Data aggregation system, method, device and equipment

Abstract

The invention discloses a data aggregation system, method and device, electronic equipment and a storage medium. The method comprises the steps that an aggregation platform applies for a first symmetric key from a password service platform; encrypting a pre-acquired encryption parameter by using the first symmetric key to obtain first encrypted information; the gateway management equipment applies for a first symmetric key and a second symmetric key; decrypting the first encrypted information by using the first symmetric key to obtain an encryption parameter; encrypting the encryption parameter by using a second symmetric key to obtain second encrypted information; the gateway applies for a second symmetric key; decrypting the second encrypted information by using the second symmetric key to obtain an encryption parameter; performing secret segmentation calculation based on the encryption parameters to obtain corresponding secret shares; the gateway management equipment aggregates the secret shares to obtain an aggregation result; and the aggregation platform reconstructs the aggregation result to obtain a secret value. In this way, data security and privacy protection between participants are ensured.

Description

Technical Field

[0001] The present application belongs to the field of data processing, and specifically relates to a data aggregation system, method, apparatus, device and storage medium. Background Art

[0002] As an important device for the deployment of the Industrial Internet, the Industrial Internet of Things gateway can collect data in real time from various sensors, equipment, production lines and other data sources, process and convert the data, and transmit it to the cloud or central server.

[0003] Within the Industrial Internet, factors such as inconsistent data standards, closed data interfaces, imperfect data sharing mechanisms, and restrictions on data access rights may lead to the inability to efficiently circulate and share data between different systems, resulting in independent, closed data storage and processing environments. These isolated data sets are like islands, which is the "data island" phenomenon.

[0004] Data silos make it impossible to transmit data within the Industrial Internet in a timely and accurate manner, which makes it easy for problems such as data duplication, inconsistency, and missing data to occur. This affects the reliability and availability of data, and prevents the data from being fully utilized and analyzed while ensuring privacy and security. It also increases the cost of data management and maintenance. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a data aggregation system, method, apparatus, device and storage medium, which can solve the problem that current data islands affect the reliability and availability of data, resulting in the inability to fully utilize and analyze data under the premise of privacy and security, while also increasing the cost of data management and maintenance.

[0006] In a first aspect, an embodiment of the present application provides a data aggregation system, the system comprising:

[0007] The convergence platform is used to apply for a first symmetric key from the cryptographic service platform; encrypt the pre-acquired encryption parameters using the first symmetric key to obtain first encrypted information; and send the first encrypted information to at least one gateway management device;

[0008] The gateway management device is used to apply for the first symmetric key and the second symmetric key from the cryptographic service platform; decrypt the first encrypted information using the first symmetric key to obtain the encryption parameter; encrypt the encryption parameter using the second symmetric key to obtain the second encrypted information; and send the second encrypted information to multiple gateways;

[0009] The gateway is configured to apply for the second symmetric key from the cryptographic service platform; decrypt the second encrypted information using the second symmetric key to obtain the encryption parameter; perform secret splitting calculation based on the encryption parameter to obtain a corresponding secret share; and return the secret share to the gateway management device;

[0010] The gateway management device is further configured to aggregate the received secret shares after receiving the secret value recovery instruction to obtain an aggregation result, and return the aggregation result to the aggregation platform;

[0011] The aggregation platform is also used to reconstruct the aggregation result to obtain a secret value.

[0012] Optionally, the convergence platform is specifically used to send the first authentication information to the cryptographic service platform and apply for the first symmetric key;

[0013] The cryptographic service platform is used to authenticate the convergence platform according to the first authentication information; after the convergence platform is successfully authenticated, return the first symmetric key to the convergence platform.

[0014] Optionally, the cryptographic service platform is specifically configured to encrypt the first symmetric key based on a key corresponding to the first security medium to obtain a first encryption key; and return the first encryption key to the convergence platform;

[0015] The convergence platform is further configured to use the first security medium to decrypt the first encryption key to obtain the first symmetric key.

[0016] Optionally, the gateway management device is specifically used to send second authentication information to the cryptographic service platform and apply for the first symmetric key and the second symmetric key;

[0017] The cryptographic service platform is used to authenticate the gateway management device according to the second authentication information; after the gateway management device is successfully authenticated, return the first symmetric key and the second symmetric key to the gateway management device.

[0018] Optionally, the cryptographic service platform is specifically configured to encrypt the first symmetric key based on a key corresponding to a second secure medium to obtain a second encryption key; and return the second encryption key to the gateway management device;

[0019] The gateway management device is further configured to use the second security medium to decrypt the second encryption key to obtain the first symmetric key.

[0020] Optionally, the gateway is specifically used to send third authentication information to the cryptographic service platform and apply for the second symmetric key;

[0021] The cryptographic service platform is used to authenticate the gateway according to the third authentication information; after the gateway authentication is successful, return the second symmetric key to the gateway.

[0022] Optionally, the cryptographic service platform is specifically configured to encrypt the second symmetric key based on a key corresponding to a third security medium to obtain a third encryption key; and return the third encryption key to the gateway management device;

[0023] The gateway management device is further configured to use the third security medium to decrypt the third encryption key to obtain the second symmetric key.

