Practical fault-tolerant data aggregation method and system without trusted third party

Abstract

The invention provides a practical fault-tolerant data aggregation method and system without a trusted third party, the method is combined with a Shamir threshold secret sharing technology to generate an encryption mask secret key, high fault tolerance can be achieved, homomorphism of the Shamir threshold secret sharing technology is utilized, an aggregated mask value is recovered instead of a mask secret key of a single user, and the reliability of the data aggregation is improved. The data privacy security of a single user can be ensured; and a trusted third party does not need to provide any information to assist the reconstruction process. Through a technology of synchronously updating a secret key by introducing an advanced encryption standard, a proposed data aggregation scheme does not need to be subjected to auxiliary processing by a trusted third party under the condition of ensuring robustness and privacy, and a mask can be reconstructed by an edge node and an intelligent electric meter (user). According to the scheme provided by the invention, by optimizing the algorithm and the data structure, the demand on computing resources is reduced, so that the intelligent electric meter can operate efficiently even under the condition of limited processing capacity, the communication traffic is low, and the efficiency is high.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption, and in particular relates to a practical fault-tolerant data aggregation method and system that does not require a trusted third party. Background Art

[0002] The Internet of Things (IoT) is a network concept composed of multiple networks such as the Internet, traditional telecommunications networks, and sensor networks. It allows intelligent interconnection and data exchange between objects, between objects and people, and between people. The core idea of ​​the IoT is to combine various information sensing devices, such as radio frequency identification (RFID) devices, infrared sensors, global positioning systems (GPS), and network sensors, with the Internet to form an intelligent network to achieve intelligent identification, positioning, tracking, monitoring, and management. The IoT has been widely used in various aspects of real life, such as smart grids, unmanned supermarkets, smart transportation, and smart medical care. However, with the surge in the amount of power data in the power grid, the efficiency of the traditional smart grid architecture that concentrates all computing and analysis operations in the control center is decreasing. Therefore, at the beginning of the 21st century, with the rise of edge computing, the edge computing-based smart grid (ECSG) came into being. ECSG deploys edge devices at the edge of the network to process a large amount of information, ensuring lower latency and better service quality with higher computing and communication efficiency.

[0003] However, with the rapid development and widespread application of IoT technology, the problem of users frequently encountering device disconnections has become increasingly prominent, which not only seriously affects the user experience, but also poses a severe challenge to data continuity and system reliability. In areas with insufficient signal coverage, such as basements, remote areas, or inside buildings, the wireless signal strength is insufficient, making it difficult for devices to maintain a stable network connection. In environments with dense devices, such as large factories or city centers, excessive use of network resources may lead to a decline in connection quality, resulting in disconnection. Hardware failures, such as physical damage to the wireless module or antenna, manufacturing defects, and unstable power supply may prevent devices from being able to connect to the network stably. Software defects, especially when the device attempts to establish or maintain a network connection, may also cause unstable connections. Incorrect network configuration, such as mismatched SSID, password, or IP address settings, can prevent devices from successfully connecting to the network. The device may not support the protocol used by the current network, or there may be incompatible protocol versions. Interference from other electronic devices or wireless signal sources may affect the wireless connection of IoT devices. Devices may temporarily lose connection when performing firmware or software updates. Network failures or maintenance by service providers may also cause devices to disconnect. Long-term operation or high ambient temperature may cause the device to overheat, affecting its performance and connection stability. For devices that rely on battery power, low battery power may cause device performance to decline or disconnect.

[0004] During the development of ECSG, various cybersecurity threats it has suffered have been exposed to the public. Among them, user privacy is an issue of great significance, because adversaries may infer sensitive information and living habits from customers' electricity usage patterns. The research of Quin et al. revealed that through in-depth analysis of users' electricity usage patterns, users' living habits and behavior patterns can be indirectly inferred, such as the time and frequency of using high-power electrical appliances, or the time when users are away from home. Such analysis results seriously infringe on users' personal privacy and may even affect personal safety. Therefore, whether users' privacy information can be kept confidential without affecting system functions has become one of the determining factors for whether smart grids can be promoted in real life.

[0005] In order to balance the security and privacy of meter measurement data, the privacy-preserving data aggregation scheme (PPDA) is an effective solution and has been widely studied. The PPDA scheme is that the smart meter SM encrypts the data and uploads it to the fog node (EN), which aggregates the encrypted data and uploads it to the control center (CC), and finally decrypts it by the CC to obtain the total aggregation value. The security goal of the privacy-preserving data aggregation scheme (PPDA) is to protect the privacy of each user and only the control center in the smart grid can obtain the final secure aggregation value.

[0006] Existing privacy protection solutions are divided into two categories: plaintext-based privacy schemes and ciphertext-based cryptographic operations. Plaintext-based schemes provide a certain degree of privacy protection through anonymization and data load balancing, but they are vulnerable to background knowledge attacks. At the same time, although ciphertext-based cryptographic operations provide strong security, their efficiency and practicality in practical applications are limited.

[0007] Most of the existing solutions have high fault tolerance, so as to cope with the situation that users are offline during data aggregation. Among them, the mask-based solution needs to ensure the key relationship p = ∑p i If a user is offline, decryption will fail. Since the network architecture of smart grids is complex and contains multiple access points, data is vulnerable to external interference or malicious attacks during transmission, which makes user offline and data loss a common problem in smart grid data transmission. Some proposed schemes suggest using ring network configuration or challenge-response interaction mode to ensure that smart meter disconnection problems can be discovered and handled in time during data transmission. However, adjusting the network structure and implementing online monitoring of smart meters may lead to higher communication costs and maintenance expenses. In order to deal with this problem, it is necessary to propose an adaptive fault-tolerant mechanism to minimize communication overhead.

