Method and system for safely sharing traffic edge computing data

Abstract

The invention relates to the technical field of traffic data processing, and discloses a traffic edge computing data security sharing method and system, and the method comprises the steps: collecting traffic edge computing network multi-source heterogeneous data, and carrying out the classification standardization processing to generate a structured data set; designing a dynamic data sharing security protocol based on a multi-party security computing protocol and a homomorphic encryption algorithm; verifying the authority of a requester in a multi-level manner by using an attribute-based access control model and a zero-knowledge proof mechanism, and generating a dynamic access token; storing data by adopting a fragmentation storage and redundancy encryption strategy, and recording storage information through a hash chain; and dynamically adjusting the encryption strength and the sharing strategy according to the network threat level and the data sensitivity. The method effectively guarantees safe sharing of traffic data, accurately controls access authority, improves storage and sharing efficiency, adapts to complex network environment changes, and provides powerful support for development of an intelligent traffic system.

Description

Technical Field

[0001] The present invention relates to the field of traffic data processing technology, and specifically to a method and system for securely sharing traffic edge computing data. Background Art

[0002] With the rapid development of intelligent transportation systems, traffic edge computing networks generate massive amounts of multi-source heterogeneous data, which are of great value for traffic management, planning, and service optimization. However, current traffic data sharing faces many severe challenges.

[0003] Regarding data security, traffic data contains a wealth of sensitive information. For example, vehicle trajectory data can reveal drivers' travel habits and lifestyles, user identification data involves personal privacy, and roadside equipment status data is crucial for the safe operation of transportation infrastructure. Existing encryption technologies have limitations when handling complex traffic scenarios. Traditional encryption algorithms struggle to balance efficiency and security. Faced with ever-increasing data volumes and diverse attack vectors, ensuring data security during transmission and storage is difficult, and the risk of data leakage is extremely high.

[0004] There is a lack of effective, fine-grained access control mechanisms for access rights management. Different data requesters, such as research institutions, transportation service providers, and government departments, have varying data needs and purposes. However, existing methods often fail to accurately match the requester's permissions with the sensitivity of the data, making it prone to unauthorized access or abuse of permissions. For example, unauthorized third parties may obtain sensitive traffic data that exceeds their business needs, posing a data security risk.

[0005] Data storage and sharing efficiency is also a major challenge. Traffic data is highly real-time and involves large amounts of data. Traditional centralized storage methods face significant performance bottlenecks when processing large amounts of data, resulting in high storage costs and the potential for single points of failure. Furthermore, due to the complex data sources and diverse formats, a significant amount of data conversion and adaptation is required during the sharing process, severely impacting data sharing efficiency and making it impossible to meet the demands of traffic application scenarios with high real-time requirements, such as real-time traffic congestion warnings and intelligent traffic scheduling. Furthermore, the traffic network environment is complex and ever-changing, with a constant stream of cyber threats, such as DDoS attacks and malicious node intrusions. These attacks can lead to data loss, tampering, or service interruptions, further exacerbating the difficulties of securely sharing traffic data.

[0006] Furthermore, under the existing centralized storage architecture, data is stored centrally. Once the central node is attacked, the entire storage system will be paralyzed, and all traffic data will be at risk of being lost. Moreover, centralized storage will cause high data access latency, making it difficult to meet the demand for rapid data response in traffic scenarios. Static encryption strategies usually use fixed keys to encrypt data. During long-term use, the risk of key cracking continues to accumulate. Once the key is leaked, attackers can easily decrypt large amounts of historical and real-time data, leading to serious data security incidents. Traditional static encryption is also unable to cope with DDoS attacks. Attackers can use a large number of requests to exhaust system resources, causing the encryption and decryption processes to be blocked or even stagnant, resulting in interruptions in data transmission and sharing. Therefore, it is urgent to develop a method and system for secure sharing of traffic edge computing data that can effectively solve the above problems. Summary of the Invention

[0007] The purpose of the present invention is to provide a method and system for securely sharing traffic edge computing data to solve the problems raised in the above background technology.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a method for securely sharing traffic edge computing data, the method comprising:

[0009] Step S1: Collect multi-source heterogeneous data in the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identity data, and classify and standardize the data to generate a structured data set;

[0010] Step S2: Based on the multi-party secure computing protocol and homomorphic encryption algorithm, a dynamic data sharing security protocol is designed to define the role permissions of the data owner, requester, and edge node, and to construct an encryption parameter set, including the public key matrix, private key seed, and dynamic session key generation rules;

[0011] Step S3: Utilize the attribute-based access control model and zero-knowledge proof mechanism to perform multi-level verification of the access rights of the data requester, generate a dynamic access token, and synchronize the verification results through a distributed consensus mechanism among edge nodes;

[0012] Step S4: During the data sharing process, a sharded storage and redundant encryption strategy is adopted to split the structured data set into multiple data blocks according to preset rules. These blocks are encrypted and stored in different edge nodes. The storage location and integrity verification information of the data blocks are recorded through a hash chain.

[0013] Step S5: Dynamically adjust encryption strength and sharing strategies based on real-time network threat levels and data sensitivity, including updating session keys, resetting access token thresholds, and triggering data block resharding operations.