[0024] Optionally, the encryption parameters include a polynomial value array, the number of polynomial terms, and the number of devices of the gateway management device;

[0025] The gateway is specifically used to construct a polynomial based on the number of polynomial terms and randomly determined polynomial coefficients; determine the number of device values ​​from the polynomial value array, substitute the determined value into the polynomial, calculate the result value of the polynomial, and use the value and the corresponding result value as the corresponding secret share.

[0026] Optionally, the gateway management device is specifically configured to add the result values ​​in the received secret shares to obtain an aggregate result.

[0027] Optionally, the aggregation platform is specifically used to construct a system of linear equations based on the received aggregation results that are no less than the number of polynomial terms, and solve the system of linear equations to obtain a secret value.

[0028] Optionally, the gateway management device is specifically used to determine a target gateway from at least one gateway managed by itself, retain the secret share returned by the target gateway, and distribute the secret shares returned by other gateways managed by itself except the above-mentioned target gateway to other gateway management devices respectively; aggregate the secret shares retained by itself and distributed by other gateway management devices to obtain an aggregated result.

[0029] In a second aspect, an embodiment of the present application provides a data aggregation method, which is applied to a convergence platform, and the method includes:

[0030] Apply for the first symmetric key from the cryptographic service platform;

[0031] Encrypting the pre-acquired encryption parameter using the first symmetric key to obtain first encrypted information;

[0032] sending the first encrypted information to at least one gateway management device;

[0033] The aggregation result returned by the gateway management device is received, and the aggregation result is reconstructed to obtain a secret value.

[0034] In a third aspect, an embodiment of the present application provides a data aggregation method, which is applied to a gateway management device, and the method includes:

[0035] After receiving the first encrypted information sent by the convergence platform, apply for the first symmetric key and the second symmetric key from the cryptographic service platform;

[0036] Decrypting the first encrypted information using the first symmetric key to obtain an encryption parameter, and encrypting the encryption parameter using the second symmetric key to obtain second encrypted information;

[0037] Sending the second encrypted information to multiple gateways, and receiving secret shares returned by the gateways;

[0038] After receiving the secret value recovery instruction, the received secret shares are aggregated to obtain an aggregated result, and the aggregated result is returned to the aggregation platform.

[0039] In a fourth aspect, an embodiment of the present application provides a data aggregation method, which is applied to a gateway, and the method includes:

[0040] After receiving the second encrypted information sent by the gateway management device, apply for a second symmetric key from the cryptographic service platform;

[0041] Decrypting the second encrypted information using the second symmetric key to obtain encryption parameters;

[0042] Perform secret splitting calculation based on the encryption parameters to obtain corresponding secret shares;

[0043] The secret share is returned to the gateway management device.

[0044] In a fifth aspect, an embodiment of the present application provides a data aggregation device, which is applied to a convergence platform, and the device includes:

[0045] An application module, used for applying for a first symmetric key from a cryptographic service platform;

[0046] An encryption module, used to encrypt the pre-acquired encryption parameter using the first symmetric key to obtain first encrypted information;

[0047] A sending module, used for sending the first encrypted information to at least one gateway management device;

[0048] The reconstruction module is used to receive the aggregation result returned by the gateway management device and reconstruct the aggregation result to obtain a secret value.

[0049] In a sixth aspect, an embodiment of the present application provides a data aggregation device, which is applied to a gateway management device, and the device includes:

[0050] An application module, configured to apply for a first symmetric key and a second symmetric key from a cryptographic service platform after receiving the first encrypted information sent by the convergence platform;

[0051] an encryption module, configured to decrypt the first encrypted information using the first symmetric key to obtain an encryption parameter, and encrypt the encryption parameter using the second symmetric key to obtain second encrypted information;

[0052] A sending module, used for sending the second encrypted information to a plurality of gateways, and receiving secret shares returned by the gateways;

[0053] The aggregation module is used to aggregate the received secret shares after receiving the secret value recovery instruction, obtain an aggregation result, and return the aggregation result to the aggregation platform.

[0054] In a seventh aspect, an embodiment of the present application provides a data aggregation device, which is applied to a gateway, and the device includes:

[0055] An application module, configured to apply for a second symmetric key from the cryptographic service platform after receiving the second encrypted information sent by the gateway management device;

[0056] A decryption module, used to decrypt the second encrypted information using the second symmetric key to obtain encryption parameters;

[0057] The splitting module is used to perform secret splitting calculation based on the encryption parameter to obtain corresponding secret shares and return the secret shares to the gateway management device.

[0058] In an eighth aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0059] In the ninth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the second, third, and fourth aspects are implemented.

[0060] In the tenth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the methods described in the second, third, and fourth aspects.

[0061] In the eleventh aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and is executed by at least one processor to implement the methods described in the second, third, and fourth aspects.

[0062] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is a flow chart of a data aggregation system according to an exemplary embodiment;

[0064] Figure 2 is an architecture diagram of a data aggregation system according to an exemplary embodiment;

[0065] Figure 3 is a schematic diagram showing an implementation of a data aggregation system according to an exemplary embodiment;

[0066] Figure 4 is a flow chart showing a data aggregation method applied to a convergence platform according to an exemplary embodiment;

[0067] Figure 5 is a flow chart showing a data aggregation method applied to a gateway management device according to an exemplary embodiment;

[0068] Figure 6 is a flow chart showing a data aggregation method applied to a gateway according to an exemplary embodiment;

[0069] Figure 7 is a block diagram of a data aggregation device applied to a convergence platform according to an exemplary embodiment;

[0070] Figure 8 A block diagram of a data aggregation device applied to a gateway management device according to an exemplary embodiment;

[0071] Fig. 9A block diagram of a data aggregation device applied to a gateway according to an exemplary embodiment;

[0072] Fig.10 is a block diagram of an electronic device according to an exemplary embodiment;

[0073] Fig.11 The figure is a schematic diagram showing the hardware structure of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0074] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0075] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0076] The data aggregation method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0077] Figure 1 The flowchart of a data aggregation system according to an exemplary embodiment is shown. The data aggregation system includes the following steps.

