is, {x i,1 , f(x i,1 )}, {x i,2 , f(x i,2 )},..., {x i,t , f(x i,t )}, bring the t secret slices into the secret sharing polynomial f(x), the following equation can be obtained:

[0198] f(x i,1 ) = a t-1 x i，1 t-1 +... a2x i，1 2 +a1x i，1 +j;

[0199] f(x i,2 ) = a t-1 x i，2 t-1 +... a2x i，2 2 +a1x i，2 +j; ...

[0201] f(x i,t ) = a t-1 x i,t t-1 +... a2x i，t 2 +a1x i，2 +j;

[0202] Solving the above t equations, t-1 random numbers {a1, a2,..., at-1} can be obtained. t-1 The edge server uses the t-1 random numbers to construct a secret sharing polynomial f(x), and brings x=0 into the secret sharing polynomial f(x), f(0)=j, so that j=(R, c, z) is obtained, and thus the recovered secret value (R, c, z) can be obtained.

[0203] In a possible implementation, the edge server performs zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, and obtains a verification result of the edge server, including:

[0204] verifying whether c in the recovered secret value is equal to hash(H, vk i ) corresponding to the target data level i; i

[0205] If they are equal, verifying whether z*G is equal to R+c*vk i , G being a predefined group G;

[0206] If they are equal, the verification result of the edge server is that the user end has an access key for accessing the power data of the target data level, otherwise, the verification result of the edge server is that the user end does not have an access key for accessing the power data of the target data level.

[0207] In this implementation, first, whether c and R in the recovered secret value are correct is verified by using the following formula:

[0208] (the meaning of this formula is whether c is equal to hash(R, vk i ))

[0209] If c=hash(R, vk i ), it indicates that c and R in the recovered secret value are correct, and at this time, whether z in the recovered secret value is correct can be verified by using the following formula:

[0210] (the meaning of this formula is whether z*G is equal to R+c*vk i )

[0211] If z*G=R+c*vk i , z in the recovered secret value is correct, and the edge server verifies that the user has an access key for accessing the power data of the target data level under the condition of zero-knowledge proof.

[0212] ​Of course, if the restored secret value is incorrect, c≠hash(R, vk i ), or z*G≠R+c*vk i , the edge server verifies that the user does not have an access key to access the target data level of power data.

[0213] Figure 2 A flowchart of a data management method applied to a user terminal in a cloud-edge collaboration is shown. As shown in Figure 2 , the method includes the following steps S201-S204:

[0214] In step S201, when accessing target data level power data, a secret value corresponding to the target data level is generated according to the access key corresponding to the target data level received in advance.

[0215] In one possible implementation, the cloud server can divide the power data into a plurality of preset data levels according to a predetermined data classification system, and generate a pair of verification key and access key for each data level. The cloud server sends the access key corresponding to the data level to the user terminal of the user identifier corresponding to the data level according to the correspondence between the data level and the user identifier in the pre-stored access control list. Some user terminals can access power data of multiple data levels, and may therefore receive multiple access keys of the data levels. For example, the user terminal of h2 in Table 1 can access power data of data level 1 and data level 2, and can therefore receive the access key sk1 corresponding to data level 1 and the access key sk2 corresponding to data level 2.

[0216] In one possible implementation, the user terminal first determines the target data level of the power data to be accessed when accessing the power data, and then generates a secret value corresponding to the target data level according to a pre-agreed generation algorithm. For example, the user terminal of h2 can generate a secret value 1 corresponding to data level 1 based on the sk1 when accessing power data of data level 1, and can generate a secret value 2 corresponding to data level 2 based on the sk2 when accessing power data of data level 2.

[0217] In step S202, the secret value corresponding to the target data level is sliced to obtain s secret slices.

[0218] In a possible implementation, the secret slice described herein refers to a secret sharing technique in cryptography, which is used to divide a secret (the secret value described above) into multiple parts, each of which can be referred to as a "secret share" or a "secret slice". Only when a predetermined number of secret slices are combined together, the original secret (i.e., the secret value described above) can be recovered, and the predetermined number is a preset secret recovery threshold. This method can improve security, because a single secret slice does not contain enough information to recover the secret value, and even if it is leaked, it has no impact.

[0219] In step S203, the s secret slices are distributed to s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice.

[0220] In a possible implementation, the user end can send a data access request to each of the s edge servers, and each data access request carries a secret slice. In this way, the s secret slices are distributed to the s edge servers, and each edge server can only be distributed one secret slice. The data access request is used to request the edge server to return the power data corresponding to the target data level.

[0221] In step S204, when the s edge servers perform permission verification based on the secret slices and allow the user end to access the power data of the target data level, the power data of the target data level is accessed.

[0222] In a possible implementation, the edge servers exchange the received secret slices with each other, and perform secret value recovery based on any t secret slices obtained, to obtain a recovered secret value, where t is a secret recovery threshold, and 2≤t≤s. The edge servers perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a verification algorithm agreed in advance, to obtain a verification result of the edge server. The access of the user end to the power data of the target data level is controlled based on the verification results of the s edge servers. When the s edge servers perform permission verification based on the secret slices and determine to allow the user end to access the power data of the target data level, the user end can access the power data of the target data level, and obtain the power data of the target data level from the edge servers or the cloud server.

[0223] In a possible implementation, the secret value corresponding to the target data level is generated according to the access key corresponding to the target data level received in advance, including:

[0224] The secret value x corresponding to the target data level i is calculated according to the following formula i =(R i , c i , z i ):

[0225]

[0226] wherein r is a random number generated by the user terminal, G is a predefined group G, vk i =sk i *G, sk i is an access key corresponding to the target data level i, and vk i is a verification key corresponding to the target data level i.

