Data processing method and device, electronic equipment and storage medium

Abstract

The invention provides a data processing method, system and device and a storage medium. And the end side device encrypts the data to be transmitted through the first symmetric key, and encrypts the first symmetric key through the first public key to obtain the symmetric key ciphertext. Therefore, the first symmetric key is not easy to leak, an attacker is not easy to acquire plaintext to-be-transmitted data, and the security of the to-be-transmitted data is guaranteed. In addition, the end side device performs key conversion on the symmetric key ciphertext through the re-encryption key to obtain a first re-encryption key ciphertext. In this way, the receiver (edge server) of the first encryption key ciphertext can decrypt the secret key through the private key of the edge server, the secret key for encrypting the to-be-transmitted data is obtained, and then the to-be-transmitted data is obtained. According to the scheme, the data security of the to-be-transmitted data can be ensured, the edge server can easily obtain the to-be-transmitted data, and the situation that other servers re-encrypt the to-be-transmitted data and then obtain the plaintext re-encrypted data of the to-be-transmitted data is avoided.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method, device, electronic device and storage medium for processing data in the field of computer technology. Background Art

[0002] With the popularization of mobile Internet, the number of terminal devices has grown rapidly. People apply terminal devices to scenarios that require computing resources, such as image processing, speech recognition, and target detection. However, the computing power of terminal devices is often limited. In order to reduce the energy consumption of terminal devices and improve computing efficiency to achieve more efficient and intelligent data processing, computing offloading technology has emerged. Computing offloading technology refers to a technology that transfers the computing tasks of terminal devices to edge servers.

[0003] In the existing computing offloading process, the terminal device usually transmits the offloading data directly to the edge server in plain text. After the edge server calculates the received offloading data, it returns the calculation result to the terminal device. This may cause the offloading data to be attacked and eavesdropped during the computing offloading process, and there is a risk of data leakage in the offloading data.

[0004] Therefore, a method for processing data is urgently needed to ensure the security and privacy of offloaded data during the computation offloading process. Summary of the invention

[0005] The present application provides a method, device, system and storage medium for processing data, which can ensure the data security of data to be transmitted and enable an edge server to easily obtain the data to be transmitted.

[0006] In a first aspect, a method for processing data is provided, which is executed by an end-side device, and the method includes: encrypting data to be transmitted by the end-side device by using a first symmetric key to obtain a first data ciphertext; encrypting the first symmetric key by using a first public key of the end-side device to obtain a symmetric key ciphertext; performing key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encryption key ciphertext, wherein the first re-encryption key ciphertext is a ciphertext that can be decrypted by a second private key of an edge server; and sending the first data ciphertext and the first re-encryption key ciphertext to the edge server.

[0007] In the above technical solution, the end-side device encrypts the data to be transmitted by using the first symmetric key, and encrypts the first symmetric key by using the first public key to obtain a symmetric key ciphertext. This makes the first symmetric key not easy to leak. When the first symmetric key is not easy to leak, it is even more difficult for the attacker to obtain the original data to be transmitted, thereby ensuring the security of the data to be transmitted. In addition, after the end-side device learns the edge server to which the data to be transmitted will be transmitted, the end-side device performs a key conversion (re-encryption key conversion) on the symmetric key ciphertext by using the re-encryption key to obtain the first re-encrypted key ciphertext (re-encrypted key ciphertext). This enables the recipient (edge ​​server) of the re-encrypted key ciphertext to decrypt it using its own private key, obtain the key used to encrypt the data to be transmitted, and then obtain the data to be transmitted. In other words, this solution can not only ensure the data security of the data to be transmitted, but also enable the edge server to easily obtain the data to be transmitted. It can also avoid the need for other servers to re-encrypt the data to be transmitted during the transmission process and then obtain the plaintext re-encrypted data of the data to be transmitted. It can also avoid the first symmetric key being obtained by the intermediate server during the transmission process and then decrypting the data to be transmitted through the re-encryption key (proxy re-encryption symmetric key).

[0008] In combination with the first aspect, in some possible implementations, the first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key, and the symmetric key ciphertext is converted by the re-encryption key to obtain the first re-encryption key ciphertext, including: decrypting the symmetric key ciphertext by the first private key to obtain the first symmetric key; encrypting the first symmetric key by the second public key to obtain the first re-encryption key ciphertext.

[0009] In the above technical solution, the end-side device decrypts the symmetric key ciphertext by using the first private key to obtain the first symmetric key; and then encrypts the first symmetric key by using the second public key to obtain the first re-encrypted key ciphertext. In other words, the end-side device re-encrypts the first symmetric key by using the second public key of the edge server, which enables the edge server to decrypt the received re-encrypted key ciphertext by using its own second private key. In other words, the first symmetric key can be prevented from being leaked easily, so that the edge server can obtain the data to be transmitted that has not been tampered with.

[0010] In combination with the first aspect and the above-mentioned implementation methods, in some possible implementation methods, the method also includes: generating a target hash value through the first symmetric key and the corresponding key version identifier, wherein the target hash value is used to perform key verification on the first symmetric key; and sending the target hash value to the blockchain system.

[0011] In the above technical solution, the end-side device generates a target hash value based on the first symmetric key and the corresponding key version identifier, and stores the target hash value in the blockchain system. In other words, the encrypted data ciphertext (including the data to be transmitted) and the re-encrypted key ciphertext are stored in the end-side device or cloud storage, and the target hash value corresponding to the first symmetric key is stored in the blockchain system to ensure the consistency of the stored data (data to be transmitted) and solve the problem of tampering of the data to be transmitted in a single cloud storage.

[0012] In a second aspect, a method for processing data is provided, which is executed by an edge server, and the method includes: obtaining a second data ciphertext and a second re-encryption key ciphertext, the second data ciphertext being obtained after an end-side device encrypts the data to be transmitted of the end-side device by using a first symmetric key, the second re-encryption key ciphertext being obtained after the end-side device performs key conversion on the symmetric key ciphertext by using the re-encryption key, and the symmetric key ciphertext being obtained after the end-side device encrypts the first symmetric key by using a first public key; decrypting the second re-encryption key ciphertext by using the second private key of the edge server to obtain a third key; decrypting the second data ciphertext by using the third key to obtain the data to be transmitted.

[0013] In the above technical solution, after the edge server obtains the second data ciphertext (data ciphertext) and the second re-encryption key ciphertext (re-encryption key ciphertext), it decrypts the re-encryption key ciphertext with its own second private key to obtain the third key. Then, the data ciphertext is decrypted with the third key to obtain the data to be transmitted. In other words, the solution enables the edge server to decrypt the re-encryption key ciphertext and obtain the data to be transmitted based on the decrypted key (third key), while other attackers cannot steal and tamper with the data to be transmitted, so that the edge server obtains the original data to be transmitted.