[0078] In step S11, the convergence platform applies for a first symmetric key from the cryptographic service platform; uses the first symmetric key to encrypt the pre-acquired encryption parameters to obtain first encrypted information; and sends the first encrypted information to at least one gateway management device.

[0079] Within the Industrial Internet, factors such as inconsistent data standards, closed data interfaces, imperfect data sharing mechanisms, and restrictions on data access rights may lead to the inability to efficiently circulate and share data between different systems, resulting in independent, closed data storage and processing environments. These isolated data sets are like islands, which is the "data island" phenomenon.

[0080] Data silos make it impossible to transmit data within the Industrial Internet in a timely and accurate manner, which makes it easy for problems such as data duplication, inconsistency, and missing data to occur. This affects the reliability and availability of data, and prevents the data from being fully utilized and analyzed while ensuring privacy and security. It also increases the cost of data management and maintenance.

[0081] Based on this, the present application proposes a data aggregation system, in which secrets can be shared between gateways, and then the secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway to avoid the generation of data islands and solve the above problems.

[0082] In this step, the aggregation platform is the starting point of data aggregation. First, the aggregation platform applies for the first symmetric key from the cryptographic service platform. The characteristic of symmetric encryption is that the same key is used for encryption and decryption, or two keys that can be simply deduced from each other are used. Therefore, the aggregation platform uses the first symmetric key to encrypt the encryption parameters obtained in advance, and after obtaining the first encrypted information, the first encrypted information is sent to at least one gateway management device. In the subsequent steps, the gateway management device can use the first symmetric key to decrypt the first encrypted information.

[0083] Among them, the aggregation platform uses the first symmetric key to encrypt the pre-acquired encryption parameters, and can use the national secret SM4 algorithm, or other symmetric encryption algorithms, which are not specifically limited in this application.

[0084] In one implementation, the convergence platform sends first authentication information to the cryptographic service platform and applies for a first symmetric key;

[0085] The cryptographic service platform authenticates the convergence platform according to the first authentication information; after the convergence platform is successfully authenticated, the cryptographic service platform returns the first symmetric key to the convergence platform.

[0086] That is to say, before the aggregation platform applies for the first symmetric key from the cryptographic service platform, it needs to perform identity authentication first. Only after the identity authentication is passed, the cryptographic service platform will return the first symmetric key to the aggregation platform to further improve the security of the encryption parameters.

[0087] In one implementation, the cryptographic service platform encrypts the first symmetric key based on the key corresponding to the first security medium to obtain a first encryption key; and returns the first encryption key to the convergence platform;

[0088] The convergence platform uses the first security medium to decrypt the first encryption key to obtain a first symmetric key.

[0089] That is to say, the convergence platform has the first security medium Ukey1, which is filled with keys and has functions such as identity authentication and key encryption. The cryptographic service platform has a backup of the keys filled in the first security medium Ukey1.

[0090] In this way, the convergence platform performs identity authentication on the cryptographic service platform, and then applies for the first symmetric key sk1. The first symmetric key sk1 is encrypted and protected by the cryptographic service platform using the key backed up in the first security medium Ukey1 and then issued.

[0091] The convergence platform uses the key in Ukey1 to decrypt the first encryption key to obtain the first symmetric key sk1, and then uses the first symmetric key sk1 to encrypt the encryption parameters respectively to obtain the first encrypted information, which is sent to the gateway management devices CS_1, ..., CS_m respectively.

[0092] In step S12, the gateway management device applies for a first symmetric key and a second symmetric key from the cryptographic service platform; uses the first symmetric key to decrypt the first encrypted information to obtain encryption parameters; uses the second symmetric key to encrypt the encryption parameters to obtain second encrypted information; and sends the second encrypted information to multiple gateways.

[0093] In this step, the gateway management device uses the first symmetric key sk1 to decrypt the first encrypted information to obtain the encryption parameter. Then, the encryption parameter is encrypted using the second symmetric key sk2 to obtain the second encrypted information. The gateway management devices CS_1, ..., CS_m respectively send the second encrypted information to the multiple gateways connected thereto.

[0094] Among them, the gateway management device uses the second symmetric key to encrypt the pre-acquired encryption parameters, and can use the national secret SM4 algorithm, or other symmetric encryption algorithms, which are not specifically limited in this application.

[0095] In one implementation, the gateway management device sends the second authentication information to the cryptographic service platform and applies for the first symmetric key and the second symmetric key;

[0096] The cryptographic service platform authenticates the gateway management device according to the second authentication information; after the gateway management device is successfully authenticated, the first symmetric key and the second symmetric key are returned to the gateway management device.

