Sandbox-based distributed collaborative edge dense state computing architecture, method and system

Abstract

The invention provides a sandbox-based distributed collaborative edge secret-state computing architecture, method and system. The architecture comprises a cloud side management platform, a secret-state computing sandbox and a secret-state algorithm memory, the cloud side management platform is used for carrying out identity authentication management on the user, managing a secret state calculation sandbox in the edge calculation node and recording a secret state calculation result; the secret state algorithm memory is used for storing secret state calculation algorithms and selecting the secret state calculation algorithms corresponding to the services according to different service requirements for calculation in a secret state calculation sandbox; the secret state calculation sandbox is used for providing a safe calculation environment for secret state calculation of the collected secret state data; according to the method, the data is safely circulated and calculated between the edge calculation node and other equipment in a ciphertext form by utilizing a cryptograph algorithm, the security guarantee of an execution environment is realized through a sandbox technology, and the security and protection capability of edge cryptograph calculation are effectively improved; and edge dense-state calculation collaboration in a weak calculation force environment is realized through combination and collaborative calculation among the sandboxes.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a sandbox-based distributed collaborative edge encrypted computing architecture, method and system. Background Art

[0002] In recent years, with the rapid development of the Internet of Things and smart devices, edge computing, as an emerging computing model, has received widespread attention. Edge computing uses edge devices to monitor, analyze and process collected data on-site, effectively reducing the computing load of cloud computing centers and improving the response speed of business processing. However, with the widespread application of edge computing, data privacy protection issues have gradually emerged. How to ensure that users' sensitive information is not leaked during the computing process has become an urgent problem to be solved. Therefore, secret computing has been introduced to meet the privacy protection needs of computing tasks, but this has also brought new challenges. Secret computing places higher requirements on the computing power and security level of devices. Edge-side devices have limited resources and weak security protection capabilities. Attackers can easily destroy computing programs, tamper with computing data, and steal computing content through underlying attacks, resulting in the failure of secret computing tasks and threatening program security and privacy. In addition, many edge devices have limited resources and are difficult to carry complex cryptographic operations. How to ensure the security and trustworthiness of all devices when performing secret computing is an important issue facing edge computing. Summary of the invention

[0003] In the edge scenario of power Internet of Things, during the interaction and calculation of data on the edge side, the traditional ciphertext transmission and plaintext calculation mode has the risk of data leakage. The purpose of this invention is to solve the problem of data privacy protection in the edge computing process. By constructing a sandbox-based multilateral collaborative secret computing, data security is achieved in the entire process of edge computing, from computing request publishing, computing task scheduling, computing task execution, and computing result storage.

[0004] The present invention proposes a sandbox-based distributed collaborative edge secret computing architecture, including: a cloud-side management platform, a secret computing sandbox and a secret algorithm storage; the cloud-side management platform is deployed on the cloud side, the secret computing sandbox is deployed on the edge computing node, and the secret algorithm storage is deployed on the terminal side and the cloud side;

[0005] The cloud-side management platform is used to perform identity authentication management on users, manage the secret computing sandbox in the edge computing node, and record the calculation results of the secret computing;

[0006] The secret algorithm storage is used to store the secret computing algorithm, select the secret computing algorithm corresponding to the service on the terminal side according to different service requirements to encrypt the collected data, and is also used to select the secret computing algorithm corresponding to the service on the cloud side to decrypt the calculation result;

[0007] The secret computing sandbox is used to provide a secure computing environment for performing secret computing on the collected secret data and send the computing results to the cloud side.

[0008] Preferably, the secret computing sandbox includes a resource security isolation module, a confidentiality container and a virtual trusted platform module;

[0009] The resource security isolation module has an isolated memory isolated by memory security separation technology and a built-in CPU-specific instruction set. The resource security isolation module is used to store and isolate confidential data collected by the terminal device, and is also used to compile and execute the CPU-specific instruction set according to the confidential computing algorithm running in the confidential container to implement privacy computing tasks;

[0010] The confidential container is used to run the confidential computing algorithm, and the isolated memory in the resource security isolation module corresponds to the confidential container one by one through the shadow page table mechanism, so that when the confidential computing algorithm runs in the confidential container, the confidential data is processed in the isolated memory;

[0011] The virtual trusted platform module is used to perform trusted measurement on the measurement objects in the resource security isolation module when the resource security isolation module is started and running, confirm whether the measurement objects are safe and reliable, and generate a trusted measurement report;

[0012] The memory security separation technology includes at least one or more of the following: memory isolation, memory encryption or data sealing; the measurement objects include at least one or more of the following: components or computing tasks; the components include at least one or more of the following: memory, BIOS or kernel; the computing tasks include at least one or more of the following: data structures, key processes and codes or important table jumps.

[0013] Preferably, the cloud-side management platform includes an identity authentication management module, a secret computing sandbox management module and a data storage module;

[0014] The identity authentication management module is used to register devices connected to the edge and end sides, verify identity information, generate a key pair, and send the public key to the end side device to encrypt the collected data using the public key;

[0015] The dense computing sandbox management module is used to create and destroy the dense computing sandbox, arrange the dense computing sandbox resources and deploy task obfuscation;

[0016] The data evidence storage module is used to receive the calculation results and trust measurement reports of the confidential calculations and store them.

[0017] Based on the same inventive concept, the present application also provides a sandbox-based distributed collaborative edge dense computing method, including:

[0018] On the end side, select the corresponding encrypted computing algorithm according to business needs to encrypt the collected data;

[0019] When collaborative dense computing is required, the edge computing node that initiates the computing task initiates a computing collaborative request to the cloud-side management platform;

[0020] The cloud-side management platform responds to computing collaboration requests, identifies edge computing nodes where secret computing sandboxes can be deployed, creates secret computing sandboxes on edge computing nodes where secret computing sandboxes can be deployed for collaborative computing, and selects the secret computing algorithm corresponding to the business on the cloud side to decrypt the calculation results.