[0008] Lightweight design is another key feature of privacy-preserving schemes in resource-constrained environments, such as smart meters (SMs) in smart grids. This design takes into account the computing power, storage capacity, and communication bandwidth of smart meters, ensuring efficient implementation and low-energy operation of the scheme. Some schemes propose a scheme combining extended hyperincremental sequences and improved Paillier cryptosystems to achieve efficient multi-dimensional data aggregation and lightweight data integrity verification, but may face challenges in terms of high computing resource consumption when processing data aggregation, especially when large-scale user participation is involved. Therefore, it is necessary to propose a key update method that supports masking to reduce interactions between users and consider its application in reducing the cost of system updates.

[0009] Privacy-preserving schemes need to achieve their security, where the security of mask-based schemes depends on the blinding factor p. i The randomness of the key relationship p = Σp i , it is challenging to achieve successful decryption even when a user is offline in a mask-based solution. Most solutions rely on a trusted third party, which is not realistic in practical applications. Under the premise of ensuring security, the solution does not require a trusted third party and does not require multiple interactions between users, which is challenging. Therefore, the present invention proposes a solution structure that does not require a trusted third party to meet practical applications. Summary of the invention

[0010] In order to solve the problems existing in the prior art, the present invention provides a practical fault-tolerant data aggregation method and system without the need for a trusted third party, proposes an adaptive fault-tolerant mechanism to minimize communication overhead, and provides a key update method that supports masks to reduce interactions between users, and considers applying it to reduce the cost of system updates.

[0011] In order to achieve the above object, the technical solution adopted by the present invention is: a practical fault-tolerant data aggregation method without the need for a trusted third party, comprising the following steps:

[0012] The encryption service provider sets the security parameter k and selects two large prime numbers P where |p| = |q| = σ;

[0013] Smart MeterSM i Random Selection Represents the multiplication group modulo N, which is used as the private key for encryption and a t-1 degree polynomial f(x) kept secret, f(x) = a0+a1x+…+a t-1 x t-1 ∈Z n [x], satisfying f(0) = p i , S.M. i Randomly select from the residential area Users, A collection of users According to the secret splitting method in Shamir's (t, n) threshold secret sharing scheme, the private key Split into Share Expressed as And send it to the corresponding user u respectively j ;

[0014] The edge node selects a large number k1 as the private key, and generates the public key Q1 through Q1=k1·P. The control center selects a large number k2 as the private key, and generates the public key Q2 through Q2=k2·P. The edge node and the control center both publish their public keys. The edge node calculates Q2·k1=k1·k2·P and stores it as a shared private key. The control center calculates Q1·k2=k1·k2·P and stores it as a shared private key. Let the encrypted private keys of both parties be s1=k1·k2·P.

[0015] In the polymerization period T s Within each SM i Using private key p i Encryption power consumption m i , c i =m i +p i mod P, c iSent to edge nodes; in the current aggregation period T s At the end, the edge node checks the ciphertext ci sent by all smart meters and marks it as the online user set For each user The edge node sends a reconstruction request to each u i Receive the request, u i Verify SM j The authenticity of the fault and all u j Send to u i Aggregate the shares of Will send To the edge node, the edge node collects User u i The valid share provided is recovered according to the reconstruction method in the Shamir (t, n) threshold secret sharing scheme Edge nodes aggregate all ciphertexts The edge node sends C and the set of faulty users to the control center;

[0016] The control center uses AES(s1, l) to decrypt and obtain

[0017] Furthermore, in the Shamir (t, n) threshold secret sharing scheme based on the polynomial interpolation algorithm, the main secret is reconstructed using polynomial interpolation. Let t sub-secrets be (x i ,y i ), where y i =f(x i ), i = 1, ..., t and i ≠ j, when x i ≠x j , participants P1, ..., P t Co-calculation:

[0018]

[0019] h(x) is a t-1 degree polynomial, since x i ≠x j , i≠j, the denominator of each addition term is non-zero, for i=1,...,t,y i =h(x i )=f(x i ), h(x)=f(x), participant P i Calculate h(0)=f(0)=s to recover the master secret s;

[0020] For finite fields For a polynomial f(x) of degree n-1 on a finite field, there exist n elements in , denoted by λ1,...,λ n , so that (λ1, ..., λ n ) is the reorganized vector, for the matrix M:

[0021]

[0022] Let the secret distribution polynomial be f(x), and the participant P i The sub-secret held is f(i), f(0) = s = (λ1, ..., λ n )M(a0,a1,...,a n-1 ) T =λ1·f(1)+…+λ n f(n), compute the reconstructed vector (λ1, ..., λ) by computing the image of the inverse matrix of the matrix M n ):

[0023] (λ1, ..., λ n )=(1,0,...,0)M -1

[0024] After obtaining the recombination vector, a secure multi-party computing protocol is constructed based on the Shamir threshold mechanism.

[0025] Furthermore, when constructing a secure multi-party computing protocol based on the Shamir threshold mechanism, let P = {P1, ..., P n} is the set of participants, P i Holds input x i (1≤i≤n), jointly calculate the function f(x1,...,x n ), in a finite field The process of Shamir (t+1, n) threshold mechanism on is as follows:

[0026] In the input phase, each participant P receives the input x i And secretly select a random polynomial f(x i ), satisfying fi(0)=x i , using Shamir(t+1,n) threshold secret sharing mechanism, P i Send fi(j) to participant P j ;

[0027] In the calculation phase, assume that inputs a and b have been shared with each participant through random polynomials fa(x) and fb(x), and after t times through the Shamir threshold mechanism,

[0028] f a (x) = m t xt +…+m1x 1 +af b (x) = n t x t +…+n1x 1 +b

[0029] Where m t ...,m1,n t ...,n1 are random polynomial coefficients,

[0030] Participant P i Holds subsecret a of input a i and sub-secret b of input b i , and perform multiple calculations.