[0097] That is to say, before the gateway management device applies for the first symmetric key and the second symmetric key from the cryptographic service platform, it needs to perform identity authentication first. Only after the identity authentication is passed, the cryptographic service platform will return the first symmetric key and the second symmetric key to the gateway management device, further improving the security of the encryption parameters.

[0098] In one implementation, the cryptographic service platform encrypts the first symmetric key based on the key corresponding to the second security medium to obtain a second encryption key; and returns the second encryption key to the gateway management device;

[0099] The gateway management device decrypts the second encryption key using the second security medium to obtain the first symmetric key.

[0100] That is to say, the gateway management device has a second security medium Ukey2, which is filled with keys and has functions such as identity authentication and key encryption. The cryptographic service platform has a backup of the keys filled in the second security medium Ukey2.

[0101] In this way, the first symmetric key sk1 is encrypted and protected by the cryptographic service platform using the key backed up in the second security medium Ukey2 and then issued. Similarly, the second symmetric key sk2 is encrypted and protected by the cryptographic service platform using the key backed up in the second security medium Ukey2 and then issued.

[0102] In step S13, the gateway applies for a second symmetric key from the cryptographic service platform; uses the second symmetric key to decrypt the second encrypted information to obtain encryption parameters; performs secret splitting calculations based on the encryption parameters to obtain corresponding secret shares; and returns the secret shares to the gateway management device.

[0103] That is, the gateway applies for the second symmetric key sk2 from the cryptographic service platform, uses the obtained second symmetric key sk2 to decrypt the second encrypted information, and obtains the encryption parameters. Then, the secret splitting calculation is performed based on the encryption parameters to obtain the corresponding secret shares; and the secret shares are returned to the gateway management device.

[0104] In one implementation, the gateway sends the third authentication information to the cryptographic service platform and applies for the second symmetric key;

[0105] The cryptographic service platform authenticates the gateway according to the third authentication information; after the gateway authentication is successful, the second symmetric key is returned to the gateway.

[0106] That is to say, before the gateway applies for the second symmetric key from the cryptographic service platform, it needs to perform identity authentication first. Only after the identity authentication is passed, the cryptographic service platform will return the second symmetric key to the gateway, further improving the security of the encryption parameters.

[0107] In one implementation, the cryptographic service platform encrypts the second symmetric key based on the key corresponding to the third security medium to obtain a third encryption key; and returns the third encryption key to the gateway management device;

[0108] The gateway management device uses the third security medium to decrypt the third encryption key to obtain the second symmetric key.

[0109] Among them, the third security medium can be a hardware encryption card, that is, the second symmetric key sk2 is encrypted and protected by the cryptographic service platform using the key backed up in the hardware encryption card and then issued. After that, the gateway uses sk2 to decrypt the third encryption key to obtain encryption parameters.

[0110] In one implementation, the encryption parameters include a polynomial value array, a number of polynomial terms, and a number of devices of the gateway management device;

[0111] The gateway constructs a polynomial based on the number of polynomial terms and randomly determined polynomial coefficients; determines the number of device values ​​from the polynomial value array, substitutes the determined values ​​into the polynomial, calculates the result value of the polynomial, and uses the values ​​and the corresponding result values ​​as the corresponding secret shares.

[0112] That is to say, the gateway constructs a polynomial based on the number of polynomial terms and randomly determined polynomial coefficients, determines the number of device values ​​from the polynomial value array, substitutes the determined values ​​into the polynomial, and calculates the result value of the polynomial. The value and the corresponding result value are used as the corresponding secret share and returned to the gateway management device.

[0113] Specifically, for each gateway i∈{1,2,…,N}, the secret value to be protected is defined as s i , for each s i , randomly select polynomial coefficients, then the polynomial value array is represented as It is randomly generated by each gateway each time it splits the secret value, and the length of the array is t-1.

[0114] In addition, the encryption parameters also include (t, m), where t represents the number of polynomial terms and m represents the number of gateway management devices. The constructed polynomial is expressed as:

[0115] in,

[0116]

[0117] That is, the secret value s i It is divided into m parts, and the part obtained by each gateway management device CS_j, j∈{1,2,…,m} is the secret s i The value of a polynomial of , the original secret s can be recovered only when at least t gateways cooperate i .

[0118] Each gateway V i ,i∈{1,2,…,N} to split the secret value s i Calculate. i According to the encryption parameters m, t, x[t-1], The number of device values ​​will be determined from the polynomial value array, which are x1, x2, ..., x t , substitute into the polynomial The corresponding result value is calculated and expressed as Where i∈{1,2,…,N}.

[0119] The value and the corresponding result value are used as the corresponding secret share, and each gateway will They are sent to the connected gateway management devices CS_1,…,CS_m respectively.

[0120] In step S14, after receiving the secret value recovery instruction, the gateway management device aggregates the received secret shares to obtain an aggregated result, and returns the aggregated result to the aggregation platform.

[0121] In this step, after each gateway sends the secret share it has calculated to the gateway management device CS_j connected to it, the gateway management device CS_j aggregates the received secret shares after receiving the secret value recovery instruction, obtains the aggregated result CSshare_i, and returns the aggregated result CSshare_i to the aggregation platform.

[0122] In one implementation, the gateway management device adds the result values ​​in the received secret shares to obtain an aggregated result.