[0014] In combination with the second aspect, in some possible implementations, the second-encrypted key ciphertext carries the key version identifier corresponding to the third key, and before the second data ciphertext is decrypted by the third key to obtain the data to be transmitted, the method also includes: obtaining a target hash value from the blockchain system, and the target hash value is used to perform key verification on the third key; verifying the third key based on the third key and the corresponding key version identifier, and the target hash value; and if the third key verification passes, executing the step of decrypting the second data ciphertext by the third key to obtain the data to be transmitted.

[0015] In the above technical solution, the edge server can obtain the second data ciphertext and the second encrypted key ciphertext from the end-side device or cloud storage; decrypt the second encrypted key ciphertext by the second private key to obtain the third key; verify the third key by the third key and the corresponding key version identifier, as well as the target hash value, and when the third key verification is passed, decrypt the second data ciphertext by the third key to obtain the data to be transmitted. This process can ensure that the edge server will continue to decrypt the second data ciphertext by the third key to obtain the data to be transmitted when the accurate third key is obtained (the third key verification is passed). To a certain extent, this solution can ensure that the edge server obtains the complete data to be transmitted.

[0016] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, the third key is verified based on the third key and the corresponding key version identifier, and the target hash value, including: generating a first hash value based on the third key and the corresponding key version identifier; when the first hash value is the same as the target hash value, determining that the third key verification succeeds; when the first hash value is different from the target hash value, determining that the third key verification fails.

[0017] In the above technical solution, a process of verifying the third key is described. Specifically, the edge server generates a first hash value through the third key and the corresponding key version identifier; and compares the first hash value with the target hash value. When the first hash value is the same as the target hash value, it indicates that the third key is the same as the first symmetric key, and the edge server determines that the third key verification is passed, the first symmetric key has not been tampered with by the attacker, and the second data ciphertext can be decrypted by the third key to obtain the complete data to be transmitted. Otherwise, the edge server determines that the third key verification fails.

[0018] In combination with the second aspect and the above-mentioned implementation methods, in some possible implementation methods, before obtaining the second data ciphertext and the second re-encryption key ciphertext, the method also includes: obtaining the first public key and the corresponding key version identifier of the end-side device; determining whether the second private key corresponding to the first public key exists in the cache of the edge server, and whether the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; if the second private key exists in the cache and the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, execute the steps of obtaining the second data ciphertext and the second re-encryption key ciphertext.

[0019] In the above technical solution, before obtaining the second data ciphertext and the second re-encryption key ciphertext, the edge server determines whether it has the ability to decrypt the re-encryption key ciphertext and the data ciphertext to be obtained. When the edge server determines that there is a second private key corresponding to the first public key in its own cache, and the key version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, it determines that it has the ability to decrypt the re-encryption key ciphertext and the data ciphertext; and then obtains the second data ciphertext and the second re-encryption key ciphertext. This process can avoid the situation where the second data ciphertext and the second re-encryption key ciphertext are obtained when there is no second private key on the edge server, or when there is a second private key but the key version identifier corresponding to the second private key does not match the key version identifier corresponding to the first public key, thereby occupying the memory resources of the edge server.

[0020] In a third aspect, a system for processing data is provided, the system comprising an end-side device and an edge server; the end-side device is used to: encrypt data to be transmitted by the end-side device by using a first symmetric key to obtain a first data ciphertext; encrypt the first symmetric key by using a first public key of the end-side device to obtain a symmetric key ciphertext; perform key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encryption key ciphertext, the first re-encryption key ciphertext being a ciphertext that can be decrypted by a second private key of the edge server; send the first data ciphertext and the first re-encryption key ciphertext to the edge server; the edge server is used to: obtain Take the second data ciphertext and the second re-encryption key ciphertext sent by the end-side device, the second data ciphertext corresponds to the first data ciphertext, the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted by using the first symmetric key, the second re-encryption key ciphertext corresponds to the first re-encryption key ciphertext, the second re-encryption key ciphertext is obtained after the end-side device converts the symmetric key ciphertext by the re-encryption key, decrypts the second re-encryption key ciphertext by the second private key of the edge server to obtain the third key; decrypts the second data ciphertext by the third key to obtain the data to be transmitted.

[0021] In a fourth aspect, a device for processing data is provided, which is installed in an end-side device, and includes: an encryption module, used to: encrypt the data to be transmitted of the end-side device by using a first symmetric key to obtain a first data ciphertext; encrypt the first symmetric key by using a first public key of the end-side device to obtain a symmetric key ciphertext; a conversion module, used to perform key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encrypted key ciphertext, and the first re-encrypted key ciphertext is a ciphertext that can be decrypted by a second private key of an edge server; and a sending module, used to send the first data ciphertext and the first re-encrypted key ciphertext to the edge server.

[0022] In combination with the fourth aspect, in some possible implementations, the first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key, and the conversion module is specifically used to: decrypt the symmetric key ciphertext by using the first private key to obtain the first symmetric key; and encrypt the first symmetric key by using the second public key to obtain the first re-encryption key ciphertext.

[0023] In combination with the fourth aspect and the above-mentioned implementation methods, in some possible implementation methods, the device also includes: a generation module, used to generate a target hash value through the first symmetric key and the corresponding key version identifier, and the target hash value is used to perform key verification on the first symmetric key; the sending module is also used to send the target hash value to the blockchain system.

[0024] In a fifth aspect, a device for processing data is provided, which is installed in an edge server, and includes: an acquisition module, used to obtain a second data ciphertext and a second re-encryption key ciphertext, the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted of the end-side device by using the first symmetric key, the second re-encryption key ciphertext is obtained after the end-side device converts the symmetric key ciphertext by using the re-encryption key, and the symmetric key ciphertext is obtained after the end-side device encrypts the first symmetric key by using the first public key; a decryption module, used to: decrypt the second re-encryption key ciphertext by using the second private key of the edge server to obtain a third key; decrypt the second data ciphertext by using the third key to obtain the data to be transmitted.

[0025] In combination with the fifth aspect, in some possible implementations, the second-encrypted key ciphertext carries the key version identifier corresponding to the third key, and before the second data ciphertext is decrypted by the third key to obtain the data to be transmitted, the acquisition module is also used to obtain a target hash value from the blockchain system, and the target hash value is used to perform key verification on the third key; the device also includes: a verification module, which is used to verify the third key based on the third key and the corresponding key version identifier, and the target hash value; the decryption module is also used to execute the step of decrypting the second data ciphertext by the third key to obtain the data to be transmitted when the third key verification is passed.