[0031] Furthermore, we recover the When , the edge node calculates:

[0032]

[0033] Among them, L j is the Lagrange coefficient, is the sum of the masks and P is the modulus.

[0034] Furthermore, when the control center uses AES(s1,l) to decrypt:

[0035]

[0036] Among them, C is the total ciphertext, s1 is the first round key, l is the number of rounds, and P is the modulus.

[0037] Furthermore, in the attacker model, it is assumed that the user, edge node, control center, and CSP may attempt to obtain the user's private information while correctly following the protocol, based on the following assumptions:

[0038] (1) Both the front-end node and the control center will follow the protocol, but they also want to obtain the value of a single smart meter reading;

[0039] (2) Although each user hopes to pay as little electricity as possible, all smart meter users are honest and follow the protocol;

[0040] (3) External adversaries have the ability to break into the control center, but can only obtain the final aggregated results and cannot obtain the private information of individual users.

[0041] Furthermore, the following four objectives are met: (1) External attackers cannot access the power consumption of a single user through information obtained through the public channel; the front-end node cannot obtain the power consumption of a single user through the received ciphertext; the control center can only obtain the total aggregate data through decryption, but cannot obtain the power consumption of a single user;

[0042] (2) During the data aggregation process, there is no need for a trusted third party to participate in decryption. The entire data aggregation process can be completed by the smart meter, front-end node, and control center;

[0043] (3) When some electricity meters fail, the edge nodes can still correctly aggregate the power consumption of normal users to obtain the correct total power consumption, and allow users to go offline again during the secret reconstruction process;

[0044] (4) Data aggregation operations do not require multiple interactions between users.

[0045] The present invention can also provide a computer device, including a processor and a memory, the memory is used to store a computer executable program, the processor reads the computer executable program from the memory and executes it, and when the processor executes the computer executable program, it can implement the practical fault-tolerant data aggregation method of the present invention that does not require a trusted third party.

[0046] A computer-readable storage medium is also provided, in which a computer program is stored. When the computer program is executed by a processor, the practical fault-tolerant data aggregation method without a trusted third party described in the present invention can be implemented.

[0047] Compared with the prior art, the present invention has at least the following beneficial effects: the present invention combines Shamir's threshold secret sharing technology to generate an encryption mask key, which can achieve higher fault tolerance. By utilizing the homomorphism of Shamir's threshold secret sharing technology, the data privacy security of a single user can be guaranteed by restoring the aggregated mask value instead of the mask key of a single user. By introducing the technology of synchronously updating the secret key of the advanced encryption standard, the proposed data aggregation scheme does not require a trusted third party to perform auxiliary processing while ensuring robustness and privacy, and the mask can be reconstructed by the edge node and the smart meter (user). In the processing of the blinding factor, there is no need to sacrifice high communication overhead to make users interact multiple times to achieve data aggregation. The scheme proposed by the present invention reduces the demand for computing resources by optimizing the algorithm and data structure, so that the smart meter can operate efficiently even with limited processing power, and has the characteristics of low communication volume and high efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 Schematic diagram of the system model of the present invention.

[0049] Figure 2Schematic diagram of Shamir secret sharing distribution.

[0050] Figure 3 Comparison results of the aggregation time of (3, 5) under different failure rates.

[0051] Figure 4 Comparison results of aggregation time under different failure rates (7, 13).

[0052] Figure 5 Comparison of aggregation time under different failure rates (13, 20).

[0053] Figure 6 Comparison of aggregation time under different failure rates. DETAILED DESCRIPTION

[0054] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In the description of the present invention, it should be understood that the terms “include” and “comprises” indicate the presence of described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0056] The present invention provides a practical fault-tolerant data aggregation scheme (named PFTDA) in the power grid without a trusted third party, and its contributions are as follows:

[0057] (1) In PFTDA, Shamir's threshold secret sharing technology is combined to generate encrypted mask keys, which can achieve higher fault tolerance. By utilizing the homomorphism of Shamir's threshold secret sharing technology, the privacy security of individual user data can be guaranteed by restoring the aggregated mask value instead of the mask key of a single user.

[0058] (2) There is no need for a trusted third party to provide any information to assist in the reconstruction process. By introducing the technology of synchronously updating the secret key of the Advanced Encryption Standard (AES), the proposed data aggregation scheme does not require a trusted third party to perform auxiliary processing while ensuring robustness and privacy, and the mask can be reconstructed by the edge node and the smart meter (user). In the processing of the blinding factor, there is no need to sacrifice high communication overhead to enable users to interact multiple times to achieve data aggregation. The scheme proposed in the present invention reduces the demand for computing resources by optimizing algorithms and data structures, so that smart meters can operate efficiently even with limited processing power, and have the characteristics of low communication volume and high efficiency.

[0059] (3) During the system implementation, performance analysis shows that the communication overhead and computational overhead are lower than those of the double-mask and ciphertext-based schemes. The aggregation scheme can resist collusion attacks between entities and protect the privacy of individual user data, proving that the scheme described in the present invention is secure and lightweight.

[0060]

[0061]

[0062] Shamir Secret Sharing Threshold Secret Sharing

[0063] The Shamir (t,n) threshold secret sharing scheme based on the polynomial interpolation algorithm has the following secret distribution algorithm:

[0064] First assume is a finite field with q elements, where q is a prime number and q>n. Figure 2 As shown, P0 is the secret owner and shares the master secret P0 distributes the master secret s as follows. For ease of reading, the modulo p operation is omitted in the following formula.