[0123] That is, each gateway management device CS_j performs offline calculation locally and adds up all the current results to calculate For example:

[0124] Finally, each gateway management device CS_j calculates CSshare i Sent to the aggregation platform.

[0125] In one implementation, the gateway management device is specifically used to determine the target gateway from at least one gateway managed by itself, retain the secret share returned by the target gateway, and distribute the secret shares returned by other gateways managed by itself except the above-mentioned target gateway to other gateway management devices respectively; aggregate the secret shares retained by itself and distributed by other gateway management devices to obtain an aggregated result.

[0126] That is, each gateway management device CS_j,j∈{1,2,…,m} needs to perform a secret value calculation on the received secret share. CS_j distributes the secret share of one of the target gateways connected to it Keep, iThe remaining m-1 values ​​are distributed to the m-1 gateway management devices corresponding to the remaining numbers.

[0127] For example, the gateway management device can distribute the secret shares returned by the gateways under it according to its own number. For example, if gateway management device CS_1 is connected to gateways V1 and V2, then CS_1 will distribute the secret shares returned by s1. Keep it for yourself Distribute to CS_2,…, Distribute to CS_m; CS_1 distributes s2 Keep it for yourself Distribute to CS_2,…, Distribute to CS_m; and so on.

[0128] In step S15, the aggregation platform reconstructs the aggregation result to obtain a secret value.

[0129] In this step, the aggregation platform can reconstruct the aggregation results to obtain the secret value, thereby protecting the secret value itself from being leaked to the outside, achieving the purpose of making the secret value available but invisible.

[0130] In one implementation, the aggregation platform is specifically used to construct a system of linear equations based on the received aggregation results of no less than the number of polynomial terms, and solve the system of linear equations to obtain the secret value.

[0131] Specifically, the aggregation platform can collect at least t secret shares CSshare1, CSshare2, ..., CSshare t , since the degree of the polynomial does not change, the parameters x[t-1] and t can be used to recover the secret value. According to t equations, t unknowns are solved to construct a t-order linear equation system, where the t-order linear equation system can be expressed as:

[0132]

[0133] The convergence platform solves the coefficients of the linear equations And let x = 0, we can get the reconstructed secret value s = s1 + s2 + ... + s N .

[0134] like Figure 2 The following is a system architecture diagram of the present application. The data aggregation system includes a convergence platform, a gateway management device, and a gateway:

[0135] First, the convergence platform sends the first authentication information to the cryptographic service platform and applies for the first symmetric key. The cryptographic service platform authenticates the convergence platform according to the first authentication information, and returns the first symmetric key to the convergence platform after successful authentication.

[0136] The convergence platform uses the obtained first symmetric key to encrypt the pre-acquired encryption parameters to obtain the first encrypted information. The encryption parameters include the polynomial value array, the number of polynomial terms, and the number of devices of the gateway management device. These parameters are used for subsequent secret splitting calculations.

[0137] Subsequently, the convergence platform sends the first encrypted information to at least one gateway management device.

[0138] The gateway management device receives the first encrypted information sent by the convergence platform. First, the gateway management device sends the second authentication information to the cryptographic service platform and applies for the first symmetric key and the second symmetric key. The cryptographic service platform authenticates the gateway management device according to the second authentication information, and after successful authentication, returns the first symmetric key and the second symmetric key to the gateway management device.

[0139] The gateway management device decrypts the first encrypted information using the acquired first symmetric key to obtain an encryption parameter, then encrypts the encryption parameter using the second symmetric key to obtain second encrypted information, and sends the second encrypted information to multiple gateways.

[0140] After receiving the secret value recovery instruction, the gateway management device aggregates the received secret shares to obtain an aggregated result, and returns the aggregated result to the aggregation platform.

[0141] In order to enhance the security and flexibility of the system, the gateway management device can also determine the target gateway from at least one gateway managed by itself, retain the secret share returned by the target gateway, and distribute the secret shares returned by other gateways managed by itself except the target gateway to other gateway management devices. Then, the secret shares retained by itself and distributed by other gateway management devices are aggregated to obtain an aggregated result.

[0142] The gateway receives the second encrypted information sent by the gateway management device. First, the gateway sends the third authentication information to the cryptographic service platform and applies for the second symmetric key. The cryptographic service platform authenticates the gateway according to the third authentication information, and returns the second symmetric key to the gateway after successful authentication.

[0143] The gateway uses the obtained second symmetric key to decrypt the second encrypted information and obtain the encryption parameter. Then, a polynomial is constructed based on the number of polynomial terms and the randomly determined polynomial coefficients, the number of device values ​​is determined from the polynomial value array, the determined value is substituted into the polynomial, and the result value of the polynomial is calculated. The value and the corresponding result value are used as the corresponding secret share and returned to the gateway management device.

[0144] like Figure 3 The figure shows a flow chart of a specific embodiment of the present application.

[0145] First, the convergence platform defines the number m of connected device management systems, the number t of polynomial terms, and the terms of the polynomial, which are represented by an array as x[t-1]. It can also define the number N of connected gateway nodes.

[0146] For each gateway i∈{1,2,…,N}, the secret value to be protected is defined as s i , for each s i , randomly select polynomial coefficients, and the polynomial coefficients are represented by an array as The length is t-1, and a polynomial is constructed.