[0026] In combination with the fifth aspect and the above-mentioned implementation methods, in some possible implementation methods, the verification module is specifically used to: generate a first hash value based on the third key and the corresponding key version identifier; when the first hash value is the same as the target hash value, determine that the third key verification is passed; when the first hash value is different from the target hash value, determine that the third key verification is failed.

[0027] In combination with the fifth aspect and the above-mentioned implementation methods, in some possible implementation methods, before obtaining the second data ciphertext and the second re-encryption key ciphertext, the acquisition module is also used to obtain the first public key and the corresponding key version identifier of the end-side device; the device also includes: a determination module, used to determine whether the second private key corresponding to the first public key exists in the cache of the edge server, and whether the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; the acquisition module is also used to execute the step of obtaining the second data ciphertext and the second re-encryption key ciphertext when the second private key exists in the cache and the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key.

[0028] In a sixth aspect, a computer-readable storage medium is provided, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes the method in the first aspect or any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a structural diagram of a system for transmitting data to be transmitted provided in an embodiment of the present application;

[0030] Figure 2 is a schematic flow chart of a method for processing data provided in an embodiment of the present application;

[0031] Figure 3 It is a schematic diagram of a flow chart of envelope encryption of data to be transmitted provided by an embodiment of the present application;

[0032] Figure 4 is a schematic flow chart of another method for processing data provided in an embodiment of the present application;

[0033] Figure 5 It is a schematic diagram of a process for obtaining a second data ciphertext and a second encryption key ciphertext provided by an embodiment of the present application;

[0034] Figure 6 It is a schematic diagram of a process of verifying a third key provided in an embodiment of the present application;

[0035] Figure 7 This is a schematic diagram of a process for post-processing data to be transmitted by an edge server provided in an embodiment of the present application;

[0036] Figure 8 is a structural diagram of a system for processing data provided in an embodiment of the present application;

[0037] Fig. 9 is a structural schematic diagram of a device for processing data provided in an embodiment of the present application;

[0038] Fig.10 is a schematic diagram of the structure of another device for processing data provided in an embodiment of the present application;

[0039] Fig.11 is a structural schematic diagram of a terminal side device provided in an embodiment of the present application;

[0040] Fig.12 It is a structural diagram of an edge server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, "multiple" means two or more than two. The terms "first" and "second" are used for descriptive purposes only and should not be understood as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0042] With the development of mobile Internet, the number of end-side devices has grown rapidly. People apply end-side devices to various computing scenarios, such as image processing, speech recognition, and target detection. However, the computing power of end-side devices is often limited. In order to improve computing efficiency and reduce the energy consumption of end-side devices, related technologies propose to assign computing tasks of end-side devices to edge servers with stronger computing power. After the edge server completes the computing task, it returns the processing result to the end-side device.

[0043] Figure 1 It is a structural diagram of a system for transmitting data to be transmitted provided in an embodiment of the present application.

[0044] For example, Figure 1 As shown, the system includes a terminal device and an edge server. The terminal device encrypts the data to be transmitted that needs to participate in the computing task by using the encryption key A to obtain the data ciphertext; the terminal device then transmits the data ciphertext to the edge server. The edge server decrypts the data ciphertext by using the decryption key B corresponding to the encryption key A to obtain the data to be transmitted.

[0045] However, in the process of transmitting the encrypted data, the encrypted data is easily invaded by attackers, and the attackers can easily steal the data to be transmitted and tamper with the data to be transmitted. Therefore, how to achieve the secure transmission of the data to be transmitted is an urgent problem to be solved.

[0046] Figure 2 It is a schematic flowchart of a method for processing data provided in an embodiment of the present application.

[0047] It should be understood that the method for processing data provided in the embodiment of the present application can be applied to Figure 1 The terminal side device shown. The terminal side device refers to various intelligent devices at the user end and with computing capabilities. The user end corresponds to the server end and can provide program codes for local services to users. In some embodiments, the terminal side device includes any one of intelligent devices with data processing capabilities such as personal computers, tablet computers, handheld devices, and vehicle-mounted devices.

[0048] For example, Figure 2 As shown, the method 200 includes:

[0049] In step 201, the terminal device encrypts the data to be transmitted of the terminal device by using a first symmetric key to obtain a first data ciphertext.

[0050] In some embodiments, step 201 can be implemented by a symmetric encryption algorithm, which symmetric encryption algorithm includes any one of the Data Encryption Standard (DES), Triple Data Encryption Algorithm (TDEA), Advanced Encryption Standard (AES), RC (Rivest Code) algorithm and International Data Encryption Algorithm (IDEA).

[0051] It should be understood that the private key is kept confidential and is only disclosed to the end-side device.

[0052] In some embodiments, step 201 includes: the terminal device determines the first data ciphertext by the following formula (1);

[0053] DataEncrypt(Data,S k,DEV )→(C D,1 ) (1)

[0054] Among them, Data is used to indicate the data to be transmitted, S k,DEV Used to indicate the first symmetric key, C D,1 Used to indicate the first data ciphertext, DataEncrypt() is used to encrypt any data to be transmitted.

[0055] It should be understood that the "first public key" is public and provided to other devices that need to communicate with the end-side device, and the "first private key" is confidential and only disclosed to the end-side device.

[0056] In step 202, the terminal device encrypts the first symmetric key by using the first public key of the terminal device to obtain a symmetric key ciphertext.

[0057] In some embodiments, after the end-side device obtains the symmetric key ciphertext, the end-side device may upload the key version identifier corresponding to the first symmetric key to the cloud storage system for storage in the cloud storage system.

[0058] In a possible implementation, before step 202, the method 200 also includes: the terminal device generates a target hash value through the first symmetric key and the corresponding key version identifier, and the target hash value is used to perform key verification on the first symmetric key; the terminal device sends the target hash value to the blockchain system.

[0059] It should be understood that the key version identifier corresponding to the first symmetric key is used to indicate the version of the first symmetric key. After the first symmetric key is modified, the key version identifier corresponding to the first symmetric key will also be modified.

[0060] In the above technical solution, the end-side device generates a target hash value based on the first symmetric key and the corresponding key version identifier, and stores the target hash value in the blockchain system. In other words, the encrypted data ciphertext (including the data to be transmitted) and the re-encrypted key ciphertext are stored in the end-side device or cloud storage system, and the target hash value corresponding to the first symmetric key is stored in the blockchain system to ensure the consistency of the stored data (data to be transmitted) and solve the problem of tampering of the data to be transmitted in a single cloud storage.