[0065] P0 in a finite field Randomly select an element t-1 from , and construct a polynomial f(x) with x as the variable:

[0066]

[0067] P0 secretly computes y i =f(i), for 1≤i≤n, P0 sends (i,y i ) is secretly assigned to P i .

[0068] The secret reconstruction in Shamir(t,n) threshold sharing mechanism can be done by solving equations, that is, t equations can determine t unknowns, which are the coefficients of the polynomial f(x) containing the master secret s. t Once we know the sub-secrets f(1),...,f(t), we can solve the following equation:

[0069]

[0070] Then we can find the coefficient a t-1 ,...,a1,s.

[0071] Another way to reconstruct the master secret is to use polynomial interpolation, assuming that the t sub-secrets are (x i ,y i ), where y i =f(x i ),i=1,...,t and i≠j, when x i ≠x j . Participants P1,...,P t Co-calculation:

[0072]

[0073] Obviously, h(x) is a t-1 degree polynomial, since x i ≠x j , i≠j, so the denominator of each addition term is non-zero, so for i=1,...,t,y i =h(x i )=f(x i ). According to the properties of polynomials, if there are two highest-order polynomials, both of which are of highest order t-1, and take the same value at t different points, then the two polynomials are equal. That is, h(x) = f(x), then participant P i Calculate h(0)=f(0)=s to recover the master secret s.

[0074] For finite fields For a polynomial f(x) of degree n-1 on a finite field, there exist n elements in On, denoted as λ1,...,λ n , so that Let (λ1,...,λ n ) is the reorganized vector. For matrix M:

[0075]

[0076] Let the secret distribution polynomial be f(x), and the participant P iThe sub-secret held is f(i), because there is a recombinant vector (λ1,...,λ n ), so that f(0)=s=(λ1,...,λ n )M(a0,a1,...,a n-1 ) T =λ1·f(1)+…+λ n f(n), in order to calculate the reorganization vector, the reorganization vector (λ1,...,λ n ):

[0077] (λ1,...,λ n )=(1,0,...,0)M -1

[0078] After obtaining the reorganization vector, a secure multi-party computing protocol can be constructed based on the Shamir threshold mechanism. First, assume that P = {P1, ..., P n} is the set of participants, P i Holds input x i (1≤i≤n), the function that needs to be calculated together is f(x1,...,x n ). In a finite field The process of Shamir(t+1,n) threshold mechanism on is as follows:

[0079] In the input phase, each participant P receives the input x i And secretly select a random polynomial f(x i ), satisfying fi(0)=x i , using Shamir(t+1,n) threshold secret sharing mechanism. Then P i Send fi(j) to participant P j ;

[0080] In the calculation phase, it is assumed that inputs a and b have been shared with each participant through random polynomials fa(x) and fb(x), and after t times through the Shamir threshold mechanism,

[0081] f a (x) = m t x t +…+m1x 1 +af b (x) = n t x t +…+n1x 1 +b

[0082] Where m t ...,m1,n t ...,n1 are random polynomial coefficients.

[0083] Participant P i Holds subsecret a of input a i and sub-secret b of input b i The reason for doing this multiple times is that the coefficients of the polynomial are randomly generated, so these coefficients may be 0 t times.

[0084] The present invention is based on the smart grid framework and involves four types of entities, including encryption service providers, control centers, edge nodes and smart meters. The system model is as follows: Figure 1 shown.

[0085] (1) Cryptographic Service Provider (CSP): CSP is the core of the cryptographic service in the system. It is responsible for key management, data encryption and decryption, digital signature verification and other key security functions to ensure the security and integrity of system data. It generates and configures the necessary encryption parameters during the system initialization phase to ensure the security of data access. CSP implements strict protection of sensitive keys through its key library and container management to prevent unauthorized access and data leakage.

[0086] (2) Control Center (CC): CC performs the decryption process, obtains the correct aggregated data results, and processes the aggregated values.

[0087] (3) Edge Node (EN): The edge node has strong computing power and is mainly responsible for aggregating the ciphertext sent by users and forwarding the results to the CC.

[0088] (4) Smart Meter (SM): Smart meters collect the amount of electricity used by users within a specified timestamp. In addition, SM performs encryption operations for privacy protection and sends the encrypted information to the connected edge nodes (EN).

[0089] In the attacker model of the present invention, it is assumed that the user (SM), edge node (EN), control center (CC) and CSP are "honest but curious" to some extent, that is, these entities may try to obtain the user's private information when they correctly follow the protocol. The attack model of the present invention is based on the following assumptions:

[0090] (1) Both the front-end nodes and the control center are of the “honest but curious” type, which means that they follow the protocol but are also eager to obtain the value of a single smart meter reading.

[0091] (2) Although every user hopes to pay as little electricity as possible, this paper assumes that all smart meter users are honest and follow the protocol.

[0092] (3) External adversaries It is possible to break into the control center, but only the final aggregated result can be obtained without obtaining the private information of individual users.

[0093] The privacy-preserving data aggregation scheme designed in this invention should meet the following four goals:

[0094] (1) Privacy: External attackers cannot access the power consumption of a single user through information obtained through public channels; the front-end node cannot obtain the power consumption of a single user through the received ciphertext; the control center can only obtain the total aggregate data through decryption, but cannot obtain the power consumption of a single user. Therefore, it can be guaranteed that the power consumption of a single user and the total power consumption information will not be leaked.

[0095] (2) No trusted third party is required: During the data aggregation process, there is no need for a trusted third party to participate in decryption. The entire data aggregation process can be completed by the smart meter, front-end node and control center.