[0147] The convergence platform authenticates its identity to the cryptographic service platform, and then applies for the first symmetric key sk1, which is encrypted and protected by the cryptographic service platform using the key backed up in the secure medium Ukey1 and then issued.

[0148] The convergence platform uses the key in Ukey1 for decryption, and uses sk1 to encrypt m, t, and x[t-1] respectively, and then sends them to the gateway management devices CS_1,…,CS_m respectively.

[0149] The gateway management device authenticates its identity to the cryptographic service platform and applies for sk1. Sk1 is encrypted and protected by the cryptographic service platform using the key backed up in the secure medium Ukey2 and then sent down. After that, the gateway management device uses the key in Ukey2 to decrypt sk1 and uses sk1 to decrypt m, t, and x[t-1].

[0150] The gateway management device applies for a second symmetric key sk2 from the cryptographic service platform. Sk2 is encrypted and protected by the cryptographic service platform using the key backed up in the secure medium Ukey2 and then issued. Sk2 is used to encrypt m, t and x[t-1].

[0151] The gateway management devices CS_1, ..., CS_m send the encrypted m, t and x[t-1] to the downstream gateways respectively.

[0152] The gateway authenticates its identity to the cryptographic service platform and applies for sk2. The cryptographic service platform encrypts sk2 using the key backed up in the hardware encryption card and then issues it. Afterwards, the gateway uses sk2 to decrypt m, t, and x[t-1].

[0153] Each gateway V i ,i∈{1,2,…,M} to split the secret value s i Calculate and distribute secret shares to the connected gateway management devices CS_1,…,CS_m.

[0154] Each gateway management device CS_j, j∈{1,2,…,m} performs local offline calculation, adds up all the currently obtained secret shares, and calculates the aggregate result CSshare i Sent to the aggregation platform.

[0155] The aggregation platform collects at least t aggregation results CSshare1, CSshare2, ..., CSshare t , and reconstruct the secret value.

[0156] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0157] Figure 4 The invention is a flow chart of a data aggregation method according to an exemplary embodiment. The data aggregation method is applied to a convergence platform and includes the following steps.

[0158] In step S21, apply for a first symmetric key from a cryptographic service platform;

[0159] In step S22, the pre-acquired encryption parameter is encrypted using the first symmetric key to obtain first encrypted information;

[0160] In step S23, the first encrypted information is sent to at least one gateway management device;

[0161] In step S24, the aggregation result returned by the gateway management device is received, and the aggregation result is reconstructed to obtain a secret value.

[0162] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0163] Figure 5 The present invention is a flow chart showing a data aggregation method according to an exemplary embodiment. The data aggregation method is applied to a gateway management device and includes the following steps.

[0164] In step S31, after receiving the first encrypted information sent by the convergence platform, apply for the first symmetric key and the second symmetric key from the cryptographic service platform;

[0165] In step S32, the first encrypted information is decrypted using the first symmetric key to obtain an encryption parameter, and the encryption parameter is encrypted using the second symmetric key to obtain second encrypted information;

[0166] In step S33, the second encrypted information is sent to multiple gateways, and secret shares returned by the gateways are received;

[0167] In step S34, after receiving the secret value recovery instruction, the received secret shares are aggregated to obtain an aggregated result, and the aggregated result is returned to the aggregation platform.

[0168] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0169] Figure 6 The present invention is a flowchart of a data aggregation method according to an exemplary embodiment. The data aggregation method is applied to a gateway and includes the following steps.

[0170] In step S41, after receiving the second encrypted information sent by the gateway management device, apply for a second symmetric key from the cryptographic service platform;

[0171] In step S42, the second encrypted information is decrypted using the second symmetric key to obtain encryption parameters;

[0172] In step S43, a secret splitting calculation is performed based on the encryption parameter to obtain a corresponding secret share, and the secret share is returned to the gateway management device.

[0173] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0174] The data aggregation method provided in the embodiment of the present application may be executed by a data aggregation device. In the embodiment of the present application, a method in which a data aggregation device executes terminal access is taken as an example to illustrate the device of the data aggregation method provided in the embodiment of the present application.

[0175] Figure 7 The present invention is a block diagram of a data aggregation device according to an exemplary embodiment, which is applied to a convergence platform and includes:

[0176] Application module 501, used to apply for a first symmetric key from a cryptographic service platform;

[0177] The encryption module 502 is used to encrypt the pre-acquired encryption parameter using the first symmetric key to obtain first encrypted information;

[0178] A sending module 503, configured to send the first encrypted information to at least one gateway management device;

[0179] The reconstruction module 504 is used to receive the aggregation result returned by the gateway management device and reconstruct the aggregation result to obtain a secret value.

[0180] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0181] Figure 8 The present invention is a block diagram of a data aggregation device according to an exemplary embodiment, which is applied to a gateway management device, including:

[0182] An application module 601 is used to apply for a first symmetric key and a second symmetric key from a cryptographic service platform after receiving the first encrypted information sent by the convergence platform;

[0183] An encryption module 602 is used to decrypt the first encrypted information using the first symmetric key to obtain an encryption parameter, and encrypt the encryption parameter using the second symmetric key to obtain second encrypted information;

[0184] A sending module 603, configured to send the second encrypted information to multiple gateways, and receive secret shares returned by the gateways;

[0185] The aggregation module 604 is used to aggregate the received secret shares after receiving the secret value recovery instruction, obtain an aggregation result, and return the aggregation result to the aggregation platform.

