Cloud edge-end collaborative data security joint computing method and system

Abstract

The application discloses a kind of cloud edge end collaborative data security joint computing method and system, can realize cloud edge end collaborative environment data joint statistics and safe calculation under the premise of guaranteeing user privacy security.Through introducing and improving Paillier encryption algorithm, so that the application completes the aggregation, cooperation and query of data in the ciphertext domain, effectively avoids the leakage of user original data.While maintaining the accuracy of statistical results, the application supports sum, mean, variance, extreme value and other statistical tasks, taking into account the dual-layer computing needs of edge server and cloud center server, to meet the flexibility of query in different scenarios.In addition, the security collaboration mechanism and difference ciphertext comparison method designed by the application significantly reduce the computing and communication overhead, improve the overall efficiency of the system without loss of calculation accuracy, with strong scalability and practical application value.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a cloud-edge-device collaborative data security joint computing method and system. Background Technology

[0002] With the deep integration of cloud computing, edge computing, and smart terminals, cloud-edge-device collaboration has become a crucial trend in next-generation intelligent network architecture. This architecture fully leverages the computing power of the cloud, the low latency of edge nodes, and the real-time data sensing capabilities of the terminal side to achieve efficient data processing and intelligent services. In this process, how to complete cross-level joint data statistics and analysis while ensuring user data privacy has become a core issue that urgently needs to be addressed. Especially in application scenarios with extremely high data security requirements, such as healthcare, intelligent transportation, energy and power, and financial risk control, common data statistical needs, such as comparison, summation, mean, variance, and frequency, will inevitably lead to privacy leaks if performed directly in plaintext. Therefore, exploring a secure method to perform the above statistical operations in encrypted form and adapting it to the cloud-edge-device collaborative architecture has significant research and application value.

[0003] Existing research has made some progress in data security computing technologies in cloud-edge-device collaborative environments. These technologies typically combine homomorphic encryption, multi-party secure computation, and layered aggregation frameworks to improve the privacy protection capabilities of data processing, but some shortcomings still exist. The patent "Blockchain-based Semi-Homomorphic Encryption IoT Privacy Protection Scheme" (application number 2024106507850, publication number CN118473635A) applied for by Hunan University of Science and Technology discloses a semi-homomorphic encryption scheme for IoT / edge scenarios, emphasizing encrypted aggregation and access control of data in a multi-layered architecture of device-edge-cloud, and achieving aggregation statistics. The patent "A Cloud-Edge-Device Chain Collaborative Management and Control Method and System for Engineering Monitoring Data" (application number 2024112850477, publication number CN118802382A) applied for by Huazhong University of Science and Technology covers a five-layer collaborative structure: cloud server, cloud consortium blockchain, edge consortium blockchain, edge device, and terminal device. By using consortium blockchains to generate and transmit public and private keys, the security and traceability of each layer in operations such as data encryption, model distribution and updates, and model integration are guaranteed. This is suitable for the secure collection and collaborative processing of real-time engineering monitoring data.

[0004] However, the aforementioned existing technology has the following problems:

[0005] (1) In the field of cloud-edge-device collaborative data security joint design, most related technologies adopt single-layer joint statistical protocols. Such protocols can only adapt to the needs of a single architecture level and cannot flexibly cope with the complex application scenarios of multi-device collaboration and multi-scenario interaction under the current cloud, edge and device three-level architecture. This results in poor compatibility between the protocol and the actual deployment environment, making it difficult to meet the needs of data security joint processing between devices at different levels.

[0006] (2) Existing algorithms for cloud-edge-device collaborative data security joint design have poor performance when processing multi-source heterogeneous data, with high data processing latency. Furthermore, as the number of participating devices increases or the data scale expands, the algorithms are difficult to scale efficiently and lack scalability, which seriously restricts the application efficiency of cloud-edge-device collaborative architecture in large-scale data processing scenarios.

[0007] (3) The current cloud-edge-device collaborative data security joint solution supports a very limited range of computing types. It can only handle simple summation and statistical computing tasks, and cannot meet the diverse computing needs common in cloud-edge-device scenarios. Its scope of application is narrow.

[0008] (4) Existing cloud-edge-device collaborative data security joint design methods and systems face many security risks during data transmission, storage and joint computing. For example, the lack of effective identity authentication and access control mechanisms can easily lead to unauthorized device access, imperfect data encryption schemes can easily cause data leakage, and it is difficult to resist attacks launched by malicious nodes. Overall security and reliability need to be improved. Summary of the Invention

[0009] To address the aforementioned problems in the existing technology, this invention provides a cloud-edge-device collaborative data security joint computing method and system. The technical problem to be solved by this invention is achieved through the following technical solution:

[0010] In a first aspect, embodiments of the present invention provide a cloud-edge-device collaborative data security joint computing method, applied to a system including authoritative and trusted institutions, user terminals, edge servers, and cloud center servers, wherein one edge server serves all user terminals in a region, and every two edge servers form a group; the corresponding method includes:

[0011] System initialization process: An authoritative and trusted institution generates a first secure random number, key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm, and distributes the first secure random number to each edge server, distributes the public key in the key parameters to each user terminal and edge server, and distributes the private key in the key parameters to the cloud center server and any edge server in each group of edge servers;

[0012] Data encryption and upload process: Each user terminal in the area collects raw data and preprocesses the raw data to obtain preprocessed data. Based on the Paillier encryption algorithm, the preprocessed data and the square of the preprocessed data are encrypted according to the corresponding public key, and the encrypted data is assigned a corresponding interval identifier. The encrypted data and the corresponding assigned interval identifier are sent to the corresponding edge server.

[0013] The encrypted aggregation and collaborative computation process for each group of edge servers is as follows: Edge servers in the group without distributed private keys perform aggregation computation on encrypted data from the same user terminal based on the Paillier encryption algorithm to obtain locally aggregated encrypted data. They locate extreme value candidate intervals based on the interval identifiers of the encrypted data and generate a second secure random number. Within the extreme value candidate interval, they construct local difference comparison ciphertext based on the second secure random number and the encrypted data. This locally aggregated encrypted data and local difference comparison ciphertext are then sent to the edge servers in the group that have distributed private keys. The edge servers in the group that have distributed private keys construct local difference comparison ciphertext based on the local comparison ciphertext and decrypt the locally aggregated encrypted data using their private keys. The encrypted data is compared with the local difference. Based on the local decryption results, local statistical results including local sums, local means, local variances, and local extrema are calculated. These local statistical results are sent to edge servers in the group that have not distributed private keys. The local decryption results are then encrypted using the improved Impaillier encryption algorithm and the corresponding public key. The encrypted local data is then sent to the central server. Each edge server in the group generates a third secure random number. Based on the first secure random parameter, the third secure random number, and the encrypted data, the comparison encrypted data is constructed. The comparison encrypted data is then encrypted using the Impaillier encryption algorithm and the corresponding public key. The new comparison encrypted data is then sent to the central server.