[0096] (3) Strong robustness: When some electricity meters fail, the front-end node EN can still correctly aggregate the power consumption of normal users and obtain the correct total power consumption. In addition, during the secret reconstruction process, users are allowed to go offline again.

[0097] (4) Efficiency: Data aggregation operations are highly efficient and do not require multiple interactions between users, reducing communication overhead, making decryption operations at the control center simpler and achieving reasonable allocation of power grid resources.

[0098] The method of the present invention is as follows:

[0099] initialization:

[0100] CSP sets a security parameter κ and selects two large prime numbers P of |p|=|q|=σ, where large means no less than 512 bits.

[0101] User Registration:

[0102] SM i Random Selection represents the multiplication group modulo N, which is used as the encrypted private key and a t-1 degree polynomial f(x) = a0+a1x+…+a t-1 x t-1 ∈Z n [x],Z n [x] represents the remainder class ring of integers modulo N, satisfying f(0) = p i , f(x) is kept confidential. SM i Randomly select from the residential area users, and the set of these users is recorded as According to the secret splitting method in the SSS scheme, the private key Split into Share Also expressed as And send it to the corresponding user u respectively j .

[0103] The edge node selects a large number k1 as the private key and generates a public key Q1 (Q1 = k1·P). The control center selects a large number k2 as the private key and generates a public key Q2, Q2 = k2·P. The edge node and the control center both publish their public keys. The edge node calculates Q2·k1 = k1·k2·P and stores it as a shared private key. Similarly, the control center calculates Q1·k2 = k1·k2·P. Let the encryption private key of both parties be s1 = k1·k2·P.

[0104] Data upload:

[0105] In the polymerization period T S Within each SM i (i=1,2,...,n) using private key p i Encryption power consumption m i :

[0106] c i =m i +p i modP

[0107] Then c i Send to edge nodes.

[0108] Data Aggregation:

[0109] At the current T S At the end, the edge node checks the ciphertext c sent by all smart meters (users) i And marked as online user collection For each The edge node sends a reconstruction request to each Once a request is received, u i Verify SM j The authenticity of the fault and all u j Send to u i The shares of Last sent to the edge nodes. Once the edge nodes collect User u i The effective shares provided are restored according to the reconstruction method in the SSS solution That is, edge nodes calculate the Lagrangian coefficient Mask Sum Edge nodes aggregate all ciphertexts The edge node sends C and To the control center.

[0110] Decryption, the control center uses AES(s1,l) to decrypt:

[0111]

[0112] Finally, the control center gets

[0113] The security analysis of the confidentiality and integrity of the scheme is as follows:

[0114] Theorem 1PFTDA satisfies correctness.

[0115] (1) First consider the feasibility of ciphertext reconstruction

[0116] To achieve correctness, PFTDA needs to meet the following two aspects: first, the result of data encryption aggregation is equal to the true value of data aggregation; second, according to the reconstruction method in the SSS scheme, when the failure probability of SM is assumed to be independent and identically distributed, it is denoted as β. Considering that smart meters may fail, it is necessary to evaluate the impact of the failure probability of the meter on the successful decryption of the ciphertext. Assume that the failure probabilities of all smart meters are independent of each other and are equal to β. According to the Shamir Secret Sharing Scheme (SSS), as long as Smart meters have at least If one of them can work properly and provide its encryption share, the original information can be successfully decrypted. The probability of the meter working properly determines the possibility of decrypting the second partially equivalent ciphertext. Therefore, the probability of successfully reconstructing the new mask can be expressed as:

[0117]

[0118] in is from The number of combinations of selecting i meters from among the meters, (1-β) i is the probability that none of the selected i meters fails, and It's the rest The probability of a meter failing.

[0119] Two examples are given with some specific parameters:

[0120] a) Given Then Pr[A]=0.99997;

[0121] b) Given Then Pr[A]=0.99991.

[0122] It can be seen that the probability of recovery and reconstruction Pr[A] in the event of a meter failure is close to 1, and the scheme is fault-tolerant.

[0123] (2) Correctness of the reconstruction part:

[0124] If and only if greater than When a SM provides a valid ciphertext share, the SM encrypted mask can be reconstructed through the reconstruction method in SSS:

[0125]

[0126] in, For all u j Send to u i The shares are aggregated.

[0127] (3) Correctness of Aggregate Ciphertext Decryption

[0128] Because the control center stores the same encryption mask as the edge node, the decryption process is as follows:

[0129]

[0130] Get the final aggregate charge

[0131] The confidentiality and privacy of data are analyzed as follows:

[0132] Theorem 2: An attacker cannot crack the power consumption of a single user through eavesdropping attacks.

[0133] Proof: The possibility of an attacker hacking a single user’s power consumption through eavesdropping attacks is effectively eliminated due to a series of security measures taken during the entire communication and encryption process. First, during the data transmission process, the power consumption exists in the form of ciphertext. This is achieved by converting the power consumption m i With its private key p i Since the private key is randomly selected and each smart meter has a different private key, even if the attacker intercepts the ciphertext, the original value of the power consumption cannot be determined without the corresponding private key. This ensures that even if the ciphertext is intercepted, the attacker without the corresponding private key cannot restore the original value of the power consumption. Second, the security of Shamir secret sharing: The private key p of the smart meter iIt is split into multiple shares through the Shamir secret sharing scheme and distributed to a group of users. According to the Shamir scheme, the original private key cannot be reconstructed unless the attacker is able to collect shares exceeding the threshold t. This ensures that even if the attacker intercepts the shares, the power consumption cannot be decrypted. In addition, during the data aggregation phase, even if the attacker is able to observe the communication during the aggregation process, the aggregation operation is performed on the ciphertext and additional encryption measures are used, through the AES algorithm and the shared private key s1, which provides an additional layer of security for the data.