[0061] Regarding the solution in which the end-side device in the above-mentioned solution generates a target hash value and stores the target hash value in the blockchain system, a trusted distributed computing offloading method based on blockchain is mentioned in the comparative document D1 (CN115981807A). The method describes the process in which a user or edge computing service provider signs a hash value, a timestamp, and an encrypted identity information according to its own private key, and stores the signed hash value, a timestamp, and an encrypted identity information index in the on-duty node of the alliance chain. However, D1 does not discuss the issue of how to improve the transmission security of the data to be transmitted. With regard to this issue, the first symmetric key in the present application does not need to be transmitted through other secure channels, thereby enhancing security. In addition, the data to be transmitted in the present application does not need to be re-encrypted, and the data ciphertext does not need to be re-shared or transmitted, thereby accelerating the transmission efficiency of the data to be transmitted.

[0062] In some embodiments, the method for the end-side device to determine the symmetric key ciphertext and the target hash value includes: the end-side device determines the symmetric key ciphertext and the target hash value by the following formula (2);

[0063] KeyEncrypt(ID DEV ,S k,DEV ,VN)→(C SK,DEV ,Hash Sk,DEV ) (2)

[0064] Among them, ID DEV It is used to indicate the first public key, specifically, the public key ID of the end-side device DEV, S k,DEV is used to indicate the first symmetric key, VN is used to indicate the key version identifier corresponding to the first symmetric key, C Sk,DEV Used to indicate the symmetric key ciphertext, Hash Sk,DEV Used to indicate the target hash value, KeyEncrypt() is used to encrypt any symmetric key and generate the hash value corresponding to the symmetric key.

[0065] It should be understood that envelope encryption is an encryption method that protects data security during data transmission. The principle of envelope encryption is to divide the data to be transmitted into two levels of encryption. The first encryption level is called the data key layer, which means that the data to be transmitted is encrypted using a symmetric key. The second encryption level is called the master key layer, which uses another key to encrypt the symmetric key. In this way, stronger data security can be achieved through the combination of the two encryption levels. It should also be understood that the first symmetric key in this application is equivalent to the symmetric key in the first encryption level, and the first public key in this application is equivalent to another key in the second encryption level. Therefore, the encryption process of the end-side device for the data to be transmitted in this application conforms to the envelope encryption process.

[0066] Figure 3 It is a schematic diagram of a flow chart of envelope encryption of data to be transmitted provided in an embodiment of the present application.

[0067] For example, Figure 3As shown, the end-side device detects whether there is a first symmetric key in its own cache, and when the first symmetric key exists, the first symmetric key does not need to be updated (the first symmetric key has been used to encrypt the data to be transmitted and the target hash value corresponding to the first symmetric key is stored in the blockchain system); when the first symmetric key does not exist in the cache or the first symmetric key needs to be updated, the end-side device generates a first symmetric key and a corresponding key version identifier; the end-side device encrypts the data to be transmitted by the first symmetric key to obtain a first data ciphertext, and uploads the first data ciphertext to the cloud storage system; the end-side device encrypts the first symmetric key by the first public key to obtain a symmetric key ciphertext, and uploads the key version identifier corresponding to the first symmetric key to the cloud storage system; the end-side device generates a target hash value based on the first symmetric key and the corresponding key version identifier, and uploads the target hash value to the blockchain system for storage in the blockchain system. When the first symmetric key exists in the cache and the first symmetric key does not need to be updated, the end-side device performs the step of encrypting the data to be transmitted by the first symmetric key to obtain the first data ciphertext.

[0068] In step 203, the terminal device performs key conversion on the symmetric key ciphertext by using the re-encryption key to obtain a first re-encryption key ciphertext, where the first re-encryption key ciphertext is a ciphertext that can be decrypted by the second private key of the edge server.

[0069] It should be understood that the "the end-side device performs key conversion on the symmetric key ciphertext through the re-encryption key to obtain the first re-encryption key ciphertext" in the above step 203 can be simply understood as: the ciphertext originally encrypted by the first public key with the first symmetric key is converted into the ciphertext encrypted by the second public key of the edge server with the first symmetric key, and the first re-encryption key ciphertext is obtained. In this regard, the first re-encryption key ciphertext can be decrypted by the second private key of the edge server, wherein the second public key corresponds to the second private key. The correspondence between the second public key and the second private key can be simply understood as: the ciphertext encrypted by the second public key can be decrypted by the second private key.

[0070] In some embodiments, the method for determining a re-encryption key by an end-side device includes: the end-side device determines the re-encryption key by the following formula (3);

[0071] RekeyGen(S k,DEV ,ID ES )→(Rekey DEV→ES ) (3)

[0072] Among them, ID ES The second public key ID, S, used to indicate the edge server ES k,DEV Used to indicate the first symmetric key, Rekey DEV→ESUsed to indicate the re-encryption key, which refers to converting the ciphertext originally encrypted by the first public key of the end-side device DEV to the ciphertext encrypted by the second public key of the edge server ES. RekeyGen() is used to generate the re-encryption key.

[0073] In one possible implementation, the first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key. Step 203 includes: the end-side device decrypts the symmetric key ciphertext by using the first private key to obtain the first symmetric key; the end-side device encrypts the first symmetric key by using the second public key to obtain the first re-encryption key ciphertext.

[0074] In the above technical solution, the end-side device decrypts the symmetric key ciphertext by using the first private key to obtain the first symmetric key; and then encrypts the first symmetric key by using the second public key to obtain the first re-encrypted key ciphertext. In other words, the end-side device re-encrypts the first symmetric key by using the second public key of the edge server, which enables the edge server to decrypt the received re-encrypted key ciphertext by using its own second private key. In other words, the first symmetric key can be prevented from being leaked easily, so that the edge server can obtain the data to be transmitted that has not been tampered with.

[0075] In some embodiments, step 203 includes: the end-side device determines the first re-encryption key ciphertext by the following formula (4);

[0076]

[0077] in, Used to indicate the symmetric key ciphertext, Rekey DEV→ES Used to indicate the re-encryption key, C RSK,1 It is used to indicate the first re-encryption key ciphertext, and ReEncrypt() is used to generate the re-encryption key ciphertext.

[0078] Step 204: The end-side device sends the first data ciphertext and the first re-encryption key ciphertext to the edge server.