[0014] Ciphertext aggregation and global calculation process: Based on the improved Impaillier encryption algorithm, the cloud center server aggregates and calculates the local encrypted data from all edge servers to obtain global aggregated encrypted data. It constructs global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. It decrypts the new global aggregated encrypted data and global difference comparison ciphertext based on the corresponding private key, and calculates global statistical results including global sum, global mean, global variance, and global extrema based on the global decryption results.

[0015] Secondly, embodiments of the present invention provide a cloud-edge-device collaborative data security joint computing system. The system includes an authoritative and trusted institution, user terminals, edge servers, and a cloud center server. One edge server serves all user terminals in a region, and every two edge servers form a group.

[0016] The authoritative and trustworthy institution includes a security system parameter selection module, a first secure random number generation module, a secure random number distribution module, a key generation module, and a key distribution module. The security parameter selection module is used to select security system parameters according to system requirements. The first secure random number generation module generates a first secure random number that meets the system requirements. The secure random number distribution module distributes the first secure random number to each edge server. The key generation module generates key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm according to the security system parameters. The key distribution module distributes the public key in the key parameters to each user terminal and edge server, and distributes the private key in the key parameters to the cloud center server and any edge server in each group of edge servers.

[0017] Each user terminal in the region includes a local data acquisition module, a data preprocessing module, a first data encryption module, an interval identification module, and a data and identification sending module. The local data acquisition module is used to collect the user's local raw data. The data preprocessing module is used to preprocess the raw data. The first data encryption module is used to encrypt the preprocessed data and the square of the preprocessed data based on the Paillier encryption algorithm and the corresponding public key. The interval identification module is used to assign interval identifiers to the encrypted data. The data and identification sending module is used to send the encrypted data and the corresponding assigned interval identifiers to the corresponding edge server.

[0018] Each edge server group without a distributed private key includes a first ciphertext aggregation module, a second secure random number generation module, a first extreme value comparison module, and a first data transmission module. The first ciphertext aggregation module is used by the edge servers in each group without a distributed private key to aggregate encrypted data from the same user terminal based on the Paillier encryption algorithm, obtaining locally aggregated encrypted data. The second secure random number generation module generates a second secure random number. The first extreme value comparison module locates extreme value candidate intervals based on the interval identifier of the encrypted data, and constructs locally difference comparison ciphertext within the extreme value candidate intervals based on the second secure random number and the encrypted data. The first data transmission module sends the locally aggregated encrypted data and the locally difference comparison ciphertext to the edge servers in the group that have distributed private keys.

[0019] Each edge server group, distributed with a private key, includes a computational collaboration module, a second data sending module, a second data encryption module, and a third data sending module. The computational collaboration module constructs a local difference comparison ciphertext based on the local comparison ciphertext, decrypts the local aggregate encrypted data and the local difference comparison ciphertext using the private key, and calculates local statistical results, including local sums, local means, local variances, and local extrema, based on the local decryption results. The second data sending module sends the local statistical results to edge servers in the group that do not have a distributed private key. The second data encryption module encrypts the local decryption results using the improved Impaillier encryption algorithm and the corresponding public key. The third data sending module sends the locally encrypted data to the central server.

[0020] Each edge server in each group also includes a third secure random number generation module, a comparison ciphertext construction module, and a fourth data sending module; the third secure random number generation module is used to generate a third secure random number; the comparison ciphertext construction module is used to construct comparison ciphertext data based on the first secure random parameter, the second secure random number, and the encrypted data, and encrypt the comparison ciphertext data based on the Paillier encryption algorithm and the corresponding public key; the fourth data sending module is used to send the new comparison ciphertext data to the central server;

[0021] The cloud center server includes a second ciphertext aggregation module, a second extreme value comparison module, and a global calculation module. The second ciphertext aggregation module is used to perform aggregation calculations on the locally aggregated encrypted data from all edge servers based on the improved Impaillier encryption algorithm to obtain globally aggregated encrypted data. The second extreme value comparison module is used to construct a global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. The global calculation module is used to decrypt the globally aggregated encrypted data and the global difference comparison ciphertext based on the corresponding private key, and calculate global statistical results including global sum, global mean, global variance, and global extreme values ​​based on the global decryption results.

[0022] The beneficial effects of this invention are:

[0023] This invention proposes a cloud-edge-device collaborative data security joint computation method that combines Paillier encryption with secure multi-party computation technology. It can not only perform routine statistical operations such as sum, mean, and variance, but also achieve efficient and privacy-preserving computations for complex tasks such as extreme value calculations. While ensuring user data security, it expands the application scope in distributed environments and enhances the system's functional integrity and versatility. This invention optimizes and improves the traditional Paillier encryption algorithm, significantly improving the efficiency of encryption and decryption operations while maintaining the original security strength. Under the premise of meeting security requirements, it greatly reduces computational overhead and communication load, providing higher practical value for privacy-preserving data aggregation and querying. This invention fully considers the special application scenarios of cloud-edge-device collaboration, supporting the processing of millions of data points on the user terminal side, ensuring scalability and efficiency even in large-scale distributed environments. This design provides a feasible reference for industrial deployment, and is particularly suitable for complex network environments requiring high-concurrency data acquisition and real-time processing. This invention achieves end-to-end security protection for data processing. User data is encrypted or scrambled at each stage, including collection, uploading, aggregation, and computation. Even during interactions between edge servers and cloud center servers, user privacy is not leaked. Particularly in the extreme value calculation stage, the efficient encrypted comparison mechanism designed in this invention can complete rapid calculations without exposing plaintext, significantly improving the overall performance and security of the system. Overall, the cloud-edge-device joint computing framework constructed by this invention provides an efficient, secure, and industrially deployable solution for privacy-preserving data aggregation and query services, possessing significant application and promotion value.