[0014] Preferably, in step S2, the dynamic data sharing security protocol further comprises the following steps:

[0015] Step S21: Define the role and permission sets of the protocol participants. The data owner has data encryption and authorization permissions. The requester needs to submit an attribute certificate and an operation intention statement. The edge node is responsible for transferring and verifying the encrypted data.

[0016] Step S22: Generate a public key matrix based on elliptic curve cryptography, and use a pseudo-random function to generate a private key seed. The dynamic session key is calculated through hash chain iteration. The calculation formula is:

[0017]

[0018] in, is a dynamically generated session key, is the previous round session key, is the current timestamp, is a random number; is a hash function, is the bitwise exclusive OR operator;

[0019] Step S23: During the protocol execution, a time window mechanism is introduced to limit the validity period of the key. After the timeout, the key update process is automatically triggered, and the new public key matrix is ​​broadcast through the edge node.

[0020] Preferably, in step S3, the multi-level verification specifically includes:

[0021] Step S31: Based on static verification of the attribute certificate, verify whether the attribute certificate submitted by the requester complies with the preset access policy tree;

[0022] Step S32: Dynamic behavior verification is performed through a zero-knowledge proof mechanism, requiring the requester to prove that its operation intention does not exceed the authorized scope and has not tampered with the original data request content;

[0023] Step S33: Using the Byzantine Fault Tolerant consensus algorithm, multiple edge nodes vote on the verification results. When more than a threshold proportion of nodes confirm that the verification is valid, a dynamic access token is generated.

[0024] Preferably, in step S4, the shard storage and redundant encryption strategy further includes:

[0025] Step S41: Divide the structured data set into core data blocks and non-core data blocks according to the data sensitivity level. The core data blocks are encrypted using a fully homomorphic encryption algorithm, and the non-core data blocks are encrypted using a symmetric encryption algorithm.

[0026] Step S42: Generate a unique identifier and integrity check code for each data block, and build an association relationship between data blocks through a Merkle tree;

[0027] Step S43: Randomly distribute the encrypted data blocks to edge nodes, and ensure that multiple copies of the same data set are stored in geographically isolated node groups during the distribution process.

[0028] Preferably, in step S5, the triggering conditions for dynamically adjusting the strategy include:

[0029] Step S51: Monitor the network threat level. When a DDoS attack or malicious node intrusion is detected, automatically increase the encryption strength to the highest level.

[0030] Step S52: Based on the change in data sensitivity, if the data is marked as a high sensitivity level, a data block resharding operation is triggered and the storage node selection strategy is updated;

[0031] Step S53: When the access token application frequency exceeds a preset threshold, a forced update mechanism for the session key is started.

[0032] Preferably, in step S23, the time window mechanism is further defined as:

[0033] Step S231: Set the key lifecycle as a dynamically adjustable parameter. The initial value is determined by the network load and data volume. The calculation formula is:

[0034]

[0035] in, is the effective life cycle of the dynamic key, is the total amount of data currently processed, For network delay, and is the weight coefficient;

[0036] Step S232: When the remaining validity period of the key is lower than the critical value, the edge node sends a key renewal request to the data owner and generates a new key after reaching a consensus.

[0037] Preferably, in step S33, the voting rules of the Byzantine fault-tolerant consensus algorithm include:

[0038] Step S331: Setting the voting weight to be positively correlated with the edge node's credibility score, which is dynamically calculated based on historical verification success rate and response time;

[0039] Step S332: If the voting result is a tie, a super node is introduced to make the final decision. The super node is designated by the data owner or generated by random selection.

[0040] Preferably, in step S43, the geographically isolated node group selection strategy includes:

[0041] Step S431: construct a topology map based on the geographical location information of the edge nodes, and calculate the physical distance and network hop count between the nodes;

[0042] Step S432: using the K-means clustering algorithm to divide the nodes into multiple regional groups, ensuring that copies of the same data set are stored in nodes in different regional groups.

[0043] Preferably, in step S52, the data sensitivity marking rules include:

[0044] Step S521: Parsing the data content based on natural language processing technology to identify fields containing personal identity information and real-time location information;

[0045] Step S522: Dynamically adjust the sensitivity level through a predefined rule engine based on the data usage scenario and compliance requirements.

[0046] Preferably, the present invention further includes a traffic edge computing data security sharing system, the system comprising:

[0047] The data acquisition and preprocessing module is used to collect multi-source heterogeneous data in the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identity data, and classify and standardize the data to generate a structured data set;

[0048] The security protocol design module designs a dynamic data sharing security protocol based on the multi-party secure computing protocol and homomorphic encryption algorithm, defines the role permissions of the data owner, requester, and edge node, and constructs a set of encryption parameters, including the public key matrix, private key seed, and dynamic session key generation rules;

[0049] The access rights verification module uses an attribute-based access control model and a zero-knowledge proof mechanism to perform multi-level verification of the data requester's access rights, generate a dynamic access token, and synchronize the verification results through a distributed consensus mechanism among edge nodes;

[0050] The data storage and encryption module uses sharding and redundant encryption strategies during data sharing to split structured data sets into multiple data blocks according to preset rules. These blocks are encrypted and stored in different edge nodes, and the storage location and integrity verification information of the data blocks are recorded through a hash chain.