[0134] In summary, the scheme ensures that the power consumption information of a single user is safe even in the case of eavesdropping by an attacker.

[0135] Theorem 3: The scheme can resist collusion attacks, i.e., malicious CC and at most Even if individual users collude, they cannot obtain the power consumption of other individual users.

[0136] Proof: When CC and When multiple users collude, CC can decrypt the final aggregated data provided by the edge node through the private key. Each user can provide his own private key and other users' share of the secret stored in these users. When CC wants to get the remaining When any user consumes electricity, it is necessary to obtain the private key p of a single user i For a single user's private key p i ,exist If all users are honest, the private key p of one of the users needs to be reconstructed through the SSS reconstructible method. i To achieve SSS reconfiguration, at least Users provide valid shares, but malicious CC and at most Users collude only share, and The threshold requirement is not met, so the private key p of other users cannot be decrypted i .

[0137] In summary, malicious CC can Even if individual users collude, a collusion attack cannot be carried out.

[0138] Theorem 4: Malicious edge nodes cannot obtain the power consumption of a single user.

[0139] Proof: To obtain the power consumption of a single user, a malicious edge node needs to obtain the user’s private key p i To decrypt the ciphertext under the Shamir encryption system. First, consider obtaining its private key p i.Since edge nodes are key nodes for data aggregation, the mask values ​​of all online users can be obtained by Lagrange interpolation when reconstructing the encryption mask in SSS. However, the mask value of a single user cannot be obtained, so the ciphertext of a single user cannot be decrypted.

[0140] Compare the computational overhead of the proposed solution with that of FPDA. In order to compare the computational overhead, the code was developed based on JPBC, and the simulation system was a laptop equipped with Intel(R)Core(TM)i5-8265U, 1.60GHz CPU and 16G RAM. The Paillier homomorphic cryptographic system was used, 512-bit prime numbers p and q were used to meet the provable security parameters, and the ciphertext length was 5096 bits. The pseudo-random function was implemented using SHA-256, and the selected Hmac was Javax.Crypto. The pseudo-random function was implemented using SHA-256, and the selected Hmac was HmacSHA1 from the Javax.Crypto.Mac library. During the aggregation period, each meter consumes a random value within 1000, which is aggregated every 15 minutes.

[0141] The computational overhead of the proposed scheme is compared with FPDA. When comparing the computational overhead, the code is developed based on JPBC, and the simulation system is a laptop equipped with Intel(R) Core(TM) i5-8265U, 1.60GHz CPU and 16G RAM. A Paillier homomorphic encryption system with 512-bit prime numbers p and q is used to meet the provable security parameters, and the ciphertext length is 5096 bits. The pseudo-random function is implemented using SHA-256, and Hmac in Javax.Crypto is selected. The pseudo-random function is implemented using SHA-256, and the selected Hmac is HmacSHA1 from the Javax.Crypto.Mac library. During the aggregation period, each meter consumes a random value within 1000, and the aggregation is performed every 15 minutes.

[0142] The computational overhead is mainly composed of the time required by the security module (SM) to encrypt the data, the time required by the edge node (EN) to aggregate the received data, and the time required by the control center (CC) to decrypt the aggregated data. If the security module fails, the aggregation efficiency will be higher than the case without errors due to the property of reusable secret sharing operations. Figure 4, 5, 6, the initialization time of the security module in different schemes is compared, where the number of security modules is (t, n) is (3, 5), and the failure probability of the security module is 15%. The average time overhead of Bo Pang et al. is about 160.5% higher than that of our scheme. The average time overhead of FPDA is about 104.51% higher than that of the scheme of the present invention. According to the average initialization time overhead, our scheme is significantly better than Bo Pang et al. and FPDA in terms of time overhead. In the decryption calculation, the time overhead of our scheme is almost 0, while the overhead of other schemes is at the microsecond level, and this gap is very obvious.

[0143] from Figure 4 It can be seen that under different thresholds (t, n), as the packet loss rate increases, the relative reduction of the aggregation time overhead also increases. Specifically, when the packet loss rate increases from 0.05 to 0.15, the aggregation time overhead decreases by an average of 18%. When the packet loss rate further increases to 0.25 and 0.35, the reduction in the aggregation time overhead is more significant, reaching 43% and 49% respectively. This shows that as the packet loss rate increases, the aggregation time overhead of the scheme decreases relatively, reflecting that the system can handle packet loss more efficiently under high packet loss rates.

[0144] Figure 6 It shows how different (k, n) affect the various time costs of this scheme. On average, the time cost of (7, 13) is 76.12% higher than the initialization time of (3, 5). This shows that, on average, (7, 13) takes more time to complete the initialization task. On average, the aggregation time cost of (7, 13) is about 96.62% of (3, 5). On average, the encryption time cost of (7, 13) is about the same as (3, 5).

[0145] The differences in communication overhead and storage overhead between the FPDA solution and the solution of the present invention are compared in detail. The communication overhead is measured by the amount of data sent from the SM to the EN and the amount of data sent from the EN to the CC. The storage overhead is measured by the size of the private key or parameter stored by the SM, EN, and CC respectively.

[0146] Assume that in the system, there are n users in each residential area, and the serial number of each SM has at most l digits. The failure rate of the meters is independent and identically distributed, denoted by β. After modeling, the size of the original ciphertext and the aggregated ciphertext is 512 bits. When P = α·N+1, where α is a small integer, the user's blinding factor is also approximately 512 bits. Assume that each user's electricity meter reports its power consumption to the edge node once every 15 minutes. In the time aggregation dimension, there are 96 time intervals per day. Finally, we set n = 1000, β = 5%, The proposed scheme and FPDA are instantiated with l = 20, where FPDA reconstructs the user's ciphertext by extending the SSS secret sharing scheme, while our scheme reconstructs the sum of the blinding factors of online users by the SSS secret sharing scheme. The detailed communication and storage overheads are shown in Tables 2 and 3, respectively.