[0227] In this embodiment, when accessing the target data level of power data, the user terminal can first randomly generate a random number r, G is a predefined group G, G is a predefined public parameter, and the user terminal, the cloud server and the edge server all store the group G. The user terminal, the cloud server and the edge server have agreed to use the formula vk i =sk i *G to generate an access key sk i corresponding verification key vk i , and also agreed to use the above formula to generate the secret value x i .

[0228] In one possible embodiment, the secret value corresponding to the target data level is sliced to obtain s secret slices, including:

[0229] sending a parameter request to the cloud server;

[0230] receiving t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers returned by the cloud server in response to the parameter request;

[0231] using the t-1 random numbers to construct the following secret sharing polynomial:

[0232] f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, wherein j is the secret value corresponding to the target data level;

[0233] putting the s non-zero numbers into the secret sharing polynomial to obtain s secret slices.

[0234] In this embodiment, after the user terminal generates the secret value corresponding to the target data level, the user terminal can send a parameter request to the cloud server. After receiving the parameter request, the cloud server can generate t-1 random numbers {a1, a2,..., at-1} and s non-zero numbers, and send the t-1 random numbers and the s non-zero numbers to the user terminal. The user terminal can construct a secret sharing polynomial f(x) = a1x + a2x2 +... + at-1xt-1 + j according to the t-1 random numbers, where j is the secret value x = (R, c, z), and the s non-zero numbers can be denoted as xk, where k is an integer from 1 to s. After the s non-zero numbers are brought into the secret sharing polynomial f(x), s secret slices {x1, f(x1)}, {x2, f(x2)},..., {xs, f(xs)} can be obtained. Since j is the secret value x = (R, c, z), each secret slice includes three sub-slices with j taking values of R, c, and z, respectively, and can be denoted as: t-1 t-1 t-1 2 i i i i i,k i,k i,k i i i i i i i

[0235]

[0236] Figure 3 A flowchart of a data management method applied to an edge server in cloud-edge collaboration provided by an embodiment of the present disclosure is shown. As shown in Figure 3 the method includes the following steps S301-S305:

[0237] In step S301, a data access request carrying a secret slice sent by a user terminal is received, and the data access request is used to request access to power data of a target data level.

[0238] ​​​​​​​​​​​​​​​​​​In a possible implementation, the cloud server can divide the power data into a plurality of preset data levels according to a predetermined data grading system, each data level corresponds to a pair of verification key and access key, the cloud server sends the access key corresponding to the data level to the user terminal of the user identification corresponding to the data level according to the correspondence between the data level and the user identification in the pre-stored access control list. When the user terminal accesses the power data of the target data level, the user terminal generates a secret value corresponding to the target data level according to the access key corresponding to the target data level received in advance, and slices the secret value corresponding to the target data level to obtain s secret slices. The user terminal can send the secret slices to the edge server in the data access request to request access to the power data of the target data level. Each data access request carries a secret slice, so that s secret slices are distributed to s edge servers, and each edge server can only be distributed one secret slice.

[0239] In step S302, the secret slices sent by the user terminal are exchanged with other edge servers.

[0240] In a possible implementation, after obtaining the secret slices, the edge server can exchange the secret slices with other edge servers. Some edge servers may be attacked, have device failure, or other problems, so that they cannot exchange the secret slices with other edge servers. However, each normal edge server can obtain the secret slices of other normal edge servers through exchange.

[0241] In step S303, the secret value is recovered based on any t secret slices of the user terminal to obtain a recovered secret value.

[0242] Wherein, t is a secret recovery threshold, 2≤t≤s, and s is the total number of edge servers.

[0243] In a possible implementation, t is a secret recovery threshold, 2≤t≤s, and t is a predefined public parameter. As long as there are any t secret slices, the secret value can be recovered. Therefore, if the secret value can be recovered, at least t edge servers are normal, and the at least t edge servers can recover the secret value.

[0244] In step S304, the verification algorithm is negotiated in advance, and the recovered secret value and the verification key corresponding to the target data level are used for zero-knowledge proof verification to obtain the verification result of the edge server.

[0245] In a possible implementation, a zero-knowledge proof (ZKP) is a cryptographic protocol that allows one party to prove to another that a certain statement is true without revealing why it is true. The present disclosure employs a zero-knowledge proof to allow the user end to prove to the edge server that the user end has the access key to the target data level of power data, only by providing the secret slice used to recover the secret value without providing the user's own real credentials.

[0246] In a possible implementation, the secret value is generated based on the access key of the target data level of power data, and the verification key corresponding to the target data level is generated based on the access key. The verification algorithm between the secret value and the verification key can be pre-agreed through a zero-knowledge proof protocol based on the two generation algorithms. In this way, the edge server can use the pre-agreed verification algorithm to verify whether the recovered secret value is correct using the verification key corresponding to the target data level. If correct, the verification result is that the user end has the access key, otherwise, the verification result is that the user end does not have the access key. If at least t edge servers are working normally, then the at least t edge servers can recover the secret value and further verify whether the user end has the access key.

[0247] In step S305, the user end is controlled to access the target data level of power data based on the verification results of the s edge servers.

[0248] In a possible implementation, the s edge servers have s verification results, in the case that at least t edge servers are working normally, when the user terminal has an access key to access the target level of power data, the normal edge servers recover the correct secret value and verify the recovered secret value with the verification key corresponding to the target level of power data to determine that the verification result is that the user terminal has the access key; in the case that the edge servers cannot work normally or the secret slice sent by the user is modified, the verification result may be that the user terminal does not have the access key. Whether to allow the user terminal to access the target level of power data can be determined based on the s verification results of the s edge servers, for example, a consensus protocol can be set, and a consensus result of the s verification results is determined according to the consensus protocol, the consensus result includes allowing or prohibiting the user terminal to access the target level of power data, for example, the consensus protocol can be that a predetermined number is set, when the number of verification results that the user terminal has the access key exceeds the predetermined number, the consensus result reached is that the user terminal is allowed to access the target level of power data, and when the number of verification results that the user terminal does not have the access key does not exceed the predetermined number, the consensus result reached is that the user terminal is prohibited to access the target level of power data.