[0051] The dynamic policy adjustment module dynamically adjusts encryption strength and sharing policies based on real-time network threat levels and data sensitivity, including updating session keys, resetting access token thresholds, and triggering data block resharding operations.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] The present invention designs a dynamic data sharing security protocol through a multi-party secure computing protocol and a homomorphic encryption algorithm, providing a solid foundation for data encryption. In the data storage link, a sharded storage and redundant encryption strategy is adopted to encrypt and store structured data sets according to sensitivity levels in different edge nodes, and the storage location and integrity verification information are recorded through a hash chain. This allows the data to be restored through redundant backups even if some data blocks are damaged when facing attacks, greatly reducing the risk of data leakage and loss, and effectively ensuring the security and integrity of the data. Multi-level verification is performed using an attribute-based access control model and a zero-knowledge proof mechanism to generate a dynamic access token. This method can not only perform static verification based on the attribute certificate submitted by the requester, but also perform dynamic behavior verification of the operation intention through a zero-knowledge proof mechanism to ensure that the requester's operation is legal and the request content has not been tampered with. At the same time, the introduction of the Byzantine fault-tolerant consensus algorithm allows multiple edge nodes to vote to decide the verification results, further improving the accuracy and reliability of access right verification, effectively preventing illegal access, and protecting the rights and interests of data owners.

[0054] The sharded storage strategy divides data and stores it across multiple edge nodes, avoiding the performance bottlenecks of centralized storage and improving storage efficiency and scalability. During the sharing process, data can be retrieved directly from edge nodes without requiring complex centralized processing, reducing data transmission and processing delays. Furthermore, by selecting different encryption algorithms based on data sensitivity, this ensures data security while balancing encryption and decryption efficiency, meeting the requirements of transportation applications with high real-time requirements, such as real-time traffic flow analysis and intelligent traffic signal control.

[0055] Dynamically adjust encryption strength and sharing policies based on real-time network threat levels and data sensitivity. When a DDoS attack or malicious node intrusion is detected, encryption strength is automatically increased. Changes in data sensitivity trigger data block resharding and storage node updates. Abnormal access token request frequency forces session key updates. This dynamic adjustment mechanism enables the system to promptly respond to complex and changing network environments, maintain optimal performance, and ensure the stability and security of data sharing.

[0056] By storing and processing data on distributed edge nodes, reliance on large-scale centralized servers is reduced, lowering hardware and maintenance costs. Furthermore, efficient data processing and security mechanisms mitigate potential losses due to data security issues, such as legal risks and business losses from data leaks, thereby improving the overall economic efficiency and sustainability of the system.

[0057] In summary, the present invention has significant advantages in data security, access control, storage and sharing efficiency, and network adaptability, and provides strong technical support for the development of intelligent transportation systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a workflow diagram of the method for securely sharing traffic edge computing data according to the present invention;

[0059] Figure 2 A workflow diagram for multi-level verification of access rights;

[0060] Figure 3 A workflow diagram for key lifecycle management and updates;

[0061] Figure 4 Workflow diagram for voting on the Byzantine Fault Tolerant consensus algorithm. DETAILED DESCRIPTION

[0062] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0063] See also Figure 1-4 The present invention provides a technical solution: a method for securely sharing traffic edge computing data, the method comprising:

[0064] Step S1: Collect multi-source heterogeneous data from the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identification data. After collection, this data is classified and standardized to generate a structured dataset. In practical application scenarios, such as urban transportation hubs, real-time traffic flow data is collected by sensors deployed at various intersections. These sensors may come from different manufacturers and have different data formats. By classifying the data, traffic flow data, vehicle trajectory data, etc. are categorized separately and processed according to a unified standard format, ensuring data consistency and facilitating subsequent analysis and use.

[0065] Step S2: Design a dynamic data sharing security protocol based on a multi-party secure computation protocol and homomorphic encryption algorithm. Define the roles and permissions of the data owner, requester, and edge node. Construct a set of encryption parameters, including a public key matrix, private key seed, and dynamic session key generation rules. This step ensures that the permissions of all parties involved in data sharing are properly defined. The encryption parameter settings provide a foundation for data encryption, ensuring data security during transmission and storage.

[0066] Step S3: Utilizing an attribute-based access control model and a zero-knowledge proof mechanism, we perform multi-level verification of the data requester's access rights, generate a dynamic access token, and synchronize the verification results through a distributed consensus mechanism among edge nodes. This multi-level verification strictly controls data access, ensuring that only legitimate requesters can obtain the corresponding data access rights, preventing unauthorized access and data leakage.

[0067] Step S4: During data sharing, a sharded storage and redundant encryption strategy is employed. Structured datasets are split into multiple data blocks according to pre-set rules. These blocks are encrypted and stored on different edge nodes. The storage location and integrity verification information for each block are recorded using a hash chain. This storage and encryption strategy improves data security and reliability, ensuring data integrity and availability even when some nodes fail or are attacked.

[0068] Step S5: Dynamically adjust encryption strength and sharing policies based on the real-time network threat level and data sensitivity, including updating session keys, resetting access token thresholds, and triggering data block resharding. Dynamic policy adjustments allow for timely adaptation to new security threats in a constantly changing network environment, ensuring the security and stability of data sharing.