[0024] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating a cloud-edge-device collaborative data security joint computing method provided in an embodiment of the present invention;

[0026] Figure 2 This is a schematic diagram illustrating the calculation principle of extreme values ​​in the user terminal-edge server layer and the edge server-cloud center server layer provided in the embodiments of the present invention;

[0027] Figure 3 This is a flowchart illustrating another cloud-edge-device collaborative data security joint computing method provided in an embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of a cloud-edge-device collaborative data security joint computing system provided in an embodiment of the present invention. Detailed Implementation

[0029] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0030] Firstly, please see Figure 1 This invention provides a cloud-edge-device collaborative data security joint computing method, applied to a system including authoritative and trusted institutions, user terminals, edge servers, and cloud center servers. One edge server serves all user terminals in a region, and every two edge servers form a group. The corresponding method includes:

[0031] System initialization process: An authoritative and trusted institution generates a first secure random number, key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm, and sends the first secure random number to the cloud center server. The public key in the key parameters is distributed to each user terminal and edge server, and the private key in the key parameters is distributed to the cloud center server and any edge server in each group of edge servers.

[0032] Data encryption and upload process: Each user terminal in the area collects raw data and preprocesses the raw data to obtain preprocessed data. Based on the Paillier encryption algorithm, the preprocessed data and the square of the preprocessed data are encrypted according to the corresponding public key, and the encrypted data is assigned a corresponding interval identifier. The encrypted data and the corresponding assigned interval identifier are sent to the corresponding edge server.

[0033] The encrypted aggregation and collaborative computation process for each group of edge servers is as follows: Edge servers in the group without distributed private keys perform aggregation computation on encrypted data from the same user terminal based on the Paillier encryption algorithm to obtain locally aggregated encrypted data. They locate extreme value candidate intervals based on the interval identifiers of the encrypted data and generate a second secure random number. Within the extreme value candidate interval, they construct local difference comparison ciphertext based on the second secure random number and the encrypted data. This locally aggregated encrypted data and local difference comparison ciphertext are then sent to the edge servers in the group that have distributed private keys. The edge servers in the group that have distributed private keys decrypt the locally aggregated encrypted data and local difference comparison ciphertext using their private keys. Based on the local decryption results, local statistical results including local sums, local means, local variances, and local extrema are calculated. These local statistical results are sent to edge servers in the group that have not distributed private keys. The local decryption results are then encrypted using the improved Impaillier encryption algorithm and the corresponding public key, and the encrypted data is sent to the central server. Each edge server in the group generates a third secure random number. Based on the first and third secure random parameters and the encrypted data, it constructs comparison ciphertext data. Using the Impaillier encryption algorithm and the corresponding public key, the comparison ciphertext data is encrypted, and the new comparison ciphertext data is sent to the central server.

[0034] Ciphertext aggregation and global calculation process: Based on the improved Impaillier encryption algorithm, the cloud center server aggregates and calculates the local encrypted data from all edge servers to obtain global aggregated encrypted data. It constructs global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. It decrypts the new global aggregated encrypted data and global difference comparison ciphertext based on the corresponding private key, and calculates global statistical results including global sum, global mean, global variance, and global extrema based on the global decryption results.

[0035] Next, the implementation of each process will be described in detail.

[0036] Regarding the system initialization process:

[0037] The entire system's key initialization and distribution are handled by a trusted authority (TA). At the user terminal-edge server layer: the Paillier encryption algorithm is referenced from the standard. The TA assigns a key to each edge server. Generate a set of Paillier key pairs The subscript represents the sequence number of the edge server. This represents the public key used when employing the Paillier encryption algorithm. This represents the private key used when employing the Paillier encryption algorithm. When the user terminal... Belongs to the edge area At that time, only the corresponding public key is obtained. And use the public key for encryption. Send to the edge server. For the edge server-cloud center server layer: generate a key pair using an improved Impaillier encryption algorithm. , This represents the public key used when employing the improved Impaillier encryption algorithm. This indicates the private key used when employing the improved Impalie encryption algorithm, and... Distribute to various edge servers. The public key is sent to the cloud center server. The improved Impaillier algorithm, while retaining the features of the original algorithm, supports splitting the public key across multiple edge servers. This algorithm not only optimizes the computational efficiency of the encryption and decryption processes and reduces the computational load, but is also more suitable for large-scale distributed computing scenarios in federated learning.

[0038] The specific steps of the improved Impaillier encryption algorithm include:

[0039] In the algorithm initialization, assuming there is an authoritative and trusted authority (TA), a cloud center server (CSP), and multiple user terminals (DO), then: given a security parameter... TA first through Generate key parameters for the Paillier encryption algorithm, including the private key. ) and public key ).in, It is an integer that satisfies Then TA needs to choose a random large integer. satisfy and guarantee Then the calculations were performed. Finally, the public key parameter is obtained. .

[0040] In order to generate a different private key for each user terminal, for For each user terminal, the first thing the TA will do is... (The product of random large prime numbers p and q) is randomly divided into A random number ,in Then TA will choose a random positive integer. This serves as the task ID for each secure aggregation. Finally, calculate... The private key is then distributed to each user terminal. The specific steps include:

[0041] (1) Data encryption:

[0042] For each user terminal DO, assume the plaintext is... So the encrypted ciphertext It can be obtained through the formula:

[0043]

[0044] in, It is a random number that satisfies , Indicates user terminal The private key.

[0045] (2) Data aggregation:

[0046] Targeting from The encrypted data of a user terminal DO can be processed by the cloud center server CSP using a formula. Each ciphertext is aggregated into :

[0047]

[0048] (3) Decryption of aggregation results:

[0049] In the cloud center server CSP The ciphertext aggregation of each user terminal DO is as follows Then the private key can be used Decryption yields data :

[0050]

[0051] in, .

[0052] In the above algorithm, the present invention improves the original Paillier encryption algorithm. This algorithm is not only more suitable for application scenarios such as a single cloud center server and multiple edge servers in the edge server-cloud center server hierarchy, but also can optimize the traditional federated dual-cloud architecture into a more efficient and secure single-cloud architecture.

[0053] At the user terminal-edge server level: during the extreme value calculation process, the edge server, upon receiving encrypted data from the user terminal, is required to construct a difference comparison ciphertext using the homomorphic properties of the Paillier key. , , For edge servers to receive encrypted data from user terminals, , The second safest random number, This approach compares user terminal data while ensuring data security and privacy. For the edge server-cloud center server layer: Due to the unique one-to-many scenario, encrypted comparison data is first constructed on a separate set of edge servers. and , The first safest random number, , As a third-level security random number, the cloud center server compares two sets of encrypted ciphertext data. and Constructing global difference comparison ciphertext Comparison is required. The same requirement applies to this. .like Figure 2 As shown, Global statistics at the edge server-cloud center server level are provided, including global sums and values. Global mean Global variance and global extrema , Local statistical results at the user terminal-edge server level are presented, including local sums and values. Local mean Local variance and local extrema .