[0249] In a possible implementation, if it is determined based on the s verification results that the user terminal is allowed to access the target level of power data, the edge server or the cloud server that stores the target level of power data can send the target level of power data to the user terminal, and if it is determined based on the s verification results that the user terminal is prohibited to access the target level of power data, a prohibition access notification can be sent to the user terminal, notifying the user terminal that the user cannot access the target level of power data.

[0250] In a possible implementation, the secret value recovery based on any t secret slices of the user terminal includes:

[0251] recovering t-1 random numbers {a1, a2,..., a t-1} in the secret sharing polynomial based on any t secret slices of the user terminal; t-1 the secret sharing polynomial is f(x) = a t-1 x 2 +... a2x

[0252] constructing a secret sharing polynomial f(x) using the t-1 random numbers, and bringing x = 0 into the secret sharing polynomial f(x) to obtain the recovered secret value j = (R, c, z).

[0253] In this embodiment, for one edge server, the edge server exchanges secret shares with other edge servers, and can obtain secret shares of other edge servers. If all edge servers are working properly, the edge server can exchange s-1 secret shares in addition to the secret share sent by the user end, so that a total of s secret shares are obtained. If some of the other edge servers have problems such as failure, the secret shares obtained by the edge server may be less than s secret shares. The edge server needs to obtain more than t secret shares to recover the secret value, otherwise the process result.

[0254] In this embodiment, if the edge server obtains at least t secret shares, the edge server can select any t secret shares and bring the t secret shares into the secret sharing polynomial f(x) to obtain t-1 random numbers. For example, the t secret shares can be {x i，k , f(x i，k )} and k takes values of 1, 2,..., t. That is, {x i，1 , f(x i，1 )}, {x i，2 , f(x i，2 )},..., {x i，t , f(x i，t )}. Bringing the t secret shares into the secret sharing polynomial f(x) can obtain the following equations:

[0255] f(x i，1 ) = a t-1 x i，1 t-1 +... a2x i，1 2 +a1x i，1 +j;

[0256] f(x i，2 ) = a t-1 x i，2 t-1 +... a2x i，2 2 +a1x i，2 +j; ...

[0258] f(x i,t ) = a t-1 x i，t t-1 +... a2x i，t 2 +a1x i，2 +j;

[0259] Solving the above t equations, t-1 random numbers {a1, a2,..., at-1} can be obtained. t-1 The edge server uses the t-1 random numbers to construct a secret sharing polynomial f(x), and brings x = 0 into the secret sharing polynomial f(x), f(0) = j, so that j = (R, c, z) is obtained, and thus the recovered secret value (R, c, z) can be obtained.

[0260] In a possible implementation, the verification algorithm based on the recovered secret value and the verification key corresponding to the target data level performs zero-knowledge proof verification, and the edge server obtains a verification result, including:

[0261] whether c in the recovered secret value is equal to hash(R, vk i ) corresponding to the target data level i; i

[0262] If c is equal to hash(R, vk i ), whether z*G is equal to R + c*vk i is verified, where G is a predefined group G:

[0263] If z*G is equal to R + c*vk i , the verification result is that the user end has an access key for accessing the target data level of power data; otherwise, the verification result is that the user end does not have an access key for accessing the target data level of power data.

[0264] In this implementation, first, whether c and R in the recovered secret value are correct is verified by using the following formula:

[0265] (the meaning of this formula is whether c is equal to hash(H, vk i ))

[0266] If c = hash(H, vk i ), it indicates that c and R in the recovered secret value are correct, and at this time, whether z in the recovered secret value is correct can be verified by using the following formula:

[0267] (the meaning of this formula is whether z*G is equal to R + c*vk i )

[0268] If z*G = R + c*vk i , z in the recovered secret value is correct, and the edge server verifies that the user has an access key for accessing the target data level of power data in the case of zero-knowledge proof. ​

[0269] Of course, if the restored secret value is incorrect, c≠hash(R, vk i , or z*G≠R+c*vk i , the edge server verifies that the user does not have an access key to access the power data of the target data level.

[0270] Figure 4 A flowchart of a data management method applied to a cloud server in a cloud-edge collaboration is shown. As shown in Figure 4 , the method comprises the following steps S401-S402:

[0271] In step S401, according to the preset data level of the power data, the corresponding access key of each data level and the corresponding verification key of the access key are generated.

[0272] In one possible implementation, the cloud server can divide the power data into a plurality of preset data levels according to a predetermined data classification system, and generate a pair of verification key and access key for each data level. For example, the access key corresponding to the data level i is sk i , and the verification key corresponding to the access key sk i is vk i , vk i = sk i *G, where the group G=(g, p) is predefined, the generator g and the prime number p are custom group parameters, and G is a public parameter previously agreed upon by the cloud server, the edge server and the user terminal.

[0273] In step S402, according to the correspondence between each data level and user identifier in the pre-stored access control list, the access key corresponding to the data level is sent to the user terminal of the user identifier corresponding to the data level, and each verification key is sent to s edge servers, so that the edge servers verify whether the user terminal has an access key to access the power data of the corresponding data level based on the verification key using zero-knowledge proof, and s is an integer greater than 2.

[0274] In one possible implementation, the cloud server is pre-constructed with an access control list, which records the correspondence between each data level and user identifier. For example, the access control list can be as shown in Table 1.