[0069] The present invention will be further described below in conjunction with Examples 1 to 5:

[0070] Example 1:

[0071] This example describes in detail the specific implementation of the dynamic data sharing security protocol. Its purpose is to further clarify the operation process, key generation and update mechanism of the protocol participants, and ensure that data sharing is carried out under a secure framework. The specific steps include:

[0072] Step S21: Define the role permission set of the protocol participants. The data owner has the data encryption and authorization authority. For example, the traffic management department, as the data owner, has absolute control over the collected traffic data and can decide which data can be shared and with which requesting parties. The requesting party needs to submit an attribute certificate and a statement of operational intent. For example, if a scientific research institution wants to obtain some traffic flow data for research, then the scientific research institution, as the requesting party, needs to submit an attribute certificate that can prove its identity and research qualifications, and clearly declare the operational intention to obtain the data, such as for analyzing traffic congestion in a specific area. The edge node is responsible for the transfer and verification of encrypted data. During the data transmission process, the edge node receives the encrypted data from the data owner and verifies the access request from the requesting party. The data is forwarded to the requesting party only after the verification is passed.

[0073] Step S22: Generate a public key matrix based on elliptic curve cryptography and generate a private key seed using a pseudo-random function. The dynamic session key is calculated by hash chain iteration, and the calculation formula is:

[0074]

[0075] in, is a dynamically generated session key, is the previous round session key, is the current timestamp, is a random number; is a hash function, is a bitwise XOR operator. In actual operation, the public key matrix is ​​first generated using the relevant algorithms of elliptic curve cryptography to provide a public key basis for data encryption. The pseudo-random function generates a private key seed according to a specific algorithm. The private key seed and the public key matrix work together to encrypt and decrypt data. During each data sharing process, a new session key is calculated through a hash function and a bitwise XOR operation based on the previous round of session key, the current timestamp and the random number. For example, during a data transmission process, the previous round of session key is , the current timestamp is , the random number is , then the session key is calculated using the above formula , used to encrypt the currently transmitted data.

[0076] Step S23: During the protocol execution, a time window mechanism is introduced to limit the validity period of the key. After the timeout, the key update process is automatically triggered and the new public key matrix is ​​broadcast through the edge node. The time window mechanism is further defined as follows:

[0077] Step S231: Set the key lifecycle as a dynamically adjustable parameter. The initial value is determined by the network load and data volume. The calculation formula is:

[0078]

[0079] in, is the effective life cycle of the dynamic key, is the total amount of data currently processed, For network delay, and is the weighting factor. In practical applications, when network load is low and data volume is small, such as during nighttime periods with light traffic, the key lifetime calculated using the above formula may be relatively long. However, during peak traffic hours, when network load is high and data volume is high, the key lifetime may be shortened accordingly. By dynamically adjusting the key lifetime, we can adapt to different network environments and data processing requirements, thereby improving data security.

[0080] Step S232: When the remaining validity period of the key is lower than the critical value, the edge node sends a key renewal request to the data owner and generates a new key after reaching a consensus. Assume that the critical value of the key is set to the remaining validity period of , when the edge node detects that the remaining validity period of the current key is less than When the data owner receives the request, it negotiates with other relevant nodes. After reaching a consensus, it generates a new key according to the key generation rules and broadcasts the new public key matrix through the edge nodes to ensure that all nodes participating in data sharing can obtain the new key information and ensure the consistency of data encryption and decryption.

[0081] Example 2:

[0082] This embodiment focuses on multi-level verification of access rights. Its purpose is to more strictly control the access rights of data requesters through multi-dimensional verification methods to ensure the legitimacy and security of data access. The specific steps include:

[0083] Step S31: Based on the static verification of the attribute certificate, verify whether the attribute certificate submitted by the requester complies with the preset access policy tree. For example, in the traffic data sharing scenario, the preset access policy tree stipulates that only scientific research institutions with specific traffic research qualifications or specific personnel of the traffic management department can access certain sensitive traffic flow data. After the requester submits the attribute certificate, the system will compare the information in the certificate according to the access policy tree, including information such as institutional qualifications and personnel identity. If the requester is a scientific research institution, the system will check whether it is in the list of scientific research institutions allowed to access the data, and whether the submitted research project is consistent with the scope of use of the data. Only when it fully meets the requirements of the access policy tree will the static verification pass.

[0084] Step S32: Dynamic behavior verification is performed through a zero-knowledge proof mechanism, requiring the requester to prove that its operation intention does not exceed the authorized scope and that the original data request content has not been tampered with. In actual operation, suppose the requester wants to obtain real-time vehicle trajectory data on a certain road section for traffic congestion analysis. The requester needs to use the zero-knowledge proof mechanism to prove to the system that its operation intention is indeed for traffic congestion analysis and that the original data request has not been tampered with, without revealing the specific data request content. For example, the requester can use a specific encryption algorithm and proof protocol to generate a proof information. The system verifies this proof information to determine the legitimacy of the requester's operation intention and the content of the data request.