[0079] In some embodiments, before step 204, in some embodiments, before step 201, the method 200 also includes: the end-side device registers its identity in the blockchain system through a smart contract in the blockchain system, and the blockchain system allocates the corresponding edge server to the end-side device through the smart contract, and the smart contract is a contract stored in the blockchain system and written in the form of program code.

[0080] In some embodiments, step 204 includes: the end-side device uploads the first data ciphertext and the first re-encryption key ciphertext to the cloud storage system, and the edge server obtains the first data ciphertext and the first re-encryption key ciphertext from the cloud storage system.

[0081] In the above technical solution, the terminal device uploads the first data ciphertext and the first re-encryption key ciphertext to the cloud storage system, so that other edge servers can obtain the first data ciphertext and the first re-encryption key ciphertext, obtain the data to be transmitted, and perform calculations on the data to be transmitted, so as to improve the computing efficiency and reduce the energy consumption of the terminal device.

[0082] Figure 4 It is a schematic flowchart of a method for processing data provided in an embodiment of the present application.

[0083] It should be understood that the method for processing data provided in the embodiment of the present application can be applied to Figure 1 The edge server shown in the figure is a server that is close to the user end and has strong computing power.

[0084] For example, Figure 4 As shown, the method 400 includes:

[0085] In step 401, the edge server obtains a second data ciphertext and a second re-encryption key ciphertext, the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted of the end-side device through the first symmetric key, the second re-encryption key ciphertext is obtained after the end-side device converts the symmetric key ciphertext through the re-encryption key, and the symmetric key ciphertext is obtained after the end-side device encrypts the first symmetric key through the first public key.

[0086] It should be understood that the "second data ciphertext" and "second re-encryption key ciphertext" in the above step 401 correspond to the "first data ciphertext" and "first re-encryption key ciphertext" respectively, which can be simply understood as: the end-side device sends the first data ciphertext, and the edge server obtains the first data ciphertext sent by the end-side device, but the first data ciphertext may be tampered with during the transmission process. Therefore, the edge server may obtain the tampered first data ciphertext (that is, the second data ciphertext). Of course, the first data ciphertext may not be tampered with, so the second data ciphertext can also be the first data ciphertext. Similarly, the relationship between the first re-encryption key ciphertext and the second re-encryption key ciphertext is the same, which will not be repeated here.

[0087] In a possible implementation, before step 401, the method 400 also includes: the edge server obtains the first public key and the corresponding key version identifier of the end-side device; the edge server determines whether the second private key corresponding to the first public key exists in the cache of the edge server, and whether the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; when the second private key exists in the cache and the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, the edge server executes the step of obtaining the second data ciphertext and the second re-encryption key ciphertext.

[0088] In the above technical solution, before obtaining the second data ciphertext and the second re-encryption key ciphertext, the edge server determines whether it has the ability to decrypt the re-encryption key ciphertext and the data ciphertext to be obtained. When the edge server determines that there is a second private key corresponding to the first public key in its own cache, and the key version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, it determines that it has the ability to decrypt the re-encryption key ciphertext and the data ciphertext; and then obtains the second data ciphertext and the second re-encryption key ciphertext. This process can avoid the situation where the second data ciphertext and the second re-encryption key ciphertext are obtained when there is no second private key on the edge server, or when there is a second private key but the key version identifier corresponding to the second private key does not match the key version identifier corresponding to the first public key, thereby occupying the memory resources of the edge server.

[0089] Figure 5 It is a flowchart of obtaining a second data ciphertext and a second encryption key ciphertext provided by an embodiment of the present application.

[0090] For example, Figure 5As shown, the blockchain system allocates a corresponding edge server to the end-side device based on the computing task corresponding to the data to be transmitted of the end-side device, that is, pairs the edge server corresponding to the end-side device; after determining the edge server corresponding to the end-side device, the blockchain system sends the first public key and the corresponding key version identifier of the end-side device to the edge server; after obtaining the first public key and the corresponding key version identifier, the edge server determines whether there is a second private key corresponding to the first public key in its own cache; if the second private key corresponding to the first public key exists in the cache, the edge server determines whether the key version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; if the key version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, the edge server determines whether the key version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key. The edge server obtains a second data ciphertext and a second re-encryption key ciphertext; when the second private key corresponding to the first public key does not exist in the cache, the cloud storage system determines whether there is a re-encryption key in its own memory; when the re-encryption key does not exist in the memory in the cloud storage system, the end-side device generates a re-encryption key; and based on the re-encryption key, the symmetric key ciphertext is re-encrypted to obtain a re-encryption key ciphertext (first re-encryption key ciphertext), and the re-encryption key ciphertext is uploaded to the cloud storage system; when the re-encryption key exists in the memory in the cloud storage system, the end-side device executes the step of re-encrypting the symmetric key ciphertext based on the re-encryption key to obtain a re-encryption key ciphertext; when the key version identifier corresponding to the second private key does not match the key version identifier corresponding to the first public key, the process ends.

[0091] It should be understood that the above Figure 5 In the process shown, if the second private key corresponding to the first public key does not exist in the cache of the edge server, it may be that the first public key of the end-side device is wrong. Since the first private key corresponds to the first public key, the re-encryption key is generated based on the first private key and the second public key. Therefore, this application will discuss whether there is a re-encryption key in the memory in the cloud storage system.

[0092] Step 402: The edge server decrypts the second encrypted key ciphertext using the second private key of the edge server to obtain a third key.

[0093] In some embodiments, before step 402, the method 400 further includes: the edge server registers its identity in the blockchain system through a smart contract to obtain a second public key of the edge server and a second private key of the edge server.

[0094] It should be understood that the "second public key" is public and is used by other devices that want to communicate with the edge server, and the "second private key" is confidential and is only disclosed to the edge server.

[0095] In some embodiments, step 402 includes: the edge server determines the third key by the following formula (5);

[0096] KeyDecrypt(C RSK,2 ,S k,ES )→(SK) (5)

[0097] Among them, C RSK,2 Used to indicate the second encryption key ciphertext, S k,ES The second private key S used to indicate the edge server ES k , SK is used to indicate the third key, and KeyDecrypt() is used to decrypt the re-encrypted key ciphertext.

[0098] Step 403: The edge server decrypts the second data ciphertext using the third key to obtain data to be transmitted.

[0099] In some embodiments, step 403 includes: the edge server determines the data to be transmitted by using the following formula (6);

[0100] DataDecrypt(C D,2 ,SK)→(Data) (6)

[0101] Among them, C D,2 is used to indicate the second data ciphertext, SK is used to indicate the third key, Data is used to indicate the data to be transmitted, and DataDecrypt() is used to decrypt the data ciphertext.