[0275] In a possible implementation, the cloud server can send the access key corresponding to each data level to the user terminal of the user identification corresponding to the data level. As shown in Table 1, the cloud server can send the access key sk1 corresponding to the data level 1 to the user terminals of h1, h2 and h3, send the access key sk2 corresponding to the data level 2 to the user terminals of h2 and h3, and so on. Meanwhile, the cloud server can send all the verification keys to the s edge servers.

[0276] In a possible implementation, the method further includes:

[0277] According to the category and sensitivity of the power data, determining the data level of the power data;

[0278] When a user registers at the cloud server, the user configures a user identification and a user authority, and updates the access control list according to the user authority of the registered user, the access control list recording the correspondence between each data level and user identification, and the user authority is used to limit the data level that the registered user can access.

[0279] In this implementation, the cloud server can determine the data level of the power data according to the category and sensitivity of the power data, for example, the more sensitive the power data is, the higher the data level is, and so on.

[0280] In this implementation, when a new user registers at the cloud server, the cloud server can configure a user identification and a user authority for the registered user according to the registration information input by the user, and then determine the data level that the registered user can access based on the user authority of the registered user, and further add the user identification of the registered user in the data level that the registered user can access in the access control list. In this way, the access control list can be continuously updated as new users register.

[0281] This implementation sets different data access authorities for power-related users or lower-level unit users, realizes the access of power data of different data levels according to the user authorities, and guarantees the intelligent access and fine-grained control of power data.

[0282] The disclosure also provides a data management and control system under cloud-edge collaboration, Figure 5 A structural block diagram of the data management and control system under cloud-edge collaboration provided by the embodiment of the disclosure is shown, and the apparatus can be realized as part or all of an electronic device by software, hardware or a combination of both. As shown in Figure 5 The data management and control system under cloud-edge collaboration includes a cloud server 501, s edge servers 502 and user terminals 503, wherein:

[0283] The cloud server 501 is configured to generate an access key corresponding to each data level of the preset power data and a verification key corresponding to the access key, send the access key corresponding to each data level to a user terminal of a user identifier corresponding to the data level according to a correspondence between each data level and the user identifier in a pre-stored access control list, and send each verification key to s edge servers, where s is an integer greater than 2.

[0284] The user terminal 503 is configured to, when accessing power data of a target data level, generate a secret value corresponding to the target data level based on the received access key corresponding to the target data level according to a pre-agreed generation algorithm, slice the secret value corresponding to the target data level to obtain s secret slices, and distribute the s secret slices to the s edge servers to request access to the power data of the target data level, each edge server obtaining one secret slice.

[0285] The edge server 502 is configured to exchange the received secret slices with each other, restore the secret value based on any t secret slices, where t is a secret restoration threshold and 2≤t≤s, perform zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level according to a pre-agreed verification algorithm to obtain a verification result of the edge server, and control the user terminal to access the power data of the target data level based on the verification results of the s edge servers.

[0286] In a possible implementation, the cloud server is further configured to:

[0287] determine the data level of the power data according to the type and sensitivity of the power data;

[0288] When a user registers with the cloud server, the cloud server configures a user identifier and a user permission for the registered user, and updates the access control list according to the user permission of the registered user, the access control list recording the correspondence between each data level and the user identifier, and the user permission being used to limit the data level accessible by the registered user.

[0289] In a possible implementation, the part of the user terminal that generates the secret value corresponding to the target data level based on the received access key corresponding to the target data level according to the pre-agreed generation algorithm is configured to:

[0290] The user terminal calculates the secret value x corresponding to the target data level i according to the following formula: i = (R i , c i , zi

[0291]

[0292] wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, vk i is a verification key corresponding to the target data level i.

[0293] In a possible implementation, the part of the user terminal that slices the secret value corresponding to the target data level to obtain s secret slices and distributes the s secret slices to s edge servers to request access to the target data level of power data is configured to:

[0294] The user terminal sends a parameter request to the cloud server.

[0295] The cloud server generates t-1 random numbers {a1, a2,..., a t-1 t-1} and s non-zero numbers in response to the received parameter request, and sends the t-1 random numbers and the s non-zero numbers to the user terminal.

[0296] The user terminal uses the t-1 random numbers to construct the following secret sharing polynomial:

[0297] f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, wherein j is the secret value corresponding to the target data level.

[0298] The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices.

[0299] The user terminal sends a data access request to each edge server respectively, each data access request carrying a secret slice, the secret slices in the data access requests of different edge servers being different, and the data access request being used to request access to the target data level of power data.

[0300] In a possible implementation, the part of the edge server that exchanges the received secret slices with other edge servers and performs secret value recovery based on any t secret slices obtained to obtain a recovered secret value is configured to:

[0301] The edge server exchanges the received secret slices with other edge servers to obtain at least t secret slices.​

[0302] The edge server recovers t-1 random numbers in the secret sharing polynomial based on any t secret slices;

[0303] The edge server uses the t-1 random numbers to construct a secret sharing polynomial f(x), and brings x=0 into the secret sharing polynomial f(x) to obtain a recovered secret value (R, c, z).

[0304] In a possible implementation, the edge server performs zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, and part of the verification result of the edge server is configured to:

[0305] verify whether c in the recovered secret value is equal to hash(H, vk i ), vk i is a verification key corresponding to the target data level i;

[0306] If c is equal to hash(R, vk i ), then verify whether z*G is equal to R+c*vk i G is a predefined group G;

[0307] If z*G is equal to R+c*vk i , then the verification result of the edge server is that the user end has an access key to access the power data of the target data level; otherwise, the verification result of the edge server is that the user end does not have an access key to access the power data of the target data level.