[0186] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0187] Fig. 9 The present invention is a block diagram of a data aggregation device according to an exemplary embodiment, which is applied to a gateway and includes:

[0188] The application module 701 is used to apply for a second symmetric key from the cryptographic service platform after receiving the second encrypted information sent by the gateway management device;

[0189] A decryption module 702, configured to decrypt the second encrypted information using the second symmetric key to obtain encryption parameters;

[0190] The splitting module 703 is used to perform secret splitting calculation based on the encryption parameter to obtain corresponding secret shares, and return the secret shares to the gateway management device.

[0191] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0192] The data aggregation method provided in the embodiment of the present application can be executed by a terminal access terminal. In the embodiment of the present application, a method in which a terminal access terminal performs terminal access is taken as an example to illustrate the device of the data aggregation method provided in the embodiment of the present application.

[0193] The data aggregation device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than a terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtual reality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0194] The data aggregation device provided in the embodiment of the present application can achieve Figures 4 to 6 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0195] Alternatively, if Fig.10 As shown, an embodiment of the present application also provides an electronic device 800, including a processor 801 and a memory 802, wherein the memory 802 stores programs or instructions that can be executed on the processor 801, and when the program or instructions are executed by the processor 801, the various steps of the above-mentioned data aggregation method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0196] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0197] Fig.11 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0198] The electronic device 1000 includes but is not limited to: a radio frequency unit 1001, a network module 1002, an audio output unit 1003, an input unit 1004, a sensor 1005, a display unit 1006, a user input unit 1007, an interface unit 1008, a memory 1009, and a processor 1010 and other components.

[0199] Those skilled in the art will appreciate that the electronic device 1000 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 1010 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Fig.11 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0200] As can be seen from the above, in the embodiment of this scheme, secrets are shared between the gateways. The secret value can be restored by aggregating and reconstructing the secret shares provided by each gateway. At the same time, the encryption parameters are encrypted by the first symmetric key and the second symmetric key during the process of being passed to each gateway to protect the secret value itself from being leaked to the outside, thereby achieving the purpose of making the secret value available and invisible, while ensuring data security and privacy protection between the participants, which can greatly improve the efficiency of cross-platform communication and computing.

[0201] It should be understood that in the embodiment of the present application, the input unit 1004 may include a graphics processor (Graphics Processing Unit, GPU) 10041 and a microphone 10042, and the graphics processor 10041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 1006 may include a display panel 10061, and the display panel 10061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 1007 includes a touch panel 10071 and at least one of other input devices 10072. The touch panel 10071 is also called a touch screen. The touch panel 10071 may include two parts: a touch detection device and a touch controller. Other input devices 10072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0202] The memory 1009 can be used to store software programs and various data. The memory 1009 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory 1009 may include a volatile memory or a non-volatile memory, or the memory 1009 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory 109 in the embodiment of the present application includes but is not limited to these and any other suitable types of memory.

[0203] The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor 1010.

[0204] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned data aggregation method embodiment are implemented and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0205] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0206] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned data aggregation method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0207] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0208] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned data aggregation method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0209] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0210] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0211] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A data aggregation system, characterized in that: The system comprises: The convergence platform is used to apply for a first symmetric key from the cryptographic service platform; encrypt the pre-acquired encryption parameters using the first symmetric key to obtain first encrypted information; and send the first encrypted information to at least one gateway management device; The gateway management device is used to apply for the first symmetric key and the second symmetric key from the cryptographic service platform; decrypt the first encrypted information using the first symmetric key to obtain the encryption parameter; encrypt the encryption parameter using the second symmetric key to obtain the second encrypted information; and send the second encrypted information to multiple gateways; The gateway is configured to apply for the second symmetric key from the cryptographic service platform; decrypt the second encrypted information using the second symmetric key to obtain the encryption parameter; perform secret splitting calculation based on the encryption parameter to obtain a corresponding secret share; and return the secret share to the gateway management device; The gateway management device is further configured to aggregate the received secret shares after receiving the secret value recovery instruction to obtain an aggregation result, and return the aggregation result to the aggregation platform; The aggregation platform is also used to reconstruct the aggregation result to obtain a secret value.

2. The data aggregation system according to claim 1, characterized in that: The convergence platform is specifically used to send the first authentication information to the cryptographic service platform and apply for the first symmetric key; The cryptographic service platform is used to authenticate the convergence platform according to the first authentication information; after the convergence platform is successfully authenticated, return the first symmetric key to the convergence platform.

3. The data aggregation system according to claim 2, characterized in that: The cryptographic service platform is specifically configured to encrypt the first symmetric key based on the key corresponding to the first security medium to obtain a first encryption key; and return the first encryption key to the convergence platform; The convergence platform is further configured to use the first security medium to decrypt the first encryption key to obtain the first symmetric key.

4. The data aggregation system according to claim 1, characterized in that: The gateway management device is specifically used to send the second authentication information to the cryptographic service platform and apply for the first symmetric key and the second symmetric key; The cryptographic service platform is used to authenticate the gateway management device according to the second authentication information; After the gateway management device is successfully authenticated, the first symmetric key and the second symmetric key are returned to the gateway management device.