[0085] Step S33: Using the Byzantine Fault Tolerant consensus algorithm, multiple edge nodes vote on the verification results. When more than a threshold percentage of nodes confirm that the verification is valid, a dynamic access token is generated. The voting rules of the Byzantine Fault Tolerant consensus algorithm are as follows:

[0086] Step S331: Set the voting weight to be positively correlated with the credibility score of the edge node. The credibility score is dynamically calculated based on the historical verification success rate and response time. During the long-term data verification process, the edge node will record its historical verification success rate and response time. If an edge node has a high verification success rate and a short response time during multiple verification processes, then its credibility score is high and the corresponding voting weight will be larger. For example, edge node A has successfully verified 95 times in the past 100 verifications, and the average response time is ;Edge node B successfully verified 80 times, with an average response time of ,and , then the credibility score of edge node A will be higher than that of edge node B, and the voting weight of edge node A will also be greater during the voting process.

[0087] Step S332: If the voting results in a tie, a supernode is introduced for final decision-making. The supernode is designated by the data owner or randomly selected. In some cases, a tie may occur, such as when the number of edge nodes in favor and against a verification is equal. In this case, a supernode is introduced to ensure the certainty of the verification results. If the supernode is designated by the data owner, the data owner will select a reliable node as the supernode based on their own judgment. If the supernode is randomly selected, the system will select a supernode from qualified nodes according to a specific random algorithm. The supernode makes the final decision based on its own judgment and decides whether to generate a dynamic access token.

[0088] Example 3:

[0089] This example describes the specific implementation of the sharded storage and redundant encryption strategy. Its purpose is to improve data security and reliability and reduce the risk of data loss and leakage through reasonable data segmentation, encryption, and storage methods. Specific steps include:

[0090] Step S41: Divide the structured data set into core data blocks and non-core data blocks according to the data sensitivity level. The core data blocks are encrypted using a fully homomorphic encryption algorithm, and the non-core data blocks are encrypted using a symmetric encryption algorithm. In traffic data, for example, the real-time location information of the vehicle, the user's identity identification data, etc. belong to the core data blocks. These data involve personal privacy and traffic safety and are highly sensitive. They are encrypted using a fully homomorphic encryption algorithm. The fully homomorphic encryption algorithm allows specific computing operations to be performed on the ciphertext without decryption, so that the data can be analyzed and processed in an encrypted state, further ensuring data security. For some non-core data blocks, such as certain traffic flow statistics, their sensitivity is relatively low and they can be encrypted using a symmetric encryption algorithm. The symmetric encryption algorithm has the advantage of fast encryption and decryption speed, which can meet the demand for fast processing of non-core data blocks.

[0091] Step S42: Generate a unique identifier and integrity check code for each data block, and establish an association relationship between data blocks through the Merkle tree. During the data processing process, each data block is assigned a unique identifier, such as a UUID (Universally Unique Identifier), to ensure that each data block has a unique identifier in the system. At the same time, a hash algorithm is used to generate an integrity check code for each data block to verify whether the data block has been tampered with during storage and transmission. The hash values ​​of each data block are organized through the Merkle tree to establish an association relationship between data blocks. The hash value of the root node of the Merkle tree can represent the integrity of the entire data set. If a data block is tampered with, its corresponding hash value will change, which will cause the hash value of the root node of the Merkle tree to change. By comparing the root node hash value, it can be found whether the data has been tampered with.

[0092] Step S43: Randomly distribute the encrypted data blocks to edge nodes, and ensure that multiple copies of the same data set are stored in geographically isolated node groups during the distribution process. The geographically isolated node group selection strategy is as follows:

[0093] Step S431: Build a topology map based on the geographic location information of edge nodes and calculate the physical distance and network hop count between nodes. Using Geographic Information System (GIS) technology, the geographic location information of each edge node is obtained to construct a node topology map. The topology map provides a visual representation of the location distribution of each node. By calculating the physical distance and network hop count between nodes, the connection strength between nodes and the data transmission delay can be assessed. For example, if the physical distance between nodes A and B is long and the number of network hops is high, this indicates that there may be significant data transmission delay between them.

[0094] Step S432: Use the K-means clustering algorithm to divide the nodes into multiple regional groups, ensuring that copies of the same dataset are stored in nodes in different regional groups. The K-means clustering algorithm is a commonly used clustering analysis algorithm. By dividing nodes into K regional groups, the distance between nodes in the same regional group is relatively small, while the distance between different regional groups is relatively large. During data storage, multiple copies of the same dataset are stored in nodes in different regional groups. For example, three copies of a traffic dataset are stored in nodes in regional group 1, regional group 2, and regional group 3, respectively. This ensures data availability even if a node in one regional group is attacked or fails, copies in other regional groups can still be used.

[0095] Example 4:

[0096] This embodiment elaborates on the triggering conditions for dynamic policy adjustment. Its purpose is to timely adjust encryption strength and sharing policies based on changes in network threat levels and data sensitivity. The specific steps include:

[0097] Step S51: Monitor the network threat level. When a DDoS attack or malicious node intrusion is detected, the encryption strength is automatically increased to the highest level. In the transportation edge computing network, network security monitoring equipment is deployed to monitor network traffic and node activity in real time. When a large amount of abnormal traffic is detected that meets the characteristics of a DDoS attack, or when a malicious node is found attempting to intrude on the system, the system immediately activates the encryption strength enhancement mechanism. The encryption algorithm is switched to a higher level, such as switching from the current encryption algorithm to an algorithm with higher encryption strength, while increasing the length and complexity of the key to ensure data security in the event of an attack.