[0308] The present disclosure also provides a data management and control device under cloud-edge collaboration, Figure 6 a structural block diagram of a data management and control device under cloud-edge collaboration applied to a user end is shown, which can be realized as part or all of an electronic device by software, hardware, or a combination of both. As Figure 6 shown, the data management and control device under cloud-edge collaboration includes:

[0309] The secret value generation module 601 is configured to generate a secret value corresponding to a target data level according to a pre-received access key corresponding to the target data level when accessing power data of the target data level;

[0310] The secret slice module 602 is configured to slice the secret value corresponding to the target data level to obtain s secret slices;

[0311] The secret distribution module 603 is configured to distribute the s secret slices to s edge servers to request access to the target data level power data, and each edge server obtains one secret slice;

[0312] The access module 604 is configured to access the target data level power data when the s edge servers perform permission verification based on the secret slices and allow the user end to access the target data level power data.

[0313] In a possible implementation, the secret value generation module is configured to:

[0314] The secret value x corresponding to the target data level i is calculated according to the following formula i =(R i , c i , z i ):

[0315]

[0316] Wherein, r is a random number generated by the user end, G is a predefined group G, vk i =sk i *G, sk i is an access key corresponding to the target data level i, and vk i is a verification key corresponding to the target data level i.

[0317] In a possible implementation, the secret slice module is configured to:

[0318] Send a parameter request to the cloud server;

[0319] Receive t-1 random numbers {a1, a2,..., a t-1} and s non-zero numbers returned by the cloud server in response to the parameter request;

[0320] Use the t-1 random numbers to construct the following secret sharing polynomial:

[0321] f(x) = a t-1 x t-1 +... a2x 2 +a1x+j, wherein j is a secret value corresponding to the target data level;

[0322] Bring the s non-zero numbers into the secret sharing polynomial to obtain s secret slices.

[0323] The present disclosure also provides a data management and control device under cloud edge collaboration, Figure 7A structural block diagram of a data management and control device applied to edge servers in cloud-edge collaboration provided by an embodiment of the present disclosure is shown. The device can be implemented as part of or the whole of an electronic device by software, hardware or a combination of both. As shown in Figure 7 The data management and control device in cloud-edge collaboration includes:

[0324] A secret receiving module 701 is configured to receive a data access request carrying a secret slice sent by a user end, the data access request being used to request access to power data of a target data level;

[0325] A secret exchange module 702 is configured to exchange the secret slice sent by the user end with other edge servers;

[0326] A secret recovery module 703 is configured to recover a secret value based on any t secret slices of the user end, to obtain a recovered secret value; wherein t is a secret recovery threshold, 2≤t≤s, and s is the total number of edge servers;

[0327] A verification module 704 is configured to perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server;

[0328] An access control module 705 is configured to control the user end to access the power data of the target data level based on the verification results of the s edge servers.

[0329] In a possible implementation, the secret recovery module is configured to:

[0330] recover t-1 random numbers {a1, a2,..., at-1} in a secret sharing polynomial based on any t secret slices of the user end; t-1 The secret sharing polynomial is f(x) = a t-1 x t-1 +...a2x 2 +a1x+j;

[0331] construct a secret sharing polynomial f(x) using the t-1 random numbers, and bring x=0 into the secret sharing polynomial f(x) to obtain a recovered secret value j=(R, c, z).

[0332] In a possible implementation, the verification module is configured to:

[0333] verify whether c in the recovered secret value is equal to hash(H, vk i ), vk i being a verification key corresponding to the target data level i;

[0334] if c equals hash(R, vk i ), verify whether z*G equals R+c*vk i G is a predefined group G;

[0335] if z*G equals R+c*vk i , the verification result is that the user terminal has an access key to access the target data level of power data; otherwise, the verification result is that the user terminal does not have an access key to access the target data level of power data.

[0336] The present disclosure also provides a data management device under cloud-edge collaboration, Figure 8 a structural block diagram of a data management device under cloud-edge collaboration applied to a cloud server is shown, which can be realized as part or all of an electronic device by software, hardware or a combination of both. As shown in Figure 8 The data management device under cloud-edge collaboration includes:

[0337] A key generation module 801 is configured to generate an access key corresponding to each data level and a verification key corresponding to the access key according to a preset data level of power data;

[0338] A key distribution module 802 is configured to send the access key corresponding to each data level to a user terminal of a user identifier corresponding to the data level according to a corresponding relationship between each data level and the user identifier in a pre-stored access control list, and send each verification key to s edge servers, so that the edge servers verify whether the user terminal has an access key to access power data of a corresponding data level based on the verification key using zero-knowledge proof, and s is an integer greater than 2.

[0339] In a possible implementation, the device further includes:

[0340] A data level division module is configured to determine the data level of the power data according to the category and sensitivity of the power data;

[0341] A list updating module is configured to register a user identifier and a user authority of a user when the user registers in the cloud server, and update the access control list according to the user authority of the registered user, the access control list recording the corresponding relationship between each data level and the user identifier, and the user authority being used to limit the data level accessible by the registered user.

[0342] The technical terms and technical features mentioned in the device embodiments are the same or similar to those mentioned in the above method embodiments. For the explanation and description of the technical terms and technical features involved in the device, reference can be made to the explanation and description of the above method embodiments, which will not be repeated here.

[0343] The present disclosure also discloses an electronic device, Figure 9 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.

[0344] As Figure 9 shown, the electronic device 900 includes a memory 901 and a processor 902, wherein the memory 901 is configured to store one or more computer instructions, and the one or more computer instructions are executed by the processor 902 to implement the method according to the embodiments of the present disclosure.

[0345] Figure 10 A structural schematic diagram of a computer system suitable for implementing the method of the embodiments of the present disclosure is shown.

[0346] As Figure 10 shown, the computer system 1000 includes a processing unit 1001, which can perform various processes in the above embodiments according to programs stored in a read-only memory (ROM) 1002 or loaded from a storage portion 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the computer system 1000 are also stored. The processing unit 1001, the ROM 1002, and the RAM 1003 are connected to each other through a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0347] The following components are connected to the I / O interface 1005: an input portion 1006 including a keyboard, a mouse, and the like; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage portion 1008 including a hard disk, and the like; and a communication portion 1009 including a network interface card such as a LAN card, a modem, and the like. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 1010 as needed, so that a computer program read therefrom is installed in the storage portion 1008 as needed. The processing unit 1001 can be implemented as a CPU, a GPU, a TPU, a FPGA, an NPU, and the like.