[0021] Preferably, the step of responding to the computing collaboration request through the cloud-side management platform, identifying the edge computing node where the secret computing sandbox can be deployed, creating the secret computing sandbox at the edge computing node where the secret computing sandbox can be deployed, and performing collaborative computing includes:

[0022] Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing node where the dense computing sandbox can be deployed, and send the computing collaboration request to the edge computing node where the dense computing sandbox can be deployed;

[0023] Create a dense computing sandbox in the edge computing node that receives the computing collaboration request and respond to the cloud-side management platform;

[0024] Obtain confidentially transmitted data from the cloud management platform and data source by deploying edge computing nodes with secret computing sandboxes;

[0025] After the edge computing node where the secret computing sandbox is deployed verifies the confidentially transmitted data, collaborative computing is performed in the secret computing sandbox based on the data;

[0026] The edge computing nodes participating in the collaborative computing send the computation results to the result demander and the cloud-side management platform, and the trusted measurement report generated during the collaborative computing is sent to the cloud-side management platform.

[0027] Preferably, the step of identifying an edge computing node where a dense computing sandbox can be deployed includes:

[0028] Evaluate the computing collaboration request to obtain the edge collaborative computing business requirements;

[0029] Select edge computing nodes that meet the edge collaborative computing business requirements from all edge computing nodes managed by the cloud-side management platform as edge computing nodes on which the dense computing sandbox can be deployed;

[0030] Among them, the edge collaborative computing business requirements include at least one or more of the following: task latency requirements, energy consumption or computing power requirements.

[0031] Preferably, the step of obtaining the confidentially transmitted data from the cloud-side management platform and the data source through the edge computing node that receives the computing collaboration request includes:

[0032] The edge computing node that receives the collaborative computing request obtains the data required to participate in the collaborative computing task from the cloud-side management platform;

[0033] The edge computing node that receives the computing collaboration request obtains the data involved in the computing from the data source, where the data involved in the computing is the data signed by the private key, and the private key is the pre-generated private key of the data source;

[0034] Among them, the data required for the collaborative computing task and the data participating in the calculation are transmitted through a sandbox physical address obfuscation method based on onion routing; the data required for participating in the collaborative computing task includes at least one or more of the following: data related to the cloud-side management platform or a computing task model.

[0035] Preferably, after selecting the secret computing algorithm corresponding to the service on the cloud side to decrypt the computing result, the method further includes:

[0036] The decrypted calculation results and trusted measurement reports are stored on the cloud-side management platform.

[0037] Preferably, the terminal side selects a secret computing algorithm corresponding to the service according to the service requirements to encrypt the collected data, including:

[0038] Select the corresponding secret state computing algorithm according to the business requirements at the edge computing node, and the secret state computing algorithm includes: homomorphic encryption or order-preserving encryption;

[0039] The collected data is encrypted based on the selected secret computing algorithm and the pre-generated public key.

[0040] Preferably, before the edge computing node selects the corresponding secret state computing algorithm according to the business requirements, it also includes:

[0041] Verify the identities of edge computing nodes and end-side devices through the cloud-side management platform and generate a pair of public and private keys;

[0042] The public key is sent to the terminal side.

[0043] Preferably, after creating a secret state computing sandbox for collaborative computing on an edge computing node where a secret state computing sandbox can be deployed, the method further includes:

[0044] Destroy the dense computing sandbox on the edge computing node where the dense computing sandbox was created.

[0045] Based on the same inventive concept, the present application also provides a sandbox-based distributed collaborative edge secret computing system, including: an encryption module, a request initiation module and a collaborative computing module;

[0046] The encryption module is used to select a secret computing algorithm corresponding to the service on the terminal side according to the service requirements to encrypt the collected data;

[0047] The request initiation module is used to initiate a computing collaboration request to the cloud-side management platform through the edge computing node that initiates the computing task when collaborative dense computing is required;

[0048] The collaborative computing module is used to respond to computing collaboration requests through the cloud-side management platform, identify edge computing nodes where secret computing sandboxes can be deployed, create secret computing sandboxes on edge computing nodes where secret computing sandboxes can be deployed for collaborative computing, and select secret computing algorithms corresponding to the business on the cloud side to decrypt the calculation results.

[0049] Preferably, the collaborative computing module responds to the computing collaborative request through the cloud-side management platform, identifies the edge computing node where the secret computing sandbox can be deployed, and creates the secret computing sandbox at the edge computing node where the secret computing sandbox can be deployed, including:

[0050] Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing node where the dense computing sandbox can be deployed, and send the computing collaboration request to the edge computing node where the dense computing sandbox can be deployed;

[0051] Create a dense computing sandbox in the edge computing node that receives the computing collaboration request and respond to the cloud-side management platform;

[0052] Obtain confidentially transmitted data from the cloud management platform and data source by deploying edge computing nodes with secret computing sandboxes;

[0053] After the edge computing node where the secret computing sandbox is deployed verifies the confidentially transmitted data, collaborative computing is performed in the secret computing sandbox based on the data;

[0054] The edge computing nodes participating in the collaborative computing send the computation results to the result demander and the cloud-side management platform, and the trusted measurement report generated during the collaborative computing is sent to the cloud-side management platform.

[0055] Preferably, the collaborative computing module identifies edge computing nodes where the dense computing sandbox can be deployed, including:

[0056] Evaluate the computing collaboration request to obtain the edge collaborative computing business requirements;

[0057] Select edge computing nodes that meet the edge collaborative computing business requirements from all edge computing nodes managed by the cloud-side management platform as edge computing nodes on which the dense computing sandbox can be deployed;

[0058] Among them, the edge collaborative computing business requirements include at least one or more of the following: task latency requirements, energy consumption or computing power requirements.

[0059] Preferably, the collaborative computing module obtains the confidentially transmitted data from the cloud-side management platform and the data source through the edge computing node that receives the collaborative computing request, including:

[0060] The edge computing node that receives the collaborative computing request obtains the data required to participate in the collaborative computing task from the cloud-side management platform;

[0061] The edge computing node that receives the computing collaboration request obtains the data involved in the computing from the data source, where the data involved in the computing is the data signed by the private key, and the private key is the pre-generated private key of the data source;

[0062] Among them, the data required for the collaborative computing task and the data participating in the calculation are transmitted through a sandbox physical address obfuscation method based on onion routing; the data required for participating in the collaborative computing task includes at least one or more of the following: data related to the cloud-side management platform or a computing task model.