[0098] Step S52: Based on the change in data sensitivity, if the data is marked as highly sensitive, the data block resharding operation is triggered and the storage node selection strategy is updated. The data sensitivity marking rules are as follows:

[0099] Step S521: Analyze the data content using natural language processing technology to identify fields containing personal identification information and real-time location information. Traffic data is analyzed using text analysis algorithms within natural language processing technology. For example, if vehicle trajectory data contains personal identification information such as the owner's name or ID number, or the vehicle's precise real-time location information, these fields will be identified and used as a basis for determining the data's sensitivity.

[0100] Step S522: Dynamically adjust the sensitivity level through a predefined rule engine based on the data usage scenario and compliance requirements. If the data was originally used for general traffic flow statistics analysis and has a low sensitivity level, but is subsequently used for a research project involving personal privacy, the predefined rule engine will raise the data's sensitivity level to a high sensitivity level based on changes in compliance requirements and usage scenarios. When data is marked as highly sensitive, the system triggers a data block resharding operation, re-dividing the original data blocks and updating the storage node selection strategy to select nodes with higher security and better geographical isolation to store these highly sensitive data blocks.

[0101] Step S53: When the application frequency of access token exceeds the preset threshold, the forced update mechanism of session key is started. The system will count the application frequency of access token in real time and preset a threshold. For example, the number of application times of access token cannot exceed times. When it is detected that the application frequency exceeds When this happens, the system considers it possible that there is abnormal access behavior and initiates a mandatory session key update mechanism. According to the session key generation rules, a new session key is regenerated and all relevant nodes are notified to update the session key to ensure the security of data encryption and prevent unauthorized users from obtaining data by frequently applying for access tokens.

[0102] Example 5:

[0103] The present invention also includes a secure sharing system for traffic edge computing data. This embodiment details how the various modules of the system work together and the specific implementation details. Its purpose is to demonstrate the operating mechanism of the entire system and ensure that the system can efficiently and securely share traffic edge computing data. The system includes:

[0104] Data Collection and Preprocessing Module: This module is responsible for collecting multi-source, heterogeneous data from the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identification data. In actual deployments, sensors, such as geomagnetic sensors and cameras, are installed at various intersections and road sections in the city to collect real-time traffic flow and vehicle trajectory data. Roadside equipment uses its own monitoring system to collect roadside equipment status data, such as traffic light operating status and road sensor fault information. User identification data is obtained through the authentication information provided when the user logs into the system. The collected data comes in various formats and requires classification and standardization. For example, traffic flow data collected by different sensors is uniformly converted into a specified format, and vehicle trajectory data is standardized according to a specific coordinate system. This ultimately generates a structured dataset for processing by subsequent modules.

[0105] Security Protocol Design Module: Designs a dynamic data sharing security protocol based on a multi-party secure computation protocol and homomorphic encryption algorithm. During the design process, existing multi-party secure computation protocols and homomorphic encryption algorithms were referenced and optimized based on the characteristics of traffic data sharing. Roles and permissions for data owners, requesters, and edge nodes were defined, and a set of encryption parameters, including a public key matrix, private key seed, and dynamic session key generation rules, were constructed. This module works in conjunction with the Data Collection and Preprocessing Module. After data collection is complete, encryption parameters and protocol rules are determined based on the data's characteristics and security requirements, providing security for data encryption and sharing.

[0106] Access Rights Verification Module: This module utilizes an attribute-based access control model and a zero-knowledge proof mechanism to perform multi-level verification of the access rights of data requesters. This module receives the attribute certificate and operational intent statement submitted by the requester and, in conjunction with the access policy defined in the Security Protocol Design Module, performs static and dynamic behavioral verification. By collaborating with multiple edge nodes and utilizing a Byzantine Fault Tolerance consensus algorithm, verification results are voted on to generate a dynamic access token. During system operation, the Access Rights Verification Module works closely with the Data Collection and Preprocessing Module and the Security Protocol Design Module to ensure that only legitimate requesters can obtain data access rights, preventing unauthorized access and data leakage.

[0107] Data storage and encryption module: In the process of data sharing, shard storage and redundant encryption strategies are adopted. Structured data sets are divided according to the data sensitivity level. After obtaining the processed structured data set from the data acquisition and preprocessing module, it is divided into core data blocks and non-core data blocks according to the division rules in Example 3. For core data blocks, a fully homomorphic encryption algorithm is used for encryption; non-core data blocks are encrypted using a symmetric encryption algorithm. The encrypted data blocks will be assigned a unique identifier and an integrity check code, and the association relationship between data blocks will be constructed with the help of the Merkle tree. According to the geographically isolated node group selection strategy, data blocks are randomly assigned to different edge nodes for storage, ensuring that multiple copies of the same data set are stored in nodes in different regional groups, thereby improving the security and reliability of data storage, and cooperating with other modules to ensure the security of data in the storage link.