[0054] Therefore, authoritative and trusted institutions need to select encryption algorithms that conform to the Paillier encryption algorithm and the improved ImpPaillier encryption algorithm, as well as secure random numbers required in the difference comparison ciphertext construction process, including the encryption algorithm's... Parameters, and the first secure random number .

[0055] First, based on the selected security system parameters, the corresponding public key is generated using the Paillier encryption algorithm. ) and private key ( The public key is assigned to the user terminal for encrypting data, while the private key is assigned to the selected edge server within the collaboration group and simultaneously sent to the cloud center server.

[0056] Subsequently, the authoritative and trusted institution also needs to generate public key parameters based on the security system parameters and using the Impaillier encryption algorithm. This allows the calculation of public keys for different user terminals. Then, the generated private key Send it to the cloud center server.

[0057] Furthermore, authoritative and trusted institutions need to correctly distribute secure random numbers. The same large random number should be used across different edge servers as the first secure random parameter for comparing the scrambled difference ciphertext. And ensure that all edge servers generate secure random numbers locally, such as second-level secure random numbers. All are much smaller than the first safety random parameter Among them, all random numbers The generation of these numbers requires the use of secure random numbers and must not be shared with external parties.

[0058] Different rounds use independent secure random numbers, and the key parameters are updated in each round to prevent replay attacks.

[0059] Regarding the data encryption and upload process:

[0060] After receiving the key parameters, the user terminal preprocesses the raw data collected locally to obtain preprocessed data. This preprocessing includes cleaning, format standardization, encoding, and combination / arrangement of the raw data to obtain a data structure that meets system requirements and ensures that the data conforms to the value range of the encryption algorithm. Then, using a public key distributed by an authoritative and trusted institution, the raw data is encrypted based on the Paillier encryption algorithm. ,in , Represents the original data. This indicates that the original data is encrypted using a public key. Furthermore, to facilitate subsequent calculations of the difference on the edge server, this invention also requires squaring the original data using the same method. Encryption is performed to generate all encrypted data, which is then sent to the edge server within its jurisdiction. The user terminal only needs to perform encryption and upload.

[0061] Since the amount of data on user terminals is in the millions, to accelerate the comparison of extreme values, the user terminal needs to perform interval marking on the original data based on the known range of the original data. This invention assigns corresponding interval identifiers to encrypted data during the data encryption and uploading process, including: using a bucketing encoding algorithm to assign corresponding interval identifiers to the encrypted data. This invention introduces bucketing encoding (interval marking) technology, which pre-divides the encrypted data into several intervals on the user terminal, ensuring that the interval division meets the requirements of subsequent processing, and assigns corresponding interval identifiers. This process associates interval markers with encrypted data, forming "ciphertext-interval" pairs. This allows the edge server to quickly locate the extreme value candidate set for comparison, significantly reducing computational overhead. Finally, the user terminal securely uploads the processed encrypted data and its interval markers to the edge server within its jurisdiction.

[0062] For the ciphertext aggregation and collaborative computation process of each group of edge servers:

[0063] The encrypted aggregation and collaborative computation process of each group of edge servers includes the calculation of local statistical results for local sums, local means, and local variances. This includes: Calculation of local sums: Edge servers in each group without private keys aggregate encrypted data corresponding to preprocessed data from the same user terminal using the Paillier encryption algorithm to obtain first locally aggregated encrypted data, and send this first locally aggregated encrypted data to the edge servers in that group that have private keys. Edge servers in each group with private keys decrypt the first locally aggregated encrypted data using their corresponding private keys to obtain local sums, and then encrypt the local sums using the improved ImpPaillier encryption algorithm and the corresponding public key, sending the encrypted local sums to the central server. Calculation of local means: The local mean is calculated based on the local sums and the total number of local ciphertexts; where the total number of local ciphertexts is... The calculation process for the local variance is as follows: Edge servers in each group that distribute private keys serve all user terminals' raw data. The process involves: Edge servers in each group that do not distribute private keys aggregate the encrypted data corresponding to the squares of preprocessed data from the same user terminal using the Paillier encryption algorithm to obtain a second local aggregated encrypted data. This second local aggregated encrypted data is then sent to the edge servers in that group that distribute private keys. Edge servers in each group that distribute private keys decrypt the second local aggregated encrypted data using their corresponding private keys to obtain a local sum of squares. Based on the improved Impaillier encryption algorithm and the corresponding public key, they encrypt the local sum of squares and send it to the central server. Finally, the local mean of squares is calculated based on the local sum of squares and the total number of local ciphertexts. The local variance is then calculated based on the local mean and the local mean of squares.

[0064] The ciphertext aggregation and collaborative computation process for each group of edge servers includes the calculation of local statistical results for local extrema, including:

[0065] Edge servers in each group that do not distribute private keys determine extreme value candidate intervals based on the interval identifiers of the encrypted data, and filter out all encrypted data within the extreme value candidate intervals. They then randomly select two encrypted data from all the encrypted data within the extreme value candidate intervals, construct local difference comparison ciphertexts based on the homomorphic property of the Paillier key and the second secure random number, and send these ciphertexts to the edge servers in the same group that have distributed private keys. Each edge server in the group that has distributed private keys decrypts the local difference comparison ciphertexts using its corresponding private key to obtain a local comparison result, and sends this result to the edge servers in the same group that have not distributed private keys. Each edge server in the group that has not distributed private keys, based on the local comparison result, randomly selects one encrypted data from the remaining encrypted data within the extreme value candidate intervals to construct the next round of local difference comparison ciphertexts, until all encrypted data within the extreme value candidate intervals have been compared, thus obtaining the local extreme value.