[0063] Preferably, after the collaborative computing module selects a secret computing algorithm corresponding to the service on the cloud side to decrypt the computing result, it further includes:

[0064] The decrypted calculation results and trusted measurement reports are stored on the cloud-side management platform.

[0065] Preferably, the encryption module is specifically used for:

[0066] Select the corresponding secret state computing algorithm according to the business requirements at the edge computing node, and the secret state computing algorithm includes: homomorphic encryption or order-preserving encryption;

[0067] The collected data is encrypted based on the selected secret computing algorithm and the pre-generated public key.

[0068] Preferably, the system also includes a key pair module, which is used to verify the identity of the edge computing node and the terminal device through the cloud-side management platform before the edge computing node selects the corresponding secret computing algorithm according to business needs, and generates a pair of public keys and private keys; and sends the public key to the terminal side.

[0069] In another aspect, the present application further provides a computing device, comprising: at least one processor and a memory;

[0070] The memory is used to store one or more programs;

[0071] When the one or more programs are executed by the one or more processors, a sandbox-based distributed collaborative edge dense computing method as described above is implemented.

[0072] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed, it implements a sandbox-based distributed collaborative edge dense computing method as described above.

[0073] Compared with the prior art, the present invention has the following beneficial effects:

[0074] The present invention provides a sandbox-based distributed collaborative edge secret computing architecture, method and system, including a cloud-side management platform, a secret computing sandbox and a secret algorithm storage; the cloud-side management platform is deployed on the cloud side, the secret computing sandbox is deployed on the edge computing node, and the secret algorithm storage is deployed on the terminal side and the cloud side; the cloud-side management platform is used to perform identity authentication management on users, and is also used to manage the secret computing sandbox in the edge computing node, and is also used to record the calculation results of the secret computing; the secret algorithm storage is used to store the secret computing algorithm, and the secret computing algorithm corresponding to the business is selected on the terminal side according to different business needs. The collected data is encrypted and is also used to select the secret computing algorithm corresponding to the business on the cloud side to decrypt the calculation result; the secret computing sandbox is used to provide a secure computing environment for the collected secret data to perform secret computing and send the calculation result to the cloud side; the present invention supports the scheduling and execution of secret computing tasks, and uses the secret algorithm to enable data to be securely circulated and calculated in ciphertext between edge computing nodes and other devices, and implements the security of the execution environment through sandbox technology, effectively improving the security and protection capabilities of edge secret computing, and realizing edge secret computing collaboration in a weak computing power environment through the combination and collaborative computing of sandboxes. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 A schematic diagram of a sandbox-based distributed collaborative edge dense computing architecture provided by the present invention;

[0076] Figure 2 A schematic diagram of the trusted computing sandbox architecture provided by the present invention;

[0077] Figure 3 A schematic diagram of a detailed structure example of a sandbox-based distributed collaborative edge dense computing architecture provided by the present invention;

[0078] Figure 4 A schematic diagram of a sandbox-based distributed collaborative edge dense computing method provided by the present invention;

[0079] Figure 5 A schematic diagram of the structure of a sandbox-based distributed collaborative edge dense computing system provided by the present invention;

[0080] Figure 6 The present invention provides a schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0081] In the edge scenario of power Internet of Things, during the interaction and calculation of data on the edge side, the traditional ciphertext transmission and plaintext calculation mode has the risk of data leakage. The purpose of this invention is to solve the problem of data privacy protection in the edge computing process. By constructing a sandbox-based multilateral collaborative secret computing, data security is achieved in the entire process of edge computing, from computing request publishing, computing task scheduling, computing task execution, and computing result storage.

[0082] The present invention integrates the trusted computing sandbox into the multilateral collaborative computing tasks in the edge computing scenario, and proposes a sandbox-based distributed collaborative edge encrypted computing architecture, method and system to ensure the security of data circulation and computing processes in the edge computing scenario.

[0083] Embodiment 1:

[0084] The present invention provides a distributed collaborative edge computing architecture based on a sandbox, such as Figure 1 As shown, including:

[0085] Cloud-side management platform, secret computing sandbox, and secret algorithm storage; the cloud-side management platform is deployed on the cloud side, the secret computing sandbox is deployed on the edge computing node, and the secret algorithm storage is deployed on the device side and the cloud side;

[0086] The cloud-side management platform is used to perform identity authentication management on users, manage the secret computing sandbox in the edge computing node, and record the calculation results of secret computing;

[0087] The secret algorithm storage device is used to store secret computing algorithms. The client selects the secret computing algorithm corresponding to the service according to different service requirements to encrypt the collected data. The client selects the secret computing algorithm corresponding to the service on the cloud side to decrypt the calculation results.

[0088] The confidential computing sandbox is used to provide a secure computing environment for confidential computing of collected confidential data and send the calculation results to the cloud side.

[0089] 1-1: Dense Computing Sandbox

[0090] The measurable secret computing sandbox based on container technology is deployed in the edge computing node (i.e. edge computing node) to provide a secure computing environment for collecting secret data for fusion computing. The secret computing sandbox (referred to as sandbox) relies on memory isolation execution technology, application sandbox creation technology based on memory space segmentation, and trusted measurement and verification technology to achieve trusted startup and runtime measurement of the execution environment of secret computing tasks.

[0091] 1-1-1: First, we need to use three key technologies, memory isolation, memory encryption, and data sealing, to implement memory-level privacy protection technology and form a secure execution environment for a trusted computing sandbox (i.e., a secret computing sandbox). The isolated memory cannot be accessed by unauthorized entities, including other parts of the CPU, and all calculations are sealed in the isolated memory. This function is implemented through the resource security isolation module.