[0102] In one possible implementation, the second encrypted key ciphertext carries the key version identifier corresponding to the third key. Before step 403, the method 400 also includes: the edge server obtains a target hash value from the blockchain system, and the target hash value is used to perform key verification on the third key; the edge server verifies the third key based on the third key and the corresponding key version identifier, and the target hash value; if the third key verification passes, the edge server executes the step of decrypting the second data ciphertext by using the third key to obtain the data to be transmitted.

[0103] In the above technical solution, the edge server can obtain the second data ciphertext and the second encrypted key ciphertext from the end-side device or cloud storage; decrypt the second encrypted key ciphertext by the second private key to obtain the third key; verify the third key by the third key and the corresponding key version identifier, as well as the target hash value, and when the third key verification is passed, decrypt the second data ciphertext by the third key to obtain the data to be transmitted. This process can ensure that the edge server will continue to decrypt the second data ciphertext by the third key to obtain the data to be transmitted when the accurate third key is obtained (the third key verification is passed). To a certain extent, this solution can ensure that the edge server obtains the complete data to be transmitted.

[0104] In a possible implementation, the edge server verifies the third key based on the third key and the corresponding key version identifier, and the target hash value, including: the edge server generates a first hash value based on the third key and the corresponding key version identifier; when the first hash value is the same as the target hash value, the edge server determines that the third key verification succeeds; when the first hash value is different from the target hash value, the edge server determines that the third key verification fails.

[0105] In the above technical solution, a process of verifying the third key is described. Specifically, the edge server generates a first hash value through the third key and the corresponding key version identifier; and compares the first hash value with the target hash value. When the first hash value is the same as the target hash value, it indicates that the third key is the same as the first symmetric key, and the edge server determines that the third key verification is passed, the first symmetric key has not been tampered with by the attacker, and the second data ciphertext can be decrypted by the third key to obtain the complete data to be transmitted. Otherwise, the edge server determines that the third key verification fails.

[0106] Figure 6 It is a schematic diagram of a process for verifying a third key provided in an embodiment of the present application.

[0107] For example, Figure 6 As shown, after the edge server decrypts the second encrypted key ciphertext obtained by the second private key to obtain the third key, the edge server generates a first hash value based on the third key and the corresponding key version identifier; the edge server obtains the target hash value from the blockchain system; the edge server compares the first hash value with the target hash value to determine whether the first hash value matches the target hash value; if the first hash value matches the target hash value, the edge server can use the third key to decrypt the second data ciphertext to obtain the data to be transmitted; if the first hash value does not match the target hash value, the process ends.

[0108] In some embodiments, after step 403, the method 400 further includes: the edge server performs operations on the data to be transmitted to obtain the calculated data; the edge server encrypts the calculated data by using the second symmetric key to obtain a third data ciphertext, so that the terminal device decrypts the third data ciphertext sent by the edge server by using the second symmetric key to obtain the calculated data.

[0109] It should be understood that the edge server encrypts the calculated data using the second symmetric key, and the process of obtaining the third data ciphertext can be implemented by the symmetric encryption algorithm in the aforementioned scheme.

[0110] In some embodiments, the edge server determines the third data ciphertext by the following formula (7);

[0111] DataEncrypt(Data2,S k,ES )→(C D3 ) (7)

[0112] Data2 is used to indicate the data after the operation, S k,ES Used to indicate the second symmetric key, C D3 Used to indicate the third data ciphertext, DataEncrypt() is used to encrypt data.

[0113] In some embodiments, the end-side device determines the calculated data by the following formula (8);

[0114] DataDecrypt(C D3 ,S k,ES )→(Data2) (8).

[0115] In other embodiments, after the edge server encrypts the calculated data by using the second symmetric key to obtain the third data ciphertext, the method 400 further includes: the edge server encrypts the second symmetric key by using the third public key of the terminal device to obtain the first key ciphertext, so that the terminal device decrypts the first key ciphertext by using the third private key of the terminal device to obtain the decrypted key, and decrypts the third data ciphertext sent by the edge server by using the decrypted key to obtain the calculated data.

[0116] In other embodiments, after the edge server encrypts the calculated data through the second symmetric key to obtain the third data ciphertext, the method 400 also includes: the edge server encrypts the second symmetric key through the fourth public key of the edge server to obtain the second key ciphertext; the edge server performs key conversion on the second key ciphertext through the re-encryption key to obtain the third key ciphertext, so that the end-side device decrypts the third key ciphertext through the third private key of the end-side device to obtain the decrypted key, and decrypts the third data ciphertext sent by the edge server through the decrypted key to obtain the calculated data, and the re-encryption key is generated based on the fourth private key of the edge server and the third public key of the end-side device.

[0117] Figure 7 It is a flow chart of an edge server performing computational processing on data to be transmitted provided by an embodiment of the present application.

[0118] Exemplarily, the edge server decrypts the second data ciphertext by using the third key to obtain the data to be transmitted; the edge server performs operations on the data to be transmitted to obtain the data after operations; the edge server encrypts the data after operations by using the second symmetric key to obtain the third data ciphertext; the edge server sends the third data ciphertext to the end-side device; after obtaining the third data ciphertext, the end-side device decrypts the third data ciphertext by using the second symmetric key to obtain the data after operations; the process ends.

[0119] Figure 8 It is a structural diagram of a system for processing data provided in an embodiment of the present application.

[0120] For example, Figure 8 As shown, the system 800 includes a terminal device and an edge server;

[0121] The end-side device is used for:

[0122] Encrypt the data to be transmitted of the end-side device by using the first symmetric key to obtain a first data ciphertext; encrypt the first symmetric key by using the first public key of the end-side device to obtain a symmetric key ciphertext; perform key conversion on the symmetric key ciphertext by using the re-encryption key to obtain a first re-encryption key ciphertext, wherein the first re-encryption key ciphertext is a ciphertext that can be decrypted by the second private key of the edge server; and send the first data ciphertext and the first re-encryption key ciphertext to the edge server;

[0123] The edge server is used to:

[0124] Obtain a second data ciphertext and a second re-encryption key ciphertext sent by the end-side device, the second data ciphertext corresponding to the first data ciphertext, the second data ciphertext being obtained after the end-side device encrypts the data to be transmitted by using the first symmetric key, the second re-encryption key ciphertext corresponding to the first re-encryption key ciphertext, the second re-encryption key ciphertext being obtained after the end-side device performs key conversion on the symmetric key ciphertext by using the re-encryption key, decrypt the second re-encryption key ciphertext by using the second private key of the edge server to obtain a third key; decrypt the second data ciphertext by using the third key to obtain the data to be transmitted.