[0108] Dynamic policy adjustment module: Dynamically adjusts encryption strength and sharing strategy according to the real-time network threat level and data sensitivity. This module continuously monitors network threat situations and automatically increases encryption strength when DDoS attacks, malicious node intrusions, and other situations occur as described in Example 4. At the same time, based on data content analysis and changes in usage scenarios, if the data sensitivity changes, such as being marked as a high sensitivity level, it triggers data block re-sharding operations and updates to storage node selection strategies. When the access token application frequency exceeds the preset threshold, the session key forced update mechanism is activated. This module works closely with other modules to dynamically optimize data security sharing strategies based on the real-time status of the system during operation, ensuring that the system continues to operate stably in a complex and changing network environment.

[0109] In the traffic edge computing data security sharing system described in this invention, each module works collaboratively. First, the data acquisition and preprocessing module collects multi-source heterogeneous data from the traffic edge computing network, such as real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identification data. It then classifies and standardizes data according to established rules, outputting a structured data set, which is then passed to subsequent modules.

[0110] After receiving a structured dataset, the security protocol design module designs a dynamic data sharing security protocol based on a multi-party secure computation protocol and homomorphic encryption algorithm. This module clearly defines the roles and permissions of the data owner, requester, and edge node. For example, the data owner controls data encryption and authorization, the requester must submit an attribute certificate and a statement of intent, and the edge node is responsible for encrypted data transfer and verification. Furthermore, a set of encryption parameters is constructed, including a public key matrix, a private key seed, and dynamic session key generation rules. The public key matrix is ​​generated using elliptic curve cryptography, the private key seed is created using a pseudo-random function, and the dynamic session key is calculated using a specific hash chain iteration formula. A time window mechanism is also introduced, determining the initial key lifecycle based on network load and data volume. When expiration is near, the edge node requests renewal from the data owner, and a new key is replaced when consensus is reached.

[0111] The access permission verification module obtains the requesting party information and first uses static verification based on attribute certificates to verify whether its attribute certificates comply with the preset access policy tree. It then uses a zero-knowledge proof mechanism to conduct dynamic behavior verification to ensure that the operation intention is compliant and the data has not been tampered with. Finally, it relies on the Byzantine fault-tolerant consensus algorithm to assign voting weights based on the edge node credibility score (linked to the historical verification success rate and response time). In case of a tie, a super node is introduced to make a ruling. If the proportion of nodes exceeding the threshold is recognized, a dynamic access token is generated, and the results are synchronized with the help of the edge node distributed consensus mechanism.

[0112] The data storage and encryption module receives structured data sets and distinguishes core and non-core data blocks according to the data sensitivity level. The former is processed using a fully homomorphic encryption algorithm, and the latter is processed using a symmetric encryption algorithm. A unique identifier and integrity check code are generated for each data block, and associations are established using a Merkle tree. The encrypted data blocks are randomly assigned to geographically isolated edge nodes for storage based on the regional groups divided by the node geographic location information, physical distance, and number of network hops using the K-means clustering algorithm. The storage details are recorded using a hash chain.

[0113] The dynamic policy adjustment module monitors the network threat level in real time, and immediately increases the encryption strength to the highest level in the event of a DDoS attack or node intrusion. Based on natural language processing technology and a predefined rule engine, data is marked with sensitivity based on data content, usage scenarios, and compliance requirements. Higher sensitivity triggers data block re-sharding and storage strategy updates. Once the access token application frequency exceeds the preset threshold, the session key is forced to be updated to fully guarantee the secure sharing of traffic edge computing data.

[0114] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0115] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for securely sharing traffic edge computing data, characterized in that: The steps include: Step S1: Collect multi-source heterogeneous data in the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identity data, and classify and standardize the data to generate a structured data set; Step S2: Based on the multi-party secure computing protocol and homomorphic encryption algorithm, a dynamic data sharing security protocol is designed to define the role permissions of the data owner, requester, and edge node, and to construct an encryption parameter set, including the public key matrix, private key seed, and dynamic session key generation rules; Step S3: Utilize the attribute-based access control model and zero-knowledge proof mechanism to perform multi-level verification of the access rights of the data requester, generate a dynamic access token, and synchronize the verification results through a distributed consensus mechanism among edge nodes; Step S4: During the data sharing process, a sharded storage and redundant encryption strategy is adopted to split the structured data set into multiple data blocks according to preset rules. These blocks are encrypted and stored in different edge nodes. The storage location and integrity verification information of the data blocks are recorded through a hash chain. Step S5: Dynamically adjust encryption strength and sharing strategies based on real-time network threat levels and data sensitivity, including updating session keys, resetting access token thresholds, and triggering data block resharding operations.

2. The method for securely sharing traffic edge computing data according to claim 1, characterized in that: In step S2, the dynamic data sharing security protocol further includes the following steps: Step S21: Define the role and permission sets of the protocol participants. The data owner has data encryption and authorization permissions. The requester needs to submit an attribute certificate and an operation intention statement. The edge node is responsible for transferring and verifying the encrypted data. Step S22: Generate a public key matrix based on elliptic curve cryptography, and use a pseudo-random function to generate a private key seed. The dynamic session key is calculated through hash chain iteration. The calculation formula is: in, is a dynamically generated session key, is the previous round session key, is the current timestamp, is a random number; is a hash function, is the bitwise exclusive OR operator; Step S23: During the protocol execution, a time window mechanism is introduced to limit the validity period of the key. After the timeout, the key update process is automatically triggered, and the new public key matrix is ​​broadcast through the edge node.