[0092] 1-1-2 Based on the memory isolation in 1-1-1, the shadow page table mechanism is used to realize the conversion from the client virtual address to the host physical address, thereby ensuring that the isolated memory corresponds to the confidential container. When processing computing tasks, the algorithm runs in the confidential container, but the data is processed in the isolated memory. This part of the function is implemented by the confidential container.

[0093] 1-1-3 The resource security isolation module has a built-in CPU-specific instruction set at the bottom layer to perform privacy data calculations. When the algorithm in 1-1-2 is running in a confidential container, this method can automatically compile the algorithm to an instruction set through a virtualized compilation environment, thereby driving the resource security isolation module to perform privacy computing tasks. The automatic compilation process includes:

[0094] 1-1-3-1: Create a virtualized compilation environment: Use container technology (such as Docker, etc.) to create an isolated compilation environment. Install a specific compilation tool chain (such as GCC, LLVM, etc.) in this environment to simulate the target hardware architecture.

[0095] 1-1-3-2: Compilation of algorithm to instruction set: Compile the algorithm code (such as C, C++, Python, etc.) into the instruction set of the target hardware through the compilation tool chain.

[0096] 1-1-4 When the resource security isolation module is started, the virtual trusted platform module is used to perform trust measurement on it. The measurement objects include components such as memory, BIOS, kernel, as well as computing tasks such as data structures, key processes and codes, and important table jumps. By comparing with the measurement baseline value, it is determined that the measurement object is complete and has not been tampered with, thereby confirming its security and trustworthiness. In addition to startup, the trusted computing sandbox will also perform static and dynamic measurements during operation to provide real-time integrity verification and security protection capabilities.

[0097] Among them, the virtual trusted platform module, as the hardware trusted root, performs trusted measurements from memory to the upper level, and passes on the construction of a trusted chain to achieve the integrity of the static and dynamic measurement system at the memory level, thereby ensuring that it is not tampered with. While achieving the system protection effect, it does not rely on TEE chip manufacturer certification and avoids data security risks that may be caused by remote certification technology. The virtual trusted platform module is integrated in the trusted computing sandbox and deployed on the edge computing node.

[0098] Among them, the benchmark value is generated and stored through measurement before the component runs, and is related to the computing program currently being executed. In the present invention, independent benchmark values ​​will be generated for computing programs deployed in different sandboxes. When a new task is executed, a new benchmark value will be generated for the task, which will not affect the benchmark values ​​of other tasks.

[0099] 1-1-5: When performing the trust measurement in 1-1-4, a trust measurement report will be generated for each measurement.

[0100] 1-1-6: Integrate some of the technologies in 1-1-3 into a trusted computing sandbox device (i.e., a confidential computing sandbox, or simply a sandbox), and provide corresponding capabilities in the process of executing computing tasks in the sandbox. The underlying memory isolates and stores data and encrypts it. When a computing task is initiated, the application layer creates a confidential container according to the instructions and imports the algorithm. The isolated memory decrypts the data and runs the algorithm. The data is sealed during the computing process to achieve private data computing. During the calculation process, the virtual trusted platform module measures the component status and computing tasks in real time to ensure that the sandbox is always trustworthy and has not been tampered with during the execution of computing tasks, and that there is no deviation in the computing tasks. At the same time, a measurement report is generated. After the computing task is completed and before the confidential container is destroyed, the report is uploaded to the cloud management platform as a basis for evidence storage and supervision. After the computing task is completed, the confidential container can be destroyed according to the instructions to avoid resource occupation and data redundancy. The trusted computing sandbox composition architecture is as follows Figure 2 shown.

[0101] 1-2: Secret algorithm (i.e. secret computing algorithm)

[0102] The secret algorithm uses algorithms such as homomorphic encryption and order-preserving encryption to implement ciphertext calculation without data decryption, ensuring the security of the data calculation process and avoiding data leakage caused by plaintext calculation. For example, if statistics are to be performed, homomorphic encryption is used to encrypt data on the end side. If sorting is to be performed, order-preserving encryption is used. The calculation tasks of the secret algorithm run in the sandbox. Different calculation tasks can be selected for calculation according to different business requirements (ciphertext comparison, ciphertext summation, ciphertext mean, and ciphertext variance). For example, in the demand response calculation mode, the demand response rules can be implemented through the combination of ciphertext comparison and ciphertext summation; the source network load storage calculation mode requires the use of ciphertext summation to realize fusion calculation; the area line loss lean calculation mode requires ciphertext summation and ciphertext product to be implemented, etc. The secret algorithm is deployed on the cloud side and the end side.

[0103] 1-3: Cloud-side management platform

[0104] The cloud management platform is deployed on the cloud side to provide services for users who participate in computing tasks. It mainly includes three modules: identity authentication management, secret computing sandbox management, and data storage. The identity authentication and management module registers the devices connected to the edge and end sides, verifies the identity information, generates a secret key pair and sends the public key to the end-side device to encrypt the collected data using the public key. Secret computing sandbox management includes the creation and destruction of sandbox containers, secret computing sandbox resource orchestration, and task obfuscation deployment. Secret computing resource orchestration refers to the identification and selection of edge node servers deployed in the secret computing sandbox environment to perform secret computing tasks collaboratively based on the resource usage of other edge computing nodes after receiving the computing collaboration request initiated by the edge computing node; task obfuscation deployment is to implement sandbox physical address obfuscation through the onion routing mechanism when the sandbox is transmitted, so as to protect the user identity and sandbox location. Data storage is to upload the calculation results of secret computing, the measurement report generated by the computing sandbox, etc. to the cloud platform for storage after the computing task is completed after the edge computing node signs them.

[0105] An example of the detailed structure of the sandbox-based distributed collaborative edge dense computing architecture is as follows: Figure 3 shown.

[0106] The present invention designs an edge secret computing mechanism based on a secret computing sandbox, and uses secret computing methods to implement ciphertext computing without data decryption, thereby ensuring the security of the data computing process, avoiding data leakage caused by plaintext computing, and maintaining data privacy and confidentiality during the computing process. A measurable secret computing sandbox based on container technology uses a secret computing sandbox to provide a secure execution environment for secret computing, ensuring that the sandbox content has not been tampered with.