[0125] Optionally, the first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key, and the end-side device is specifically used to: decrypt the symmetric key ciphertext by using the first private key to obtain the first symmetric key; and encrypt the first symmetric key by using the second public key to obtain the first re-encryption key ciphertext.

[0126] Optionally, the system also includes a blockchain system and a cloud storage system; the end-side device is also used to: generate a target hash value based on the first symmetric key and the corresponding key version identifier, the target hash value being used to perform key verification on the first symmetric key; and send the target hash value to the blockchain system.

[0127] Optionally, the blockchain system includes and stores a smart contract, which is a contract written in the form of program code. The blockchain system allocates the corresponding edge server to the terminal device through the smart contract.

[0128] Optionally, the terminal-side device is also used to obtain a first public key and a first private key from the blockchain system through a smart contract.

[0129] Optionally, the edge server is also used to obtain a second public key and a second private key from the blockchain system through a smart contract.

[0130] Optionally, the second-encrypted key ciphertext carries a key version identifier corresponding to the third key, and before the second data ciphertext is decrypted by the third key to obtain the data to be transmitted, the edge server is also used to: obtain a target hash value from the blockchain system; verify the third key based on the third key and the corresponding key version identifier, and the target hash value; if the third key verification is successful, decrypt the second data ciphertext by the third key to obtain the data to be transmitted.

[0131] Optionally, the end-side device is further specifically used to send the first data ciphertext and the first re-encryption key ciphertext to the cloud storage system, and the edge server is specifically used to obtain the first data ciphertext and the first re-encryption key ciphertext from the cloud storage system.

[0132] Fig. 9 It is a structural diagram of a device for processing data provided in an embodiment of the present application.

[0133] For example, Fig. 9 As shown, the device 900 is installed in a terminal side device, and the device 900 includes:

[0134] The encryption module 901 is used for:

[0135] Encrypt the data to be transmitted of the end-side device by using the first symmetric key to obtain a first data ciphertext; encrypt the first symmetric key by using the first public key of the end-side device to obtain a symmetric key ciphertext;

[0136] The conversion module 902 is used to perform key conversion on the symmetric key ciphertext by using the re-encryption key to obtain a first re-encryption key ciphertext, where the first re-encryption key ciphertext is a ciphertext that can be decrypted by the second private key of the edge server;

[0137] The sending module 903 is configured to send the first data ciphertext and the first re-encryption key ciphertext to the edge server.

[0138] Optionally, the first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key. The conversion module 902 is specifically used to: decrypt the symmetric key ciphertext by using the first private key to obtain the first symmetric key; and encrypt the first symmetric key by using the second public key to obtain the first re-encryption key ciphertext.

[0139] Optionally, the device 900 also includes: a generating module, used to generate a target hash value through the first symmetric key and the corresponding key version identifier, and the target hash value is used to perform key verification on the first symmetric key; the sending module 903 is also used to send the target hash value to the blockchain system.

[0140] Fig.10 It is a structural diagram of a device for processing data provided in an embodiment of the present application.

[0141] For example, Fig.10 As shown, the device 1000 is installed in an edge server, and the device 1000 includes:

[0142] An acquisition module 1001 is configured to acquire a second data ciphertext and a second re-encryption key ciphertext, wherein the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted of the end-side device by using the first symmetric key, the second re-encryption key ciphertext is obtained after the end-side device performs key conversion on the symmetric key ciphertext by using the re-encryption key, and the symmetric key ciphertext is obtained after the end-side device encrypts the first symmetric key by using the first public key;

[0143] The decryption module 1002 is used to:

[0144] Decrypting the second encrypted key ciphertext using the second private key of the edge server to obtain a third key;

[0145] The second data ciphertext is decrypted using the third key to obtain the data to be transmitted.

[0146] Optionally, the second-encrypted key ciphertext carries a key version identifier corresponding to the third key, and before the second data ciphertext is decrypted by the third key to obtain the data to be transmitted, the acquisition module 1001 is also used to obtain a target hash value from the blockchain system, and the target hash value is used to perform key verification on the third key; the device 1000 also includes: a verification module, which is used to verify the third key based on the third key and the corresponding key version identifier, and the target hash value; the decryption module 1002 is also used to execute the step of decrypting the second data ciphertext by the third key to obtain the data to be transmitted when the third key verification is passed.

[0147] Optionally, the verification module is specifically used to: generate a first hash value based on the third key and the corresponding key version identifier; when the first hash value is the same as the target hash value, determine that the third key verification is passed; when the first hash value is different from the target hash value, determine that the third key verification is failed.

[0148] Optionally, before obtaining the second data ciphertext and the second re-encryption key ciphertext, the acquisition module 1001 is also used to obtain the first public key and the corresponding key version identifier of the end-side device; the device 1000 also includes: a determination module, used to determine whether the second private key corresponding to the first public key exists in the cache of the edge server, and whether the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; the acquisition module 1001 is also used to execute the step of obtaining the second data ciphertext and the second re-encryption key ciphertext when the second private key exists in the cache and the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key.

[0149] Fig.11It is a structural diagram of a terminal side device provided in an embodiment of the present application.

[0150] For example, Fig.11 As shown, the terminal device 1100 includes: a memory 1101, a processor 1102, and a computer program 1103 stored in the memory 1101 and running on the processor 1102, wherein when the processor 1102 executes the computer program 1103, the terminal device can execute any one of the methods for processing data introduced above.

[0151] In this embodiment, the functional modules of the terminal device can be divided according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0152] In the case of dividing each functional module according to each function, the terminal device may include: an encryption module, a conversion module, a sending module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0153] The terminal-side device provided in this embodiment is used to execute the above-mentioned method for processing data, and thus can achieve the same effect as the above-mentioned implementation method.

[0154] In the case of an integrated unit, the terminal device may include a processing module and a storage module. The processing module may be used to control and manage the actions of the terminal device. The storage module may be used for the terminal device to execute mutual program codes and data.

[0155] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits disclosed in the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0156] Fig.12 It is a structural diagram of an edge server provided in an embodiment of the present application.

[0157] For example, Fig.12As shown, the edge server 1200 includes: a memory 1201, a processor 1202, and a computer program 1203 stored in the memory 1201 and running on the processor 1202, wherein when the processor 1202 executes the computer program 1203, the edge server can execute any one of the methods for processing data described above.

[0158] In this embodiment, the functional modules of the edge server can be divided according to the above method example. For example, each functional module can be corresponded, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0159] In the case of dividing each functional module according to each function, the edge server may include: an acquisition module, a decryption module, a verification module, a determination module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0160] The edge server provided in this embodiment is used to execute the above-mentioned method for processing data, and thus can achieve the same effect as the above-mentioned implementation method.