3. The method for securely sharing traffic edge computing data according to claim 1, characterized in that: In step S3, the multi-level verification specifically includes: Step S31: Based on static verification of the attribute certificate, verify whether the attribute certificate submitted by the requester complies with the preset access policy tree; Step S32: Dynamic behavior verification is performed through a zero-knowledge proof mechanism, requiring the requester to prove that its operation intention does not exceed the authorized scope and has not tampered with the original data request content; Step S33: Using the Byzantine Fault Tolerant consensus algorithm, multiple edge nodes vote on the verification results. When more than a threshold proportion of nodes confirm that the verification is valid, a dynamic access token is generated.

4. The method for securely sharing traffic edge computing data according to claim 1, characterized in that: In step S4, the shard storage and redundant encryption strategy further includes: Step S41: Divide the structured data set into core data blocks and non-core data blocks according to the data sensitivity level. The core data blocks are encrypted using a fully homomorphic encryption algorithm, and the non-core data blocks are encrypted using a symmetric encryption algorithm. Step S42: Generate a unique identifier and integrity check code for each data block, and build an association relationship between data blocks through a Merkle tree; Step S43: Randomly distribute the encrypted data blocks to edge nodes, and ensure that multiple copies of the same data set are stored in geographically isolated node groups during the distribution process.

5. The method for securely sharing traffic edge computing data according to claim 1, characterized in that: In step S5, the triggering conditions for dynamically adjusting the strategy include: Step S51: Monitor the network threat level. When a DDoS attack or malicious node intrusion is detected, automatically increase the encryption strength to the highest level. Step S52: Based on the change in data sensitivity, if the data is marked as a high sensitivity level, a data block resharding operation is triggered, and the storage node selection strategy is updated; Step S53: When the access token application frequency exceeds a preset threshold, a forced update mechanism for the session key is started.

6. The method for securely sharing traffic edge computing data according to claim 2, characterized in that: In step S23, the time window mechanism is further defined as: Step S231: Set the key lifecycle as a dynamically adjustable parameter. The initial value is determined by the network load and data volume. The calculation formula is: in, is the effective life cycle of the dynamic key, is the total amount of data currently processed, For network delay, and is the weight coefficient; Step S232: When the remaining validity period of the key is lower than the critical value, the edge node sends a key renewal request to the data owner and generates a new key after reaching a consensus.

7. The method for securely sharing traffic edge computing data according to claim 3, characterized in that: In step S33, the voting rules of the Byzantine Fault Tolerant consensus algorithm include: Step S331: Setting the voting weight to be positively correlated with the edge node's credibility score, which is dynamically calculated based on historical verification success rate and response time; Step S332: If the voting result is a tie, a super node is introduced to make the final decision. The super node is designated by the data owner or generated by random selection.

8. The method for securely sharing traffic edge computing data according to claim 4, characterized in that: In step S43, the geographically isolated node group selection strategy includes: Step S431: construct a topology map based on the geographical location information of the edge nodes, and calculate the physical distance and network hop count between the nodes; Step S432: using the K-means clustering algorithm to divide the nodes into multiple regional groups, ensuring that copies of the same data set are stored in nodes in different regional groups.

9. The method for securely sharing traffic edge computing data according to claim 5, characterized in that: In step S52, the data sensitivity marking rules include: Step S521: Parsing the data content based on natural language processing technology to identify fields containing personal identity information and real-time location information; Step S522: Dynamically adjust the sensitivity level through a predefined rule engine based on the data usage scenario and compliance requirements.

10. A traffic edge computing data security sharing system, characterized in that: include: The data acquisition and preprocessing module is used to collect multi-source heterogeneous data in the traffic edge computing network, including real-time traffic flow data, vehicle trajectory data, roadside equipment status data, and user identity data, and classify and standardize the data to generate a structured data set; The security protocol design module designs a dynamic data sharing security protocol based on the multi-party secure computing protocol and homomorphic encryption algorithm, defines the role permissions of the data owner, requester, and edge node, and constructs a set of encryption parameters, including the public key matrix, private key seed, and dynamic session key generation rules; The access rights verification module uses an attribute-based access control model and a zero-knowledge proof mechanism to perform multi-level verification of the data requester's access rights, generate a dynamic access token, and synchronize the verification results through a distributed consensus mechanism among edge nodes; The data storage and encryption module uses sharding and redundant encryption strategies during data sharing to split structured data sets into multiple data blocks according to preset rules. These blocks are encrypted and stored in different edge nodes, and the storage location and integrity verification information of the data blocks are recorded through a hash chain. The dynamic policy adjustment module dynamically adjusts encryption strength and sharing policies based on real-time network threat levels and data sensitivity, including updating session keys, resetting access token thresholds, and triggering data block resharding operations.

Images