[0107] The present invention builds a distributed collaborative edge secret computing architecture based on sandbox, supports secret computing sandbox resource orchestration by combining secret algorithms, secret computing sandboxes and cloud management platforms, and improves edge secret computing capabilities through the combination of sandboxes and collaborative computing by utilizing the dynamic and scalable characteristics of sandbox components. Constructs a secret computing task obfuscation deployment based on onion routing technology, obfuscates the data transmission path and destination address, forms an anonymous transmission link, effectively protects the node address of the deployed sandbox to execute secret computing tasks, and provides a safe, efficient and transparent computing service platform to ensure the security and privacy of data in the process of executing secret computing tasks.

[0108] Embodiment 2:

[0109] The present invention based on the same inventive concept also provides a sandbox-based distributed collaborative edge dense computing method, the process of which is as follows: Figure 4 As shown, including:

[0110] Step 1: On the client side, select the corresponding encrypted computing algorithm according to the business requirements to encrypt the collected data;

[0111] Step 2: When collaborative dense computing is required, the edge computing node that initiates the computing task initiates a computing collaborative request to the cloud management platform;

[0112] Step 3: Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing nodes where the secret computing sandbox can be deployed, create a secret computing sandbox on the edge computing node where the secret computing sandbox can be deployed for collaborative computing, and select the secret computing algorithm corresponding to the business on the cloud side to decrypt the calculation results.

[0113] Before step 1, also include:

[0114] Step 0: Identity authentication and key distribution: After the edge and end devices verify their identity information on the cloud management platform, the cloud management platform generates a pair of public and private keys. The public key is distributed to the end for encryption of data collected by the end. The public key is only sent to the end, and the edge is only responsible for calculating the ciphertext data and does not have the secret key of the end to prevent data leakage to the edge.

[0115] Step 1 specifically includes data collection and secret computing request initiation: the end side selects the corresponding secret computing algorithm according to business needs, and the end side uses the public key and secret computing algorithm distributed by the cloud management platform to encrypt the collected data and transmit it to the edge computing node, which aggregates the encrypted data collected by the end side. The edge computing node analyzes the computing needs based on the current secret computing task and determines whether other nodes are needed for collaborative computing. In actual application scenarios, business needs are fixed, and the secret computing algorithm on the end side is generally selected and does not change. Secret algorithms include but are not limited to order-preserving encryption, homomorphic encryption, and other algorithms.

[0116] When collaborative computing is required, step 2 is executed, that is, the edge computing node initiates a collaborative computing request to the cloud management platform, indicating the need for collaborative confidential computing.

[0117] Step 3 includes:

[0118] Step 3-1: Dense computing resource orchestration: The cloud-side management platform monitors the edge computing node resources. The dense computing sandbox management module evaluates the edge collaborative computing business needs through the dense computing sandbox resource editing function, optimizes the configuration on demand according to the task latency requirements, energy consumption or computing power requirements, identifies and selects edge computing nodes where the dense computing sandbox can be deployed, and sends computing collaboration requests to them so that they can collaboratively execute dense computing tasks. Here, we want to filter out nodes that meet the requirements of collaborative computing. On the one hand, we need to consider the computing power resources of the collaborative computing nodes themselves, including CPU resources, memory resources, and network bandwidth resources. On the other hand, we need to consider energy consumption (the energy consumption required to transmit the dense computing tasks to the collaborative nodes and the energy consumption involved in the calculation) and latency (the latency of the task transmission to the collaborative computing nodes and the latency of the collaborative computing node calculation process).

[0119] Step 3-2: Create a secret computing sandbox: After receiving the request, the edge computing node responds to the cloud management platform and creates a secret computing sandbox. The sandbox is jointly supported and constructed by the computing resources on the edge computing node servers that collaborate to participate in the secret computing task. The edge computing node dynamically creates a secret computing sandbox by deploying a sandbox management module locally, relying on memory isolation execution, memory space segmentation, and trusted proof technology.

[0120] Step 3-3: Confused transmission of confidential computing tasks: The data and initial model related to the cloud-side management platform (i.e., the data required to participate in the collaborative computing tasks), the data from the computing participants, and the data source are summarized and encrypted with a private key to generate a digital signature, which is then sent to the edge computing nodes that want to participate in the collaborative computing using a sandbox physical address obfuscation method based on onion routing.

[0121] Step 3-4: Collaborative execution of distributed node secret computing tasks: The edge computing node where the sandbox is deployed first uses the public key of the data source to verify the source of the received data, and verifies the integrity of the received data based on the content and summary of the received data, and then performs different computing tasks (ciphertext comparison, ciphertext summation, ciphertext mean, and ciphertext variance) according to different business needs.

[0122] Step 3-5: Decryption and storage of calculation results: After the secret computing task is completed, the edge nodes participating in the collaborative computing will send the calculation results to the result demander, who will use the decryption key to decrypt the calculation results and perform subsequent operations according to business needs. At the same time, the sandbox will also upload the calculation results and the measurement report generated during the calculation (i.e., the trusted measurement report) to the cloud management platform as a proof of the security of the secret computing sandbox execution environment. The cloud side selects the secret computing algorithm corresponding to the business to decrypt the calculation results.

[0123] After step 3, it also includes: destroying the computing sandbox: after the task is completed, the edge computing node destroys the computing sandbox to avoid resource occupation and data redundancy.

[0124] Example 3

[0125] The following is a specific example of a sandbox-based distributed collaborative edge dense computing method. This example uses a cloud-edge-end architecture to build a sandbox-based distributed collaborative dense computing vehicle-pile network orderly power consumption application architecture, including a cloud-side IoT management platform, an edge-side fusion terminal, and an end-side charging pile. The orderly charging service implementation process is as follows:

[0126] 3-1: Identity authentication and key distribution: The end-side charging pile and the edge-side fusion terminal verify the identity information on the cloud-side IoT management platform. The cloud-side IoT management platform uses the homomorphic encryption CKKS scheme that supports real / complex number approximate calculations to generate public and private keys. The public keys are sent to the charging piles that need to report data.