[0066] More specifically, assume that ciphertext aggregation and collaborative computation occur on an edge server. and edge servers between, and They are in a group. No private key was distributed. Distributed with a private key:

[0067] Receive all encrypted data from the user terminal, when Upon receiving the encrypted data, the homomorphic property of the Paillier encryption algorithm is used to perform an aggregation operation on the encrypted data. Specifically, for the received encrypted data: through calculation... This involves performing an aggregation operation on the encrypted data corresponding to all preprocessed data to obtain the first local aggregated encrypted data. At the same time, through calculation This involves performing an aggregation operation on the encrypted data corresponding to the squares of all preprocessed data to obtain the second locally aggregated encrypted data. It is important to note that a single edge server cannot decrypt the aggregated ciphertext; edge servers must work in pairs to decrypt the aggregated value. Do not possess the private key ( ),therefore It cannot be decrypted; its sole responsibility is to aggregate the encrypted data. Send the completed aggregated encrypted data, along with the total number of raw user terminal data points you've collected, to another collaborator within the group. , Having only aggregated encrypted data, it is impossible to maliciously obtain data from individual user terminals. This method is similar to the dual-cloud architecture in federated learning, and its main core purpose is to ensure data privacy and security.

[0068] when Aggregate encrypted data and Send to back, Can be with The local sums, local means, local variances, and local extrema of these aggregated encrypted data are calculated collaboratively. The specific calculation process is as follows:

[0069] (1) Local summation operation. When Received first partial aggregated encrypted data Then, you can use your private key to calculate This is used to decrypt and obtain the local sum. After obtaining the local sum, Again Send the local sum and value to inform The final sum of all user terminal data within the jurisdiction is determined. For subsequent calculations of global statistics, the local sum is encrypted using the improved Impaillier encryption algorithm and the corresponding public key, and then sent to the central server.

[0070] (2) The operation of finding the local mean. Similarly, when Received first partial aggregated encrypted data Then, you can use your private key to calculate To decrypt and obtain local sum values, at the same time It will also receive the amount of raw data from all user terminals it serves. 1. At this time It can be calculated To obtain the final local mean .Then Again Send local mean ,inform What is the final average value of all user terminal data within the jurisdiction?

[0071] (3) Calculating the local variance. The formula for calculating variance is: A variance statistic describes the dispersion of a random variable around its central location, reflecting the degree of dispersion of the variable's values. In scenarios involving secure joint computation, another formula for variance calculation can be used for ease of calculation. . Using formula Solve for the variance. First, regarding... , Received first partial aggregated encrypted data Then, you can use your private key to calculate The local sum is calculated in this way, and then the local mean is obtained using the received values. Then targeting ,exist send It also came with Therefore when Received second part of aggregated encrypted data Then, you can also calculate using your own private key. Solve for the local sum of squares. Then, based on the amount of original data... 1. Find the local mean square. The value. Finally, after the edge server finishes calculating... and Then, the local variance can be calculated. .at the same time It is also necessary to inform Calculation Results. For subsequent calculation of global statistical results, the local sum of squares is encrypted using the improved Impaillier encryption algorithm and the corresponding public key, and then sent to the central server.

[0072] (4) Finding local extrema. The calculation of finding local extrema at the edge server-client layer can be regarded as the result of comparing multiple sets of data. The user terminal only needs to encrypt the data and then upload it. After receiving the encrypted data, it is necessary to base it on two encrypted data. and Constructing the difference comparison ciphertext Specifically By leveraging the homomorphic properties of Paillier keys, through computation This allows the construction of difference comparison ciphertext. Then send the encrypted difference comparison data to... This allows for the comparison of two encrypted data sets. However, the problem is that in a full comparison scenario, the time complexity can be as high as [missing value]. If a comparison-by-comparison approach is used, the time complexity is O(log n). However, this would incur significant communication overhead. Therefore, this invention designs a bucket coding (interval marking) technique. When generating encrypted data, the user terminal matches the encrypted data to the corresponding interval marker and uploads both the interval marker and the encrypted data to the edge server. At this point, This allows for precise localization of the interval containing the extreme value, enabling the construction of a locally compared ciphertext. Then, the locally compared ciphertext is transmitted... , After obtaining the locally compared ciphertext, we can construct and decrypt the locally differencing ciphertext, thus obtaining the size relationship of the encrypted data. More specifically: This cannot be accomplished through a single round of communication; therefore, it requires... Trigger a collaboration request. Here, let's assume... A request to compare encrypted text was triggered. Based on the interval identifier, all encrypted data within the interval containing the extreme value will be filtered out. Then, for the encrypted data within the interval identifier, a difference comparison ciphertext will be constructed using the homomorphic property of the Paillier key. ,here , For the two encrypted data within the interval identifier, and For the reason The generated second secure random number. When Compare the difference to the ciphertext Send to back, Decrypting this difference comparison ciphertext using your private key yields a scrambled value. The sign of this value reflects the difference between the two encrypted data. and Size. You can inform The size results of these two encrypted data. Next round, Based on the comparison results, the next round of difference comparison ciphertext can be constructed, allowing for multi-round collaborative solving. In the final round, After the terminal obtains the size comparison results of all encrypted data within the interval identifier, it can send the local extrema of the user terminal to Thus, the two The extreme value was obtained through multiple rounds of encrypted comparison and query.

[0073] This invention utilizes this bucketing encoding technique to divide data into... When dealing with a given interval, the algorithm's complexity can be reduced to [a certain value]. At the same time, the law of large numbers tells us that when the sample size... When the sample size is large enough, it will likely follow a population distribution. In real-world applications, especially with large datasets following a normal distribution, the data falling within... The probability of something other than that is much smaller. So even if it targets With millions of data points, only a few thousand extreme value comparisons are needed. Having only the perturbed difference compared to the ciphertext, the original data cannot be recovered even after decryption. Therefore, in joint data security statistics between the cloud, edge, and endpoint, this solution can better protect the privacy of user data.

[0074] Regarding the ciphertext aggregation and global computation process:

[0075] The calculation process of global statistical results, including global sum, global mean, and global variance, during encrypted aggregation and global computation includes:

[0076] The calculation process for the global sum: Based on the improved Impaillier encryption algorithm, the cloud center server aggregates and calculates the local encrypted data corresponding to the first local aggregated encrypted data from all edge servers to obtain the first global aggregated encrypted data. The first global aggregated encrypted data is then decrypted using the corresponding private key to obtain the global sum. The calculation process for the global mean: The global mean is calculated based on the global sum and the total number of global ciphertexts. The total number of global ciphertexts represents the amount of original data from all user terminals in the entire region. The calculation process for the global variance: Based on the improved Impaillier encryption algorithm, the cloud center server aggregates and calculates the local encrypted data corresponding to the second local aggregated encrypted data from all edge servers to obtain the second global aggregated encrypted data. The second global aggregated encrypted data is then decrypted using the corresponding private key to obtain the global sum of squares. The global sum of squares and the total number of global ciphertexts are then used to calculate the global mean of squares. Finally, the global variance is calculated based on the global mean and the global mean of squares.