[0161] In the case of an integrated unit, the edge server may include a processing module and a storage module. The processing module may be used to control and manage the actions of the edge server. The storage module may be used for the edge server to execute mutual program codes and data.

[0162] The processing module may be a processor or a controller, which may implement or execute various exemplary logic blocks, modules and circuits disclosed in the present application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc. The storage module may be a memory.

[0163] This embodiment provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a computer or a processor, the computer or the processor executes any one of the methods for processing data described above.

[0164] This embodiment also provides a computer program product including instructions. When the computer program product is executed on a computer or a processor, the computer or the processor executes the above-mentioned related steps to implement any one of the methods for processing data introduced above.

[0165] Among them, the terminal side device, computer-readable storage medium, computer program product or chip containing instructions provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0166] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0167] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for processing data, characterized in that: The method is performed by a terminal side device, and the method includes: Encrypt the data to be transmitted on the end-side device by using the first symmetric key to obtain a first data ciphertext; Encrypting the first symmetric key by using the first public key of the terminal device to obtain a symmetric key ciphertext; Performing key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encryption key ciphertext, where the first re-encryption key ciphertext is a ciphertext that can be decrypted by a second private key of the edge server; The first data ciphertext and the first re-encryption key ciphertext are sent to the edge server.

2. The method according to claim 1, characterized in that: The first re-encryption key is generated by a first private key corresponding to the first public key and a second public key corresponding to the second private key, and the key conversion is performed on the symmetric key ciphertext by using the re-encryption key to obtain the first re-encryption key ciphertext, including: Decrypting the symmetric key ciphertext using the first private key to obtain the first symmetric key; The first symmetric key is encrypted using the second public key to obtain the first re-encryption key ciphertext.

3. The method according to claim 1, characterized in that: The method further comprises: Generate a target hash value using the first symmetric key and the corresponding key version identifier, where the target hash value is used to perform key verification on the first symmetric key; The target hash value is sent to the blockchain system.

4. A method for processing data, characterized in that The method is performed by an edge server, and the method includes: Obtain a second data ciphertext and a second re-encryption key ciphertext, wherein the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted of the end-side device by using the first symmetric key, the second re-encryption key ciphertext is obtained after the end-side device performs key conversion on the symmetric key ciphertext by using the re-encryption key, and the symmetric key ciphertext is obtained after the end-side device encrypts the first symmetric key by using the first public key; Decrypting the second encrypted key ciphertext by using the second private key of the edge server to obtain a third key; The second data ciphertext is decrypted using the third key to obtain the data to be transmitted.

5. The method according to claim 4, characterized in that The second re-encryption key ciphertext carries a key version identifier corresponding to the third key, and before decrypting the second data ciphertext by the third key to obtain the data to be transmitted, the method further includes: Obtain a target hash value from the blockchain system, where the target hash value is used to perform key verification on the third key; Verify the third key based on the third key and the corresponding key version identifier, and the target hash value; In the case where the third key verification is passed, the step of decrypting the second data ciphertext by using the third key to obtain the data to be transmitted is performed.

6. The method according to claim 5, characterized in that The verifying the third key based on the third key and the corresponding key version identifier, and the target hash value, includes: Generate a first hash value based on the third key and the corresponding key version identifier; When the first hash value is the same as the target hash value, determining that the third key verification passes; In a case where the first hash value is different from the target hash value, it is determined that the third key verification fails.

7. The method according to claim 4, characterized in that Before obtaining the second data ciphertext and the second re-encryption key ciphertext, the method further includes: Obtaining a first public key and a corresponding key version identifier of the terminal device; Determine whether the second private key corresponding to the first public key exists in the cache of the edge server, and whether the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key; When the second private key exists in the cache and the version identifier corresponding to the second private key matches the key version identifier corresponding to the first public key, the step of obtaining the second data ciphertext and the second re-encryption key ciphertext is performed.

8. A system for processing data, characterized in that: The system includes a terminal device and an edge server; The terminal side device is used for: Encrypting the data to be transmitted on the terminal device by using the first symmetric key to obtain a first data ciphertext; Encrypting the first symmetric key by using the first public key of the terminal device to obtain a symmetric key ciphertext; Performing key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encryption key ciphertext, where the first re-encryption key ciphertext is a ciphertext that can be decrypted by a second private key of the edge server; Sending the first data ciphertext and the first re-encryption key ciphertext to the edge server; The edge server is used for: Obtain a second data ciphertext and a second re-encryption key ciphertext sent by the terminal device, the second data ciphertext corresponding to the first data ciphertext, the second data ciphertext being obtained after the terminal device encrypts the data to be transmitted by using the first symmetric key, the second re-encryption key ciphertext corresponding to the first re-encryption key ciphertext, the second re-encryption key ciphertext being obtained after the terminal device performs key conversion on the symmetric key ciphertext by using the re-encryption key; Decrypting the second encrypted key ciphertext by using the second private key of the edge server to obtain a third key; The second data ciphertext is decrypted using the third key to obtain the data to be transmitted.

9. A device for processing data, characterized in that: The device is installed in a terminal side device, and the device includes: Cryptographic modules for: Encrypt the data to be transmitted on the end-side device by using the first symmetric key to obtain a first data ciphertext; Encrypting the first symmetric key by using the first public key of the terminal device to obtain a symmetric key ciphertext; A conversion module, configured to perform key conversion on the symmetric key ciphertext by using a re-encryption key to obtain a first re-encryption key ciphertext, where the first re-encryption key ciphertext is a ciphertext that can be decrypted by a second private key of the edge server; A sending module is used to send the first data ciphertext and the first re-encryption key ciphertext to the edge server.

10. A device for processing data, characterized in that: The device is installed in an edge server, and the device includes: an acquisition module, configured to acquire a second data ciphertext and a second re-encryption key ciphertext, wherein the second data ciphertext is obtained after the end-side device encrypts the data to be transmitted of the end-side device by using the first symmetric key, the second re-encryption key ciphertext is obtained after the end-side device performs key conversion on the symmetric key ciphertext by using the re-encryption key, and the symmetric key ciphertext is obtained after the end-side device encrypts the first symmetric key by using the first public key; Decryption module for: Decrypting the second encrypted key ciphertext by using the second private key of the edge server to obtain a third key; The second data ciphertext is decrypted using the third key to obtain the data to be transmitted.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes the method for processing data according to any one of claims 1 to 7.

Images