[0348] In particular, the method described above can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising computer instructions which, when executed by a processor, implement the method steps described above. In such embodiments, the computer program product can be downloaded and installed from a network by the communication section 1009, and / or installed from the detachable medium 1011.

[0349] The flow and block diagrams in the drawings represent possible architectural, functional, and operational architectures of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow and block diagrams can represent a module, a segment, or a portion of code which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0350] The units or modules described in the embodiments of the present disclosure can be implemented by means of software, or by means of programmable hardware. The described units or modules can also be provided in a processor, and the names of these units or modules do not constitute a limitation on the units or modules themselves in some cases.

[0351] As another aspect, the present disclosure also provides a computer readable storage medium, which can be a computer readable storage medium contained in the electronic device or computer system in the above embodiments; or can exist separately, and is not assembled into the device. The computer readable storage medium stores one or more programs, which are used by one or more processors to execute the method described in the present disclosure.

[0352] The above description is merely preferred embodiments of the present disclosure and a description of the principles of the technology applied. It should be understood by those skilled in the art that the scope of the application involved in the present disclosure is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combinations of the above technical features or equivalent features without departing from the inventive concept. For example, the above features are replaced with each other to form technical solutions with similar functions disclosed in the present disclosure (but not limited to).

Claims

1. A data management method under cloud-edge collaboration, characterized in that, The method comprises: The cloud server generates an access key corresponding to each data level and a verification key corresponding to the access key according to a preset data level of power data; The cloud server sends the access key corresponding to each data level to a user terminal corresponding to a user identifier according to a correspondence between each data level and the user identifier in a pre-stored access control list, and sends each verification key to s edge servers, wherein s is an integer greater than 2; The user terminal generates a secret value corresponding to a target data level according to a pre-agreed generation algorithm based on the received access key corresponding to the target data level when accessing power data of the target data level; The user terminal slices the secret value corresponding to the target data level to obtain s secret slices, and distributes the s secret slices to the s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice; The edge servers exchange the received secret slices with each other, and restore the secret value based on any t secret slices, wherein t is a secret restoration threshold, and 2≤t≤s; The edge servers perform zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level according to a pre-agreed verification algorithm to obtain a verification result of the edge servers; and control the user terminal to access the power data of the target data level based on the verification results of the s edge servers.

2. The method of claim 1, wherein, The method further comprises: The cloud server determines the data level of the power data according to the type and sensitivity of the power data; When a user registers with the cloud server, the cloud server configures a user identifier and a user permission for the registered user, and updates the access control list according to the user permission of the registered user, wherein the access control list records the correspondence between each data level and the user identifier, and the user permission is used to limit the data level accessible by the registered user.

3. The method of claim 1, wherein, The method further comprises: The user terminal calculates the secret value x corresponding to the target data level i according to the following formula i =(R i ,c i ,z i ) wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, vk i is a verification key corresponding to the target data level i.

4. The method of claim 1, wherein, The user terminal sends a parameter request to the cloud server; The user terminal constructs the following secret sharing polynomial using the t-1 random numbers: The cloud server generates t-1 random numbers {a1, a2, …, a t-1} and s non-zero numbers in response to the received parameter request, and sends the t-1 random numbers and the s non-zero numbers to the user end. The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices; f(x) = a t-1 x t-1 +... a2x 2 + a1x + j, where j is a secret value corresponding to the target data class. The user terminal sends a data access request to each edge server, and each data access request carries one secret slice, wherein the secret slices in the data access requests of different edge servers are different, and the data access request is used to request access to the power data of the target data level. ​ 5. The method of claim 4, wherein, The edge servers exchange the received secret slices with each other, and restore a secret value based on any t secret slices to obtain a restored secret value, including: For an edge server, the edge server exchanges the received secret slices with other edge servers to obtain at least t secret slices; The edge server restores t-1 random numbers in the secret sharing polynomial based on any t secret slices; The edge server uses the t-1 random numbers to construct a secret sharing polynomial f(x), and brings x=0 into the secret sharing polynomial f(x) to obtain the restored secret value (R, c, z).

6. The method of claim 5, wherein, The edge server performs zero-knowledge proof verification based on the restored secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm to obtain a verification result of the edge server, including: The edge server verifies whether c in the recovered secret value is equal to hash(R, vk i ), vk i is a verification key corresponding to the target data level i. if c equals hash(R, vk i ), then verify whether z*G equals R + c*vk i , G is a predefined group G; If z*G equals R + c*vk i then the verification result of the edge server is that the user terminal has the access key to access the target level of power data; otherwise, the verification result of the edge server is that the user terminal does not have the access key to access the target level of power data.

7. A data management method under cloud-edge collaboration, characterized in that, Applied to a user end, the method includes: When accessing power data of a target data level, generating a secret value corresponding to the target data level according to a pre-received access key corresponding to the target data level; Slicing the secret value corresponding to the target data level to obtain s secret slices; Distributing the s secret slices to s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice; When the s edge servers perform permission verification based on the secret slices and allow the user end to access the power data of the target data level, accessing the power data of the target data level.

8. The method of claim 7, wherein, The generating of the secret value corresponding to the target data level according to the pre-received access key corresponding to the target data level includes: The secret value x corresponding to the target data level i is calculated according to the following formula i = (R i ,c i ,z i ): wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, vk i is a verification key corresponding to the target data level i.