5. The data aggregation system according to claim 4, characterized in that: The cryptographic service platform is specifically configured to encrypt the first symmetric key based on the key corresponding to the second security medium to obtain a second encryption key; and return the second encryption key to the gateway management device; The gateway management device is further configured to use the second security medium to decrypt the second encryption key to obtain the first symmetric key.

6. The data aggregation system according to claim 1, characterized in that: The gateway is specifically used to send the third authentication information to the cryptographic service platform and apply for the second symmetric key; The cryptographic service platform is used to authenticate the gateway according to the third authentication information; After the gateway authentication succeeds, the second symmetric key is returned to the gateway.

7. The data aggregation system according to claim 6, characterized in that: The cryptographic service platform is specifically configured to encrypt the second symmetric key based on the key corresponding to the third security medium to obtain a third encryption key; and return the third encryption key to the gateway management device; The gateway management device is further configured to use the third security medium to decrypt the third encryption key to obtain the second symmetric key.

8. The data aggregation system according to claim 1, characterized in that: The encryption parameters include a polynomial value array, the number of polynomial terms, and the number of devices of the gateway management device; The gateway is specifically used to construct a polynomial based on the number of polynomial terms and randomly determined polynomial coefficients; determine the number of device values ​​from the polynomial value array, substitute the determined value into the polynomial, calculate the result value of the polynomial, and use the value and the corresponding result value as the corresponding secret share.

9. The data aggregation system according to claim 8, characterized in that: The gateway management device is specifically used to add the result values ​​in the received secret shares to obtain an aggregated result.

10. The data aggregation system according to claim 9, characterized in that: The aggregation platform is specifically used to construct a system of linear equations based on the received aggregation results that are not less than the number of polynomial terms, and solve the system of linear equations to obtain a secret value.

11. The data aggregation system according to claim 1, characterized in that: The gateway management device is specifically used to determine the target gateway from at least one gateway managed by itself, retain the secret share returned by the target gateway, and distribute the secret shares returned by other gateways managed by itself except the above-mentioned target gateway to other gateway management devices respectively; aggregate the secret shares retained by itself and distributed by other gateway management devices to obtain an aggregated result.

12. A data aggregation method, characterized in that: Applied to the convergence platform, the method comprises: Apply for the first symmetric key from the cryptographic service platform; Encrypting the pre-acquired encryption parameter using the first symmetric key to obtain first encrypted information; sending the first encrypted information to at least one gateway management device; The aggregation result returned by the gateway management device is received, and the aggregation result is reconstructed to obtain a secret value.

13. A data aggregation method, characterized in that: Applied to a gateway management device, the method comprises: After receiving the first encrypted information sent by the convergence platform, apply for the first symmetric key and the second symmetric key from the cryptographic service platform; Decrypting the first encrypted information using the first symmetric key to obtain an encryption parameter, and encrypting the encryption parameter using the second symmetric key to obtain second encrypted information; Sending the second encrypted information to multiple gateways, and receiving secret shares returned by the gateways; After receiving the secret value recovery instruction, the received secret shares are aggregated to obtain an aggregated result, and the aggregated result is returned to the aggregation platform.

14. A data aggregation method, characterized in that: Applied to a gateway, the method comprises: After receiving the second encrypted information sent by the gateway management device, apply for a second symmetric key from the cryptographic service platform; Decrypting the second encrypted information using the second symmetric key to obtain encryption parameters; A secret split calculation is performed based on the encryption parameter to obtain a corresponding secret share, and the secret share is returned to the gateway management device.

15. A data aggregation device, characterized in that: Applied to a convergence platform, the device comprises: An application module, used for applying for a first symmetric key from a cryptographic service platform; An encryption module, used to encrypt the pre-acquired encryption parameter using the first symmetric key to obtain first encrypted information; A sending module, used for sending the first encrypted information to at least one gateway management device; The reconstruction module is used to receive the aggregation result returned by the gateway management device and reconstruct the aggregation result to obtain a secret value.

16. A data aggregation device, characterized in that: Applied to a gateway management device, the device comprises: An application module, configured to apply for a first symmetric key and a second symmetric key from a cryptographic service platform after receiving the first encrypted information sent by the convergence platform; an encryption module, configured to decrypt the first encrypted information using the first symmetric key to obtain an encryption parameter, and encrypt the encryption parameter using the second symmetric key to obtain second encrypted information; A sending module, used for sending the second encrypted information to a plurality of gateways, and receiving secret shares returned by the gateways; The aggregation module is used to aggregate the received secret shares after receiving the secret value recovery instruction, obtain an aggregation result, and return the aggregation result to the aggregation platform.

17. A data aggregation device, characterized in that: Applied to a gateway, the device comprises: An application module, configured to apply for a second symmetric key from the cryptographic service platform after receiving the second encrypted information sent by the gateway management device; A decryption module, used to decrypt the second encrypted information using the second symmetric key to obtain encryption parameters; The splitting module is used to perform secret splitting calculation based on the encryption parameter to obtain corresponding secret shares and return the secret shares to the gateway management device.

18. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the data aggregation method as described in any one of claims 12, 13, and 14.

19. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the data aggregation method according to any one of claims 12, 13, and 14 are implemented.

20. A computer program product, the program product being stored in a storage medium, and the program product being executed by at least one processor to implement the data aggregation method according to any one of claims 12, 13, and 14.

Images