[0127] 3-2: Initiation of encrypted computing request: The fusion terminal application in a certain area collects the active, reactive, voltage and current data of the charging piles encoded by homomorphic encryption technology; and obtains the daily load forecast data of the area such as the maximum load time and minimum load time of the area after homomorphic encryption from the cloud. Fusion terminal A analyzes the computing demand based on the current orderly power consumption computing task to determine whether other nodes are needed for collaborative computing. When collaborative computing is required, a computing collaborative request is initiated to the IoT management platform to explain the computing demand.

[0128] 3-3: Dense computing resource orchestration: The IoT management platform monitors the resource status of other fusion terminals that can deploy sandboxes, and based on the hybrid on-demand optimization configuration, identifies and selects the edge fusion terminal B that can deploy the dense computing sandbox and sends a computing collaboration request to it, so that it can collaboratively execute the dense computing tasks.

[0129] 3-4: Creation of a dense computing sandbox: After receiving the request, the fusion terminal B responds to the cloud-side management platform and creates a dense computing sandbox based on the local sandbox management module.

[0130] 3-5: Confusion transmission of secret computing tasks: After the IoT management platform packages the data required for the ordered charging computing subtasks to be executed collaboratively into an image, it uses the sandbox physical address obfuscation method based on onion routing to send the image to the fusion terminal B. After receiving the image, the fusion terminal B creates a secret computing application container to implement the deployment of the secret computing task execution program. The IoT management platform signs the data to be involved in the calculation (such as the data collected by the fusion terminal A, etc.) with a private key and sends it to the fusion terminal B using the sandbox physical address obfuscation method based on onion routing.

[0131] 3-6: Distributed node secret computing task collaborative execution: The edge computing node that deploys the sandbox uses the public key of the IoT management platform to verify its integrity. Fusion terminals A and B perform calculations based on the ordered charging secret subtasks, such as comparing the "station load" duration with the "set duration" of the "station set maximum load" to determine whether the "set duration" has been reached.

[0132] 3-7: Decryption and storage of calculation results: After the calculation is completed, the fusion terminals A and B upload the encrypted calculation results to the IoT management platform. The IoT management platform uses the corresponding private key to decrypt the calculation results and determines whether the charging pile power needs to be adjusted according to the control strategy. If necessary, the cloud side will issue control instructions to the charging pile so that the charging pile adjusts the power to achieve orderly power consumption. At the same time, the sandbox will also upload the generated measurement report to the cloud management platform as a proof of the security of the encrypted computing sandbox execution environment.

[0133] 3-8: Destroy the computing sandbox: After the task is completed, the fusion terminal B destroys the computing sandbox to avoid resource occupation and data redundancy.

[0134] Embodiment 4:

[0135] The present invention also provides a sandbox-based distributed collaborative edge dense computing system, such as Figure 5 As shown, it includes: an encryption module, a request initiation module and a collaborative computing module;

[0136] The encryption module is used to select a secret computing algorithm corresponding to the service on the terminal side according to the service requirements to encrypt the collected data;

[0137] The request initiation module is used to initiate a computing collaboration request to the cloud-side management platform through the edge computing node that initiates the computing task when collaborative dense computing is required;

[0138] The collaborative computing module is used to respond to computing collaboration requests through the cloud-side management platform, identify edge computing nodes where secret computing sandboxes can be deployed, create secret computing sandboxes on edge computing nodes where secret computing sandboxes can be deployed for collaborative computing, and select secret computing algorithms corresponding to the business on the cloud side to decrypt the calculation results.

[0139] Preferably, the collaborative computing module responds to the computing collaborative request through the cloud-side management platform, identifies the edge computing node where the secret computing sandbox can be deployed, and creates the secret computing sandbox at the edge computing node where the secret computing sandbox can be deployed, including:

[0140] Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing node where the dense computing sandbox can be deployed, and send the computing collaboration request to the edge computing node where the dense computing sandbox can be deployed;

[0141] Create a dense computing sandbox in the edge computing node that receives the computing collaboration request and respond to the cloud-side management platform;

[0142] Obtain confidentially transmitted data from the cloud management platform and data source by deploying edge computing nodes with secret computing sandboxes;

[0143] After the edge computing node where the secret computing sandbox is deployed verifies the confidentially transmitted data, collaborative computing is performed in the secret computing sandbox based on the data;

[0144] The edge computing nodes participating in the collaborative computing send the computation results to the result demander and the cloud-side management platform, and the trusted measurement report generated during the collaborative computing is sent to the cloud-side management platform.

[0145] Preferably, the collaborative computing module identifies edge computing nodes where the dense computing sandbox can be deployed, including:

[0146] Evaluate the computing collaboration request to obtain the edge collaborative computing business requirements;

[0147] Select edge computing nodes that meet the edge collaborative computing business requirements from all edge computing nodes managed by the cloud-side management platform as edge computing nodes on which the dense computing sandbox can be deployed;

[0148] Among them, the edge collaborative computing business requirements include at least one or more of the following: task latency requirements, energy consumption or computing power requirements.

[0149] Preferably, the collaborative computing module obtains the confidentially transmitted data from the cloud-side management platform and the data source through the edge computing node that receives the collaborative computing request, including:

[0150] The edge computing node that receives the collaborative computing request obtains the data required to participate in the collaborative computing task from the cloud-side management platform;

[0151] The edge computing node that receives the computing collaboration request obtains the data involved in the computing from the data source, where the data involved in the computing is the data signed by the private key, and the private key is the pre-generated private key of the data source;

[0152] Among them, the data required for the collaborative computing task and the data participating in the calculation are transmitted through a sandbox physical address obfuscation method based on onion routing; the data required for participating in the collaborative computing task includes at least one or more of the following: data related to the cloud-side management platform or a computing task model.