[0077] The calculation process of global statistical results, including global extrema, during ciphertext aggregation and global computation includes:

[0078] Two edge servers are randomly selected to send comparison ciphertext data to construct a global difference comparison ciphertext. The global difference comparison ciphertext is then decrypted using the corresponding private key to obtain the global comparison result. Based on the global comparison result, one edge server is randomly selected from the remaining edge servers to send comparison ciphertext data to construct the next round of global difference comparison ciphertext. This process continues until the comparison ciphertext data of all edge servers is compared, at which point the global extreme value is obtained.

[0079] More specifically:

[0080] For encrypted data computation on cloud center servers, improvements to the Paillier encryption algorithm make the solution for encrypted data highly suitable for this network topology, eliminating the need for collaboration from multiple edge servers. The specific computation process is as follows:

[0081] (1) Global sum operations. After calculating the local sum within the region, the algorithm uses its own public key in the improved Impaillier encryption algorithm. Encrypting local sums: Then, each group This allows the encrypted local sum and value to be... It is sent to the central server. Once the central server receives all the encrypted parts and values, it can then... Aggregate all encrypted local sums and values. Once aggregation is complete, the private key can be used to compute... Obtain the final global sum value.

[0082] (2) Global mean operation. The central server still needs to first calculate the encrypted local sum value it receives. ,pass Aggregate all encrypted local sums and values. Once aggregation is complete, the private key can be used to compute... The final global sum value is obtained. After obtaining the global sum value, the central server will also receive the raw data counts from all user terminals within the region. 2. Based on the global sum and the value received by itself 2. Solving for the global mean .

[0083] (3) Operations on the global variance value. This still requires the use of formulas. Solving for the global variance, specifically The solution operation is the same as the operation for (2) global mean, and the global mean can be obtained. . In the process of solving the problem, each group is required to In addition to encrypting the local sums of the preprocessed data using the improved Impaillier encryption algorithm, it is also necessary to encrypt the local sums of squares corresponding to the squares of the preprocessed data. Therefore, the central server will receive all the encrypted local sums of squares. The central server then uses the same computational process to aggregate and decrypt all local sums of squares, obtaining... When the central server receives... and Then you can calculate The final global variance value is obtained.

[0084] (4) Global Extremum Operation. In the process of finding the global extremum at the central server-edge server level, the idea of ​​comparing two encrypted data points remains similar. However, due to the one-to-many network topology, the solution at the edge server-client level has several problems. First, data is not shared between different edge servers, which means that a single edge server cannot construct a difference comparison ciphertext similar to local extremum solving. Secondly, the central server possesses all the private keys; if only encryption is used... Sending it to the central server could trigger a statistical analysis attack from the central server. It also cannot be like... Similarly, new collaborations are being introduced. Therefore, the central server cannot refer to the difference comparison ciphertext when constructing it. Instead of the previous scheme, an alternative scheme for constructing ciphertext using difference comparison is proposed. Specifically: an authoritative and trusted institution distributes the first secure random number... At this time, all are required at this level Using the same first secure random number, then in each group of edge servers Comparison ciphertext data can be constructed based on the Paillier encryption algorithm. and Third-level secure random number and It is randomly generated by the edge server itself, and it needs to be ensured that... Once the central server receives these two ciphertexts, it can use the homomorphic properties of the Paillier key to construct the final global difference comparison ciphertext. After decryption, the size of the ciphertext can be determined based on the decryption result. If there are more edge servers, multiple comparisons may be required. Finally, the central server will obtain the corresponding global extremum after comparison.

[0085] Overall, the approach to finding the global extremum in the central server-edge server layer is similar to that in the edge server-client layer. However, due to the one-to-many network topology of this layer and the different jurisdictions of the servers... Since data cannot be directly exchanged between them, this invention requires the introduction of an additional perturbation factor and places the final generation step of the global difference comparison ciphertext on the central server. Due to the characteristics of the improved Impaillier encryption algorithm, the central server can only obtain the aggregated data of the encrypted local statistical results and cannot obtain the data of a single edge server. This mechanism can not only effectively protect the data security of the edge server side, but also avoid the central server from maliciously obtaining the original data.

[0086] Further, please see Figure 3 The cloud-edge-device collaborative data security joint computing method proposed in this invention is also applied to systems that include service requesters; the corresponding method also includes:

[0087] Data query process: The data requester initiates a computation query request to the cloud center server or edge server to obtain global statistical results from the cloud center server or local statistical results from the edge server. Specifically:

[0088] The service requester can choose to initiate queries either on the edge server side or the cloud center server side. Queries on the edge server side provide local statistical results within their respective jurisdictions, while queries on the cloud center server side provide global statistical results. The query request types primarily include calculating local sums, local means, local variances, and local extrema, as well as calculating global sums, global means, global variances, and global extrema. Throughout the entire query process, the service requester does not need to hold any keys or access the original data, ensuring data privacy and query accuracy while balancing flexibility and efficiency.

[0089] As can be seen, this invention aims to address the problems of poor single-layer protocol adaptability, insufficient algorithm performance, narrow coverage of computation types, and prominent security risks in existing cloud-edge-device collaborative scenarios, and to improve the overall efficiency, security, and functionality of the system under a cloud-edge-device architecture. The invention makes the following improvements to existing technologies:

[0090] Layered Collaborative Security Architecture: This invention breaks through the limitations of traditional single-layer joint statistical protocols, constructing a two-tier collaborative architecture at the edge and cloud levels. At the edge level, a combination of the Paillier encryption algorithm and a secure multi-party computation algorithm is used to lay the foundation for data security protection and joint processing. At the cloud level, by improving the Paillier encryption algorithm, secure joint statistics for corresponding scenarios are achieved under a single cloud architecture, realizing efficient collaboration and security protection across the entire cloud-edge-edge architecture.

[0091] Highly Efficient and Secure Security at All Levels: This invention addresses the characteristics of a two-tiered cloud-edge-device architecture by matching targeted technical solutions at different levels, ensuring efficient, secure, and complete operation at both the device-edge and cloud-edge levels. The device-edge level mitigates data leakage risks through collaborative edge server support, while the cloud-edge level leverages the improved Impaillier encryption algorithm to reduce communication and computational overhead while ensuring data security during transmission and computation, forming a comprehensive security protection system.