[0147] Most of the computational and communication overhead associated with handling meter failures occurs in the internal network centered on the edge server, so the solution proposed in the present invention achieves fault tolerance in terms of low latency, reduced meter-side computation, and increased computational rate. By analyzing the data in the table, it can be concluded that compared with the FPDA solution, the solution of the present invention is more efficient in terms of storage overhead, especially in terms of key sharing indexes and reconstructed data indexes, the solution of the present invention shows lower storage requirements. FPDA requires significantly more storage space during the reconstruction process, especially when processing large-scale user data. In addition, in the FPDA solution, the storage requirement of CC is also higher than that of the solution of the present invention, which may affect its applicability in resource-constrained environments. Overall, the solution of the present invention has advantages in storage efficiency and is suitable for applications with limited storage resources.

[0148] Table 2 Storage overhead

[0149]

[0150] In summary, in order to solve the privacy protection problem of data aggregation in smart grid, the present invention designs a practical fault-tolerant data aggregation scheme (PFTDA) without a trusted third party, uses Shamir threshold secret sharing technology to generate encryption mask keys, realizes secure data aggregation between edge nodes and smart meters, effectively solves the risk of data leakage and eavesdropping in smart grids, and ensures the security and robustness of data aggregation. By introducing the key update technology based on AES, the security of the scheme is further enhanced, and the communication cost between users is reduced. Without the need for a trusted third party, the present invention realizes secure data interaction between edge nodes and smart meters, significantly reduces the communication and computing overhead, and is particularly suitable for resource-constrained smart meter environments. Security analysis proves the reliability of the PFTDA scheme in protecting user privacy and data integrity, and can resist a variety of security threats including eavesdropping and collusion attacks. Performance evaluation experiments show that the efficiency of PFTDA in computing, communication and storage is better than that of existing schemes, demonstrating its potential and advantages in practical applications.

[0151] Embodiment 2, the present invention also provides a practical fault-tolerant data aggregation system without a trusted third party, including an encryption service provider, a control center, an edge node and a smart meter;

[0152] The encryption service provider generates and configures the necessary encryption parameters during the system initialization phase;

[0153] The control center performs the decryption process, obtains the correct aggregated data results, and processes the aggregated values;

[0154] The edge node aggregates the ciphertext sent by the user and forwards the result to the control center;

[0155] The smart meter collects the amount of electricity used by the user within a specified timestamp, performs encryption operations for privacy protection and sends the encrypted information to the connected edge nodes; and performs data aggregation based on the practical fault-tolerant data aggregation method without a trusted third party described in the present invention.

[0156] On the other hand, the present invention provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the practical fault-tolerant data aggregation method without a trusted third party described in the present invention can be implemented.

[0157] The present invention can also provide a computer device, including a processor and a memory, the memory is used to store a computer executable program, the processor reads the computer executable program from the memory and executes it, and when the processor executes the computer executable program, it can implement the practical fault-tolerant data aggregation method of the present invention that does not require a trusted third party.

[0158] The computer device may be a laptop computer, a desktop computer or a workstation.

[0159] The processor may be a central processing unit (CPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), or an off-the-shelf field programmable gate array (FPGA).

[0160] The memory of the present invention may be an internal storage unit of a laptop computer, a desktop computer or a workstation, such as a memory or a hard disk; or an external storage unit, such as a mobile hard disk or a flash memory card.

[0161] Computer-readable storage media may include computer storage media and communication media. Computer storage media include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. Computer-readable storage media may include: read-only memory (ROM), random access memory (RAM), solid-state drive (SSD) or optical disk, etc. Among them, random access memory may include resistance random access memory (ReRAM) and dynamic random access memory (DRAM).