[0153] Preferably, after the collaborative computing module selects a secret computing algorithm corresponding to the service on the cloud side to decrypt the computing result, it further includes:

[0154] The decrypted calculation results and trusted measurement reports are stored on the cloud-side management platform.

[0155] Preferably, the encryption module is specifically used for:

[0156] Select the corresponding secret state computing algorithm according to the business requirements at the edge computing node, and the secret state computing algorithm includes: homomorphic encryption or order-preserving encryption;

[0157] The collected data is encrypted based on the selected secret computing algorithm and the pre-generated public key.

[0158] Preferably, the system also includes a key pair module, which is used to verify the identity of the edge computing node and the terminal device through the cloud-side management platform before the edge computing node selects the corresponding secret computing algorithm according to business needs, and generates a pair of public keys and private keys; and sends the public key to the terminal side.

[0159] Embodiment 5:

[0160] like Figure 6 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0161] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to implement the steps of a sandbox-based distributed collaborative edge dense computing method in the above embodiment.

[0162] Example 6

[0163] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in electronic devices and, of course, extended storage media supported by electronic devices. The storage medium provides a storage space that stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a distributed collaborative edge dense computing method based on a sandbox in the above embodiment.

[0164] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0168] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A sandbox-based distributed collaborative edge dense computing architecture, characterized in that: include: Cloud-side management platform, secret computing sandbox, and secret algorithm storage; The cloud-side management platform is deployed on the cloud side, the secret state computing sandbox is deployed on the edge computing node, and the secret state algorithm storage is deployed on the terminal side and the cloud side; The cloud-side management platform is used to perform identity authentication management on users, manage the secret computing sandbox in the edge computing node, and record the calculation results of the secret computing; The secret algorithm storage is used to store the secret computing algorithm, select the secret computing algorithm corresponding to the service on the terminal side according to different service requirements to encrypt the collected data, and is also used to select the secret computing algorithm corresponding to the service on the cloud side to decrypt the calculation result; The secret computing sandbox is used to provide a secure computing environment for performing secret computing on the collected secret data and send the computing results to the cloud side.

2. The edge dense computing architecture as claimed in claim 1, characterized in that: The secret computing sandbox includes a resource security isolation module, a confidentiality container and a virtual trusted platform module; The resource security isolation module has an isolated memory isolated by memory security separation technology and a built-in CPU-specific instruction set. The resource security isolation module is used to store and isolate confidential data collected by the terminal device, and is also used to compile and execute the CPU-specific instruction set according to the confidential computing algorithm running in the confidential container to implement privacy computing tasks; The confidential container is used to run the confidential computing algorithm, and the isolated memory in the resource security isolation module corresponds to the confidential container one by one through the shadow page table mechanism, so that when the confidential computing algorithm runs in the confidential container, the confidential data is processed in the isolated memory; The virtual trusted platform module is used to perform trusted measurement on the measurement objects in the resource security isolation module when the resource security isolation module is started and running, confirm whether the measurement objects are safe and reliable, and generate a trusted measurement report; The memory security separation technology includes at least one or more of the following: memory isolation, memory encryption or data sealing; the measurement objects include at least one or more of the following: components or computing tasks; the components include at least one or more of the following: memory, BIOS or kernel; the computing tasks include at least one or more of the following: data structures, key processes and codes or important table jumps.

3. The edge dense computing architecture as described in claim 2, characterized in that: The cloud-side management platform includes an identity authentication management module, a secret computing sandbox management module and a data storage module; The identity authentication management module is used to register devices connected to the edge and end sides, verify identity information, generate a key pair, and send the public key to the end side device to encrypt the collected data using the public key; The dense computing sandbox management module is used to create and destroy the dense computing sandbox, arrange the dense computing sandbox resources and deploy task obfuscation; The data evidence storage module is used to receive the calculation results and trust measurement reports of the confidential calculations and store them.

4. A sandbox-based distributed collaborative edge dense computing method, characterized in that: include: On the end side, select the corresponding encrypted computing algorithm according to business needs to encrypt the collected data; When collaborative dense computing is required, the edge computing node that initiates the computing task initiates a computing collaborative request to the cloud-side management platform; The cloud-side management platform responds to computing collaboration requests, identifies edge computing nodes where secret computing sandboxes can be deployed, creates secret computing sandboxes on edge computing nodes where secret computing sandboxes can be deployed for collaborative computing, and selects the secret computing algorithm corresponding to the business on the cloud side to decrypt the calculation results.

5. The method according to claim 4, characterized in that The method of responding to the computing collaboration request through the cloud-side management platform, identifying the edge computing node where the secret computing sandbox can be deployed, and creating a secret computing sandbox for collaborative computing at the edge computing node where the secret computing sandbox can be deployed includes: Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing node where the dense computing sandbox can be deployed, and send the computing collaboration request to the edge computing node where the dense computing sandbox can be deployed; Create a dense computing sandbox in the edge computing node that receives the computing collaboration request and respond to the cloud-side management platform; Obtain confidentially transmitted data from the cloud management platform and data source by deploying edge computing nodes with secret computing sandboxes; After the edge computing node where the secret computing sandbox is deployed verifies the confidentially transmitted data, collaborative computing is performed in the secret computing sandbox based on the data; The edge computing nodes participating in the collaborative computing send the computation results to the result demander and the cloud-side management platform, and the trusted measurement report generated during the collaborative computing is sent to the cloud-side management platform.

6. The method according to claim 5, characterized in that The step of identifying an edge computing node where a dense computing sandbox can be deployed includes: Evaluate the computing collaboration request to obtain the edge collaborative computing business requirements; From all edge computing nodes managed by the cloud-side management platform, select edge computing nodes that meet the edge collaborative computing business requirements as edge computing nodes on which the dense computing sandbox can be deployed; Among them, the edge collaborative computing business requirements include at least one or more of the following: task latency requirements, energy consumption or computing power requirements.