[0092] Diverse Ciphertext Computation Support: This invention breaks through the limitation of existing solutions with only one type of calculation. Under the cloud-edge-device collaborative architecture, it supports multiple calculation types such as summation, mean, variance, and extreme values ​​in ciphertext. Complex statistical calculations can be completed without decrypting the data into plaintext, which not only meets the diverse data processing needs in cloud-edge-device scenarios, but also avoids the privacy leakage risks caused by plaintext processing.

[0093] Cloud-edge architecture adaptation and optimization: This invention proposes an improved Impaillier encryption algorithm for single-cloud architecture application scenarios, optimizing data interaction and joint statistical processes at the cloud-edge level. Under a cloud-edge architecture, it ensures both the accuracy of secure joint statistical data and avoids issues such as complex collaboration and high latency that may occur in multi-cloud architectures, improving the adaptability and operational efficiency of cloud-edge collaboration in single-center server scenarios.

[0094] In summary, the cloud-edge-device collaborative data security joint computation method proposed in this invention combines Paillier encryption and secure multi-party computation technology. It can not only perform routine statistical operations such as sum, mean, and variance, but also achieve efficient privacy-preserving computation for complex tasks such as extreme value calculation. While ensuring user data security, it expands the application scope in distributed environments and enhances the system's functional integrity and versatility. This invention optimizes and improves the traditional Paillier encryption algorithm, significantly improving the efficiency of encryption and decryption operations while maintaining the original security strength. Under the premise of meeting security requirements, it greatly reduces computational overhead and communication load, providing higher practical value for privacy-preserving data aggregation and querying. This invention fully considers the special application scenarios of cloud-edge-device collaboration, supporting the processing of millions of data points on the user terminal side, ensuring scalability and efficiency even in large-scale distributed environments. This design provides a feasible reference for industrial deployment, and is particularly suitable for complex network environments requiring high-concurrency data acquisition and real-time processing. This invention achieves end-to-end security protection for data processing. User data is encrypted or scrambled at each stage, including collection, uploading, aggregation, and computation. Even during interactions between edge servers and cloud center servers, user privacy is not leaked. Particularly in the extreme value calculation stage, the efficient encrypted comparison mechanism designed in this invention can complete rapid calculations without exposing plaintext, significantly improving the overall performance and security of the system. Overall, the cloud-edge-device joint computing framework constructed by this invention provides an efficient, secure, and industrially deployable solution for privacy-preserving data aggregation and query services, possessing significant application and promotion value.

[0095] Secondly, please see Figure 4 This invention provides a cloud-edge-device collaborative data security joint computing system. The system includes an authoritative and trusted institution, user terminals, edge servers, and a cloud center server. One edge server serves all user terminals in a region, and every two edge servers form a group.

[0096] The authoritative and trustworthy institution includes a security system parameter selection module, a first secure random number generation module, a secure random number distribution module, a key generation module, and a key distribution module. The security parameter selection module is used to select security system parameters according to system requirements. The first secure random number generation module generates a first secure random number that meets the system requirements. The secure random number distribution module distributes the first secure random number to each edge server. The key generation module generates key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm according to the security system parameters. The key distribution module distributes the public key in the key parameters to each user terminal and edge server, and distributes the private key in the key parameters to the cloud center server and any edge server in each group of edge servers.

[0097] Each user terminal in the region includes a local data acquisition module, a data preprocessing module, a first data encryption module, an interval identification module, and a data and identification sending module. The local data acquisition module is used to collect the user's local raw data. The data preprocessing module is used to preprocess the raw data. The first data encryption module is used to encrypt the preprocessed data and the square of the preprocessed data based on the Paillier encryption algorithm and the corresponding public key. The interval identification module is used to assign interval identifiers to the encrypted data. The data and identification sending module is used to send the encrypted data and the corresponding assigned interval identifiers to the corresponding edge server.

[0098] There is no edge server in each group of edge servers that distributes private keys. The system comprises a first ciphertext aggregation module, a second secure random number generation module, a first extreme value comparison module, a first data transmission module, a second data encryption module, and a second data transmission module. The first ciphertext aggregation module is used by edge servers in each group that do not have a distributed private key to aggregate encrypted data from the same user terminal using the Paillier encryption algorithm to obtain locally aggregated encrypted data. The second secure random number generation module generates a second secure random number. The first extreme value comparison module locates extreme value candidate intervals based on the interval identifier of the encrypted data, and constructs locally difference comparison ciphertext within the extreme value candidate intervals based on the second secure random number and the encrypted data. The first data transmission module sends the locally aggregated encrypted data and the locally difference comparison ciphertext to the edge servers in the group that have distributed private keys.

[0099] Each group of edge servers distributes a private key to the edge servers ( The system comprises a computational collaboration module, a second data transmission module, a second data encryption module, and a third data transmission module. The computational collaboration module is used to decrypt locally aggregated encrypted data and locally difference comparison ciphertext using a private key, and to calculate local statistical results, including local sums, local means, local variances, and local extrema, based on the local decryption results. The second data transmission module is used to send the local statistical results to edge servers in the group that have not distributed private keys. The second data encryption module is used to encrypt the local decryption results using the improved Impaillier encryption algorithm and the corresponding public key. The third data transmission module is used to send the locally encrypted data to the central server.

[0100] Each edge server in each group also includes a third secure random number generation module, a comparison ciphertext construction module, and a fourth data sending module; the third secure random number generation module is used to generate a third secure random number; the comparison ciphertext construction module is used to construct comparison ciphertext data based on the first secure random parameter, the third random number, and the encrypted data, and encrypt the comparison ciphertext data based on the Paillier encryption algorithm and the corresponding public key; the fourth data sending module is used to send the new comparison ciphertext data to the central server;

[0101] The cloud center server includes a second ciphertext aggregation module, a second extreme value comparison module, and a global calculation module. The second ciphertext aggregation module is used to perform aggregation calculations on the locally aggregated encrypted data from all edge servers based on the improved Impaillier encryption algorithm to obtain globally aggregated encrypted data. The second extreme value comparison module is used to construct a global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. The global calculation module is used to decrypt the globally aggregated encrypted data and the global difference comparison ciphertext based on the corresponding private key, and calculate global statistical results including global sum, global mean, global variance, and global extreme values ​​based on the global decryption results.

[0102] The cloud-edge-device collaborative data security joint computing system provided in this embodiment of the invention also includes a data requester; the data requester initiates a computing query request to the cloud center server or the edge server to obtain global statistical results obtained from the cloud center server or local statistical results obtained from the edge server.