[0162] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A practical fault-tolerant data aggregation method without a trusted third party, characterized in that: The following steps are involved: The encryption service provider sets the security parameter κ and selects two large prime numbers P where |p| = |q| = σ; Smart MeterSM i Random Selection i=1,2,...,n, Represents the multiplication group modulo N, which is used as the private key for encryption and a t-1 degree polynomial f(x) kept secret, f(x) = a0+a1x+…+a t-1 x t-1 ∈Z n [x], satisfying f(0) = p i , S.M. i Randomly select from the residential area Users, A collection of users According to the secret splitting method in Shamir's (t,n) threshold secret sharing scheme, the private key Split into Share Expressed as And send it to the corresponding user u respectively j ; The edge node selects a large number k1 as the private key, and generates the public key Q1 through Q1=k1·P. The control center selects a large number k2 as the private key, and generates the public key Q2 through Q2=k2·P. The edge node and the control center both publish their public keys. The edge node calculates Q2·k1=k1·k2·P and stores it as a shared private key. The control center calculates Q1·k2=k1·k2·P and stores it as a shared private key. Let the encrypted private keys of both parties be s1=k1·k2·P. In the polymerization period T S Within each SM i Using private key p i Encryption power consumption m i , c i =m i +p i modP, c i Sent to edge nodes; in the current aggregation period T S At the end, the edge node checks the ciphertext c sent by all smart meters i And marked as online user collection For each user The edge node sends a reconstruction request to each u i Receive the request, u i Verify SM j The authenticity of the fault and all u j Send to u i Aggregate the shares of Will send To the edge node, the edge node collects User u i The valid share provided is recovered according to the reconstruction method in the Shamir (t,n) threshold secret sharing scheme Edge nodes aggregate all ciphertexts The edge node sends C and the set of faulty users to the control center; The control center uses AES(s1,l) to decrypt and obtain 2. The practical fault-tolerant data aggregation method without a trusted third party according to claim 1, characterized in that: In the Shamir (t,n) threshold secret sharing scheme based on the polynomial interpolation algorithm, the main secret is reconstructed using polynomial interpolation. Let t sub-secrets be (x i ,y i ), where y i =f(x i ),i=1,…,t and i≠j, when x i ≠x j , participants P1,...,P t Co-calculation: h(x) is a t-1 degree polynomial, since x i ≠x j , i≠j, the denominator of each addition term is non-zero, for i=1,...,t,y i =h(x i )=f(x i ), h(x)=f(x), participant P i Calculate h(0)=f(0)=s to recover the master secret s; For finite fields For a polynomial f(x) of degree n-1 on a finite field, there exist n elements in On, denoted as λ1,...,λ n , so that (λ1,...,λ n ) is the reorganized vector, for the matrix M: Let the secret distribution polynomial be f(x), and the participant P i The sub-secret held is f(i), f(0) = s = (λ1, ..., λ n )M(a0,a1,...,a n-1 ) T =λ1·f(1)+…+λ n f(n), computes the reconstructed vector (λ1,...,λ) by computing the image of the inverse matrix of the matrix M n ): (λ1,...,λ n )=(1,0,...,0)M -1 After obtaining the recombination vector, a secure multi-party computing protocol is constructed based on the Shamir threshold mechanism.

3. The practical fault-tolerant data aggregation method without a trusted third party according to claim 2, characterized in that: When constructing a secure multi-party computing protocol based on the Shamir threshold mechanism, let P = {P1,...,P n } is the set of participants, P i Holds input x i (1≤i≤n), jointly calculate the function f(x1,...,x n ), in a finite field The process of Shamir(t+1,n) threshold mechanism on is as follows: In the input phase, each participant P receives the input x i And secretly select a random polynomial f(x i ), satisfying fi(0)=x i , using Shamir(t+1,n) threshold secret sharing mechanism, P i Send fi(j) to participant P j ; In the calculation phase, assume that inputs a and b have been shared with each participant through random polynomials fa(x) and fb(x), and after t times through the Shamir threshold mechanism, f a (x)=m t x t +…+m1x 1 +af b (x)=n t x t +…+n1x 1 +b Where m t ...,m1,n t ..., n1 are random polynomial coefficients, Participant P i Holds subsecret a of input a i and sub-secret b of input b i , and perform multiple calculations.

4. The practical fault-tolerant data aggregation method without a trusted third party according to claim 1, characterized in that: Recover according to the reconstruction method in Shamir's (t,n) threshold secret sharing scheme When , the edge node calculates: Among them, L j is the Lagrange coefficient, is the sum of the masks and P is the modulus.

5. The practical fault-tolerant data aggregation method without a trusted third party according to claim 1, characterized in that: When the control center uses AES(s1,l) for decryption: Among them, C is the total ciphertext, s1 is the first round key, l is the number of rounds, and P is the modulus.

6. The practical fault-tolerant data aggregation method without a trusted third party according to claim 1, characterized in that: In the attacker model, it is assumed that users, edge nodes, control centers, and CSPs may attempt to obtain users’ private information while correctly following the protocol, based on the following assumptions: (1) Both the front-end node and the control center will follow the protocol, but they also want to obtain the value of a single smart meter reading; (2) Although each user hopes to pay as little electricity as possible, all smart meter users are honest and follow the protocol; (3) External adversaries have the ability to break into the control center, but can only obtain the final aggregated results and cannot obtain the private information of individual users.

7. The practical fault-tolerant data aggregation method without a trusted third party according to claim 1, characterized in that: The following four objectives are met: (1) External attackers cannot access the power consumption of a single user through information obtained through public channels; the front-end node cannot obtain the power consumption of a single user through the received ciphertext; the control center can only obtain the total aggregate data through decryption, but cannot obtain the power consumption of a single user; (2) During the data aggregation process, there is no need for a trusted third party to participate in decryption. The entire data aggregation process can be completed by the smart meter, front-end node, and control center; (3) When some electricity meters fail, the edge nodes can still correctly aggregate the power consumption of normal users to obtain the correct total power consumption, and allow users to go offline again during the secret reconstruction process; (4) Data aggregation operations do not require multiple interactions between users.

8. A practical fault-tolerant data aggregation system without the need for a trusted third party, characterized in that: Includes encryption service providers, control centers, edge nodes, and smart meters; The encryption service provider generates and configures the necessary encryption parameters during the system initialization phase; The control center performs the decryption process, obtains the correct aggregated data results, and processes the aggregated values; The edge node aggregates the ciphertext sent by the user and forwards the result to the control center; The smart meter collects the amount of electricity used by the user within the specified timestamp, performs encryption operations for privacy protection and sends the encrypted information to the connected edge node; Data aggregation is performed based on the practical fault-tolerant data aggregation method without the need for a trusted third party as described in any one of claims 1-7.

9. A computer device, characterized in that: It includes a processor and a memory, the memory is used to store a computer executable program, the processor reads part or all of the computer executable program from the memory and executes it, and when the processor executes part or all of the computer executable program, it can implement the practical fault-tolerant data aggregation method without a trusted third party as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: A computer program is stored in a computer-readable storage medium, and when the computer program is executed by a processor, the practical fault-tolerant data aggregation method without a trusted third party as described in any one of claims 1 to 7 can be implemented.

Images