7. The method according to claim 5, characterized in that The edge computing node that receives the computing collaboration request obtains the confidentially transmitted data from the cloud management platform and the data source, including: The edge computing node that receives the collaborative computing request obtains the data required to participate in the collaborative computing task from the cloud-side management platform; The edge computing node that receives the computing collaboration request obtains the data involved in the computing from the data source, where the data involved in the computing is the data signed by the private key, and the private key is the pre-generated private key of the data source; Among them, the data required for the collaborative computing task and the data participating in the calculation are transmitted through a sandbox physical address obfuscation method based on onion routing; the data required for participating in the collaborative computing task includes at least one or more of the following: data related to the cloud-side management platform or a computing task model.

8. The method according to claim 5, characterized in that After the cloud side selects the secret computing algorithm corresponding to the service to decrypt the computing result, the method further includes: The decrypted calculation results and trusted measurement reports are stored on the cloud-side management platform.

9. The method according to claim 4, characterized in that The selecting, on the end side, a secret computing algorithm corresponding to the service according to service requirements to encrypt the collected data includes: Select the corresponding secret state computing algorithm according to the business requirements at the edge computing node, and the secret state computing algorithm includes: homomorphic encryption or order-preserving encryption; The collected data is encrypted based on the selected secret computing algorithm and the pre-generated public key.

10. The method according to claim 9, characterized in that Before the edge computing node selects the corresponding secret computing algorithm according to the business requirements, it also includes: Verify the identities of edge computing nodes and end-side devices through the cloud-side management platform and generate a pair of public and private keys; The public key is sent to the terminal side.

11. The method according to claim 4, characterized in that After the edge computing node on which the dense computing sandbox can be deployed creates a dense computing sandbox for collaborative computing, the method further includes: Destroy the dense computing sandbox on the edge computing node where the dense computing sandbox was created.

12. A sandbox-based distributed collaborative edge computing system, characterized in that: include: Encryption module, request initiation module and collaborative computing module; The encryption module is used to select a secret computing algorithm corresponding to the service on the terminal side according to the service requirements to encrypt the collected data; The request initiation module is used to initiate a computing collaboration request to the cloud-side management platform through the edge computing node that initiates the computing task when collaborative dense computing is required; The collaborative computing module is used to respond to computing collaboration requests through the cloud-side management platform, identify edge computing nodes where secret computing sandboxes can be deployed, create secret computing sandboxes on edge computing nodes where secret computing sandboxes can be deployed for collaborative computing, and select secret computing algorithms corresponding to the business on the cloud side to decrypt the calculation results.

13. The system of claim 12, wherein: The collaborative computing module responds to the computing collaborative request through the cloud-side management platform, identifies the edge computing node where the secret computing sandbox can be deployed, and creates the secret computing sandbox at the edge computing node where the secret computing sandbox can be deployed, including: Respond to the computing collaboration request through the cloud-side management platform, identify the edge computing node where the dense computing sandbox can be deployed, and send the computing collaboration request to the edge computing node where the dense computing sandbox can be deployed; Create a dense computing sandbox in the edge computing node that receives the computing collaboration request and respond to the cloud-side management platform; Obtain confidentially transmitted data from the cloud management platform and data source by deploying edge computing nodes with secret computing sandboxes; After the edge computing node where the secret computing sandbox is deployed verifies the confidentially transmitted data, collaborative computing is performed in the secret computing sandbox based on the data; The edge computing nodes participating in the collaborative computing send the computation results to the result demander and the cloud-side management platform, and the trusted measurement report generated during the collaborative computing is sent to the cloud-side management platform.

14. The system of claim 13, wherein: The collaborative computing module identifies edge computing nodes where a dense computing sandbox can be deployed, including: Evaluate the computing collaboration request to obtain the edge collaborative computing business requirements; Select edge computing nodes that meet the edge collaborative computing business requirements from all edge computing nodes managed by the cloud-side management platform as edge computing nodes on which the dense computing sandbox can be deployed; Among them, the edge collaborative computing business requirements include at least one or more of the following: task latency requirements, energy consumption or computing power requirements.

15. The system of claim 13, wherein: The collaborative computing module obtains confidentially transmitted data from the cloud-side management platform and the data source through the edge computing node that receives the collaborative computing request, including: The edge computing node that receives the collaborative computing request obtains the data required to participate in the collaborative computing task from the cloud-side management platform; The edge computing node that receives the computing collaboration request obtains the data involved in the computing from the data source, where the data involved in the computing is the data signed by the private key, and the private key is the pre-generated private key of the data source; Among them, the data required for the collaborative computing task and the data participating in the calculation are transmitted through a sandbox physical address obfuscation method based on onion routing; the data required for participating in the collaborative computing task includes at least one or more of the following: data related to the cloud-side management platform or a computing task model.

16. The system of claim 13, wherein: After the collaborative computing module selects a secret computing algorithm corresponding to the service on the cloud side to decrypt the computing result, the collaborative computing module further includes: The decrypted calculation results and trusted measurement reports are stored on the cloud-side management platform.

17. The system of claim 12, wherein: The encryption module is specifically used for: Select the corresponding secret state computing algorithm according to the business requirements at the edge computing node, and the secret state computing algorithm includes: homomorphic encryption or order-preserving encryption; The collected data is encrypted based on the selected secret computing algorithm and the pre-generated public key.

18. The system of claim 17, wherein: The system also includes a key pair module, which is used to verify the identity of the edge computing node and the terminal device through the cloud-side management platform before the edge computing node selects the corresponding secret computing algorithm according to business needs, and generates a pair of public keys and private keys; and sends the public key to the terminal side.

19. The system of claim 12, wherein: The system also includes a sandbox destruction module; The sandbox destruction module is used to destroy the secret computing sandbox at the edge computing node where the secret computing sandbox can be deployed, after the secret computing sandbox is created for collaborative computing.

20. A computer device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, a sandbox-based distributed collaborative edge dense computing method as described in any one of claims 4 to 11 is implemented.

21. A computer-readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, a sandbox-based distributed collaborative edge dense computing method as described in any one of claims 4 to 11 is implemented.

Images