9. The method of claim 7, wherein, The slicing of the secret value corresponding to the target data level to obtain s secret slices includes: Sending a parameter request to a cloud server; receiving t-1 random numbers {a1, a2,..., at} and s non-zero numbers returned by the cloud server in response to the parameter request; t-1} and s non-zero numbers; Using the t-1 random numbers to construct the following secret sharing polynomial: f(x) = a t-1 x t-1 +...a2x 2 +a1x+j, where j is a secret value corresponding to the target data class. Bringing the s non-zero numbers into the secret sharing polynomial to obtain s secret slices.

10. A data management method under cloud-edge collaboration, characterized in that, Applied to an edge server, the method includes: Receiving a data access request sent by a user end and carrying a secret slice, the data access request being used to request access to power data of a target data level; Exchanging the secret slice sent by the user end with other edge servers; Restoring a secret value based on any t secret slices of the user end to obtain a restored secret value; wherein the t is a secret restoration threshold, 2≤t≤s, and s is the total number of edge servers; Performing zero-knowledge proof verification based on the restored secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm to obtain a verification result of the edge server; Controlling the user end to access the power data of the target data level based on the verification results of the s edge servers.

11. The method of claim 10, wherein, The restoring of the secret value based on any t secret slices of the user end includes: based on any t secret slices of the user end, t-1 random numbers {a1, a2,..., at} in the secret sharing polynomial are recovered t-1}; the secret sharing polynomial is f(x) = a t-1 x t-1 +...a2x 2 +a1x+j; Using the t-1 random numbers to construct a secret sharing polynomial f(x), and bringing x=0 into the secret sharing polynomial f(x) to obtain the restored secret value j=(R, c, z).

12. The method of claim 11, wherein, The verification algorithm is pre-negotiated, and zero-knowledge proof verification is performed based on the recovered secret value and the verification key corresponding to the target data level, to obtain the verification result of the edge server, including: verifying whether c in the recovered secret value is equal to hash(R, vk i ), vk i is the verification key corresponding to the target data level i; if c equals hash(R, vk i ), verify whether z*G equals R + c*vk i , G is a predefined group G; if z*G equals R + c*vk i then the verification result is that the user terminal has the access key to access the power data of the target data level; otherwise, the verification result is that the user terminal does not have the access key to access the power data of the target data level.

13. A data management method under cloud-edge collaboration, characterized in that, The method is applied to a cloud server, and the method comprises: According to the data level of the preset power data, the access key corresponding to each data level and the verification key corresponding to the access key are generated; According to the correspondence between each data level and the user identifier in the pre-stored access control list, the access key corresponding to the data level is sent to the user terminal corresponding to the user identifier of the data level, and each verification key is sent to s edge servers, so that the edge servers verify whether the user terminal has the access key for accessing the power data of the corresponding data level based on the verification key by using zero-knowledge proof, and s is an integer greater than 2.

14. The method of claim 13, wherein, The method further comprises: According to the type and sensitivity of the power data, the data level of the power data is determined; When a user registers in the cloud server, the user configures a user identifier and a user authority, and updates the access control list according to the user authority of the registered user, the access control list records the correspondence between each data level and the user identifier, and the user authority is used to limit the data level that the registered user can access.

15. A data management and control system under cloud-edge collaboration, characterized in that, The system comprises a cloud server, s edge servers and a user terminal; The cloud server is configured to generate the access key corresponding to each data level and the verification key corresponding to the access key according to the data level of the preset power data, and send the access key corresponding to the data level to the user terminal corresponding to the user identifier of the data level according to the correspondence between each data level and the user identifier in the pre-stored access control list, and send each verification key to s edge servers, and s is an integer greater than 2; The user terminal is configured to generate the secret value corresponding to the target data level based on the received access key corresponding to the target data level according to the pre-negotiated generation algorithm when accessing the power data of the target data level; The secret value corresponding to the target data level is sliced to obtain s secret slices, and the s secret slices are distributed to s edge servers to request access to the power data of the target data level, and each edge server obtains one secret slice; The edge server is configured to exchange the received secret slices with each other, recover the secret value based on any t secret slices, obtain the recovered secret value, wherein t is a secret recovery threshold, 2≤t≤s, and perform zero-knowledge proof verification based on the recovered secret value and the verification key corresponding to the target data level according to the pre-negotiated verification algorithm to obtain the verification result of the edge server; The verification result of the s edge servers is used to control the user terminal to access the power data of the target data level.

16. The system of claim 15, wherein, The cloud server is further configured to: According to the type and sensitivity of the power data, the data level of the power data is determined; When a user registers at the cloud server, the cloud server configures a user identifier and a user authority for the registered user, and updates an access control list according to the user authority of the registered user, the access control list recording a corresponding relationship between each data level and the user identifier, and the user authority being used to limit the data level accessible by the registered user.

17. The system of claim 15, wherein, The part of the user terminal that generates, according to a pre-agreed generation algorithm, a part of the secret value corresponding to the target data level based on the received access key corresponding to the target data level is configured to: The user terminal calculates the secret value x corresponding to the target data level i according to the following formula i = (R i ,c i ,z i ): wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, vk i is a verification key corresponding to the target data level i.

18. The system of claim 15, wherein, The part of the user terminal that slices the secret value corresponding to the target data level to obtain s secret slices and distributes the s secret slices to s edge servers to request access to the power data of the target data level is configured to: The user terminal sends a parameter request to the cloud server. The cloud server generates t-1 random numbers {a1, a2, …, a t-1} and s non-zero numbers in response to the received parameter request, and sends the t-1 random numbers and the s non-zero numbers to the user end. The user terminal uses the t-1 random numbers to construct the following secret sharing polynomial: f(x) = a t-1 x t-1 +...a2x 2 +a1x+j, where j is a secret value corresponding to the target data class. The user terminal brings the s non-zero numbers into the secret sharing polynomial to obtain s secret slices. The user terminal sends a data access request to each edge server respectively, each data access request carrying a secret slice, the secret slices in the data access requests of different edge servers being different, and the data access request being used to request access to the power data of the target data level.

19. The system of claim 18, wherein, The part of the edge server that exchanges the received secret slices with other edge servers and restores the secret value based on any t secret slices is configured to: The edge server exchanges the received secret slices with other edge servers to obtain at least t secret slices. The edge server restores the t-1 random numbers in the secret sharing polynomial based on any t secret slices. The edge server uses the t-1 random numbers to construct the secret sharing polynomial f(x), and brings x=0 into the secret sharing polynomial f(x) to obtain the restored secret value (R, c, z).

20. The system of claim 19, wherein, The part of the edge server that performs zero-knowledge proof verification based on the restored secret value and the verification key corresponding to the target data level according to a pre-agreed verification algorithm is configured to: verifying whether c in the recovered secret value is equal to hash(R, vk i ), vk i is the verification key corresponding to the target data level i; if c equals hash(R, vk i ), then verify whether z*G equals R + c*vk i , G being a predefined group G; If z*G is equal to R + c*vk i The verification result of the edge server is that the user terminal has the access key to access the target level of power data; otherwise, the verification result of the edge server is that the user terminal does not have the access key to access the target level of power data.

21. A data management and control device under cloud-edge collaboration, characterized in that, The device applied to a user terminal comprises: A secret value generation module configured to generate, when accessing power data of a target data level, a secret value corresponding to the target data level according to a pre-received access key corresponding to the target data level; A secret slice module configured to slice the secret value corresponding to the target data level to obtain s secret slices; A secret distribution module configured to distribute the s secret slices to s edge servers to request access to the power data of the target data level, each edge server obtaining a secret slice; An access module configured to access the power data of the target data level when the s edge servers perform authority verification based on the secret slices and allow the user terminal to access the power data of the target data level.

22. The apparatus of claim 21, wherein, The secret value generation module is configured to: The secret value x corresponding to the target data level i is calculated according to the following formula i = (R i , c i , z i ): wherein r is a random number generated by the user terminal, G is a predefined group G, vk i = sk i *G, sk i is an access key corresponding to the target data level i, vk i is a verification key corresponding to the target data level i.

23. The apparatus of claim 21, wherein, The secret slice module is configured to: send a parameter request to a cloud server; receiving t-1 random numbers {a1, a2,..., at} and s non-zero numbers returned by the cloud server in response to the parameter request; t-1} and s non-zero numbers; build a secret sharing polynomial f(x) using the t-1 random numbers, and bring x=0 into the secret sharing polynomial f(x) to obtain a recovered secret value j=(R,c,z). f(x) = a t-1 x t-1 +...a2x 2 +a1x+j, where j is a secret value corresponding to the target data class. The secret receiving module is configured to receive a data access request carrying a secret slice sent by a user terminal, the data access request being used to request access to power data of a target data level. 24.A data management and control device under cloud-edge collaboration, characterized in that, The secret exchange module is configured to exchange the secret slice sent by the user terminal with other edge servers. The secret recovery module is configured to recover a secret value based on any t secret slices of the user terminal, to obtain a recovered secret value; wherein the t is a secret recovery threshold, 2≤t≤s, and s is a total number of edge servers. The verification module is configured to perform zero-knowledge proof verification based on the recovered secret value and a verification key corresponding to the target data level according to a pre-agreed verification algorithm, to obtain a verification result of the edge server. The access control module is configured to control the user terminal to access the power data of the target data level based on the verification results of the s edge servers. The secret recovery module is configured to: build a secret sharing polynomial f(x) using the t-1 random numbers, and bring x=0 into the secret sharing polynomial f(x) to obtain a recovered secret value j=(R,c,z).

25. The apparatus of claim 24, wherein, The verification module is configured to: based on any t secret slices of the user end, t-1 random numbers {a1, a2,..., at} in the secret sharing polynomial are recovered t-1}; the secret sharing polynomial is f(x) = a t-1 x t-1 +... a2x 2 + a1x + j; The device is applied to a cloud server and includes:

26. The apparatus of claim 25, wherein, The key generation module is configured to generate an access key corresponding to each data level and a verification key corresponding to the access key according to a preset data level of power data. verifying whether c in the recovered secret value is equal to hash(R, vk i ), vk i being the verification key corresponding to the target data level i; if c equals hash(R, vk i ), verify whether z*G equals R + c*vk i , G being a predefined group G; if z*G equals R + c*vk i then the verification result is that the user terminal has the access key to access the power data of the target data level; otherwise, the verification result is that the user terminal does not have the access key to access the power data of the target data level. 27.A data management and control device under cloud-edge collaboration, characterized in that, The key distribution module is configured to send the access key corresponding to each data level to a user terminal of a user identifier corresponding to the data level according to a correspondence between each data level and the user identifier in a pre-stored access control list, and send each verification key to s edge servers, so that the edge servers perform zero-knowledge proof verification on whether the user terminal has an access key for accessing power data of a corresponding data level based on the verification key, and the s is an integer greater than 2. The device further includes: The data level division module is configured to determine a data level of the power data according to a category and a sensitivity of the power data.

28. The apparatus of claim 27, wherein, The list updating module is configured to register a user identifier and a user authority of a registered user when a user registers at the cloud server, and update the access control list according to the user authority of the registered user, the access control list recording a correspondence between each data level and a user identifier, and the user authority being used to limit a data level accessible by the registered user. A memory and a processor, the memory being used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method of any one of claims 1-14. A computer instruction is stored thereon, and the computer instruction is executed by a processor to implement the method of any one of claims 1-14.

29. An electronic device, comprising: ​ 30. A readable storage medium, characterized by, ​

Images