[0103] Authoritative and trusted institutions: At the user terminal-edge server level, an independent Paillier key is generated for each region under the jurisdiction of the edge server to ensure data isolation and security between different regions; at the edge server-central server level, an improved Impaillier key is generated and the key parameters required for encryption and decryption are distributed to the edge server and the central server respectively. At the same time, it is also necessary to ensure and coordinate the generation and distribution of secure random numbers to ensure that all nodes operate under a unified security framework, thereby laying the foundation for encrypted data processing and secure transmission.

[0104] User terminals can be various types of data acquisition devices, including sensors, mobile phones, smart motion-sensing devices, and other devices that can generate valid data. The user terminal is responsible for collecting raw data and preprocessing it; it also encrypts the preprocessed data and its squares using the Paillier encryption algorithm. Furthermore, to optimize the efficiency of solving for extreme values, interval identifiers need to be assigned to the encrypted data. Finally, the encrypted data and corresponding interval identifiers can be uploaded to the edge server. These processes ensure that the data uploaded to the edge server meets security requirements and is easy to aggregate later.

[0105] Edge Servers: Edge servers serve as the middle layer for data processing. Throughout the process, they collaborate on ciphertext processing, receiving and processing data uploaded by user terminals within their designated area. First, in the ciphertext aggregation calculation phase, they receive encrypted data and its squared value from user terminals. Combining this with interval identifiers, they quickly locate and compare extreme values. Leveraging the homomorphic properties of the Paillier key, they aggregate at the ciphertext level, generating interval statistical results and difference comparison ciphertext. Next, in the ciphertext collaborative calculation phase, edge servers within the group collaborate via secure communication protocols, transmitting and coordinating the computation between nodes to obtain extreme values ​​or other statistical results (sum, mean, variance) without decrypting the original data, thus achieving privacy-preserving computation under distributed conditions.

[0106] Central Server: The central server is the central node for global aggregation and computation, used to integrate the encrypted results from multiple edge servers globally. After the edge servers have finished processing, it receives ciphertext statistical results uploaded from edge servers in different groups and regions, and uses the improved Impaillier encryption algorithm for global aggregation and necessary decryption. For extreme value operations, the central server performs further calculations by comparing the scrambled difference with the ciphertext to ensure both privacy and computational accuracy. Through this process, the central server can generate global statistical results. This design avoids the central server directly accessing the raw data while ensuring the correctness of cross-regional data statistics and analysis, providing efficient support for cross-regional and cross-node data services.

[0107] Service requester: The service requester is the end user and can choose to initiate query requests on either the edge server or the central server, depending on their needs. Their local data is uploaded to the corresponding node after encryption. Whether it's summation, mean, variance, or extreme value calculation, it can be completed smoothly while protecting privacy. The service requester can obtain local statistical results quickly through the edge server or obtain more accurate global statistical results through the central server, thus achieving a flexible choice between security and efficiency.

[0108] This invention proposes a cloud-edge-device collaborative data security joint computing system that enables joint data statistics and secure computation in a cloud-edge-device collaborative environment while ensuring user privacy and security. By introducing and improving the Paillier encryption algorithm, this invention completes data aggregation, collaboration, and querying within the encrypted domain, effectively preventing the leakage of users' original data. While maintaining the accuracy of statistical results, this invention supports various statistical tasks such as summation, mean, variance, and extreme values, accommodating the dual-layer computing needs of edge servers and cloud center servers, and meeting the query flexibility requirements in different scenarios. Furthermore, the secure collaboration mechanism and difference-ciphertext comparison method designed in this invention significantly reduce computational and communication overhead, improving the overall system efficiency without sacrificing computational accuracy, and possessing strong scalability and practical application value.

[0109] As the system embodiment of the second aspect is basically similar to the method embodiment of the first aspect, the description is relatively simple, and relevant details can be found in the description of the method embodiment of the first aspect.

[0110] In the description of this invention, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0111] Although the invention has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the specification and accompanying drawings, will understand and implement other variations of the disclosed embodiments in carrying out the claimed invention. In the specification, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality. While certain measures are described in different embodiments, this does not mean that these measures cannot be combined to produce good results.

[0112] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A cloud-edge-device collaborative data security joint computing method, characterized in that, This system is applied to systems including authoritative and trusted institutions, user terminals, edge servers, and cloud center servers. One edge server serves all user terminals in a region, and every two edge servers form a group. Corresponding methods include: System initialization process: An authoritative and trusted institution generates a first secure random number, key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm, and distributes the first secure random number to each edge server, distributes the public key in the key parameters to each user terminal and edge server, and distributes the private key in the key parameters to the cloud center server and any edge server in each group of edge servers; Data encryption and upload process: Each user terminal in the area collects raw data and preprocesses the raw data to obtain preprocessed data. Based on the Paillier encryption algorithm, the preprocessed data and the square of the preprocessed data are encrypted according to the corresponding public key, and the encrypted data is assigned a corresponding interval identifier. The encrypted data and the corresponding assigned interval identifier are sent to the corresponding edge server. The ciphertext aggregation and collaborative computation process for each group of edge servers is as follows: Edge servers in the group without distributed private keys perform aggregation computation on encrypted data from the same user terminal based on the Paillier encryption algorithm to obtain locally aggregated encrypted data. They locate extreme value candidate intervals based on the interval identifiers of the encrypted data and generate a second secure random number. Within the extreme value candidate interval, they construct a local comparison ciphertext based on the second secure random number and the encrypted data. This locally aggregated encrypted data and the locally comparison ciphertext are then sent to the edge servers in the group that have distributed private keys. The edge servers in the group that have distributed private keys construct local difference comparison ciphertexts based on the local comparison ciphertexts and decrypt the locally aggregated encrypted data and the locally compared ciphertexts using their private keys. The local difference comparison ciphertext is calculated based on the local decryption results, including local sums, local means, local variances, and local extrema. These local statistical results are sent to edge servers in the group that do not have their private keys distributed. The local decryption results are then encrypted using the improved Impaillier encryption algorithm and the corresponding public key, and the encrypted data is sent to the central server. Each edge server in the group generates a third secure random number. Based on the first secure random parameter, the third secure random number, and the encrypted data, comparison ciphertext data is constructed. This comparison ciphertext data is then encrypted using the Impaillier encryption algorithm and the corresponding public key, and the new comparison ciphertext data is sent to the central server. Ciphertext aggregation and global calculation process: Based on the improved Impaillier encryption algorithm, the cloud center server aggregates and calculates the local encrypted data from all edge servers to obtain global aggregated encrypted data. It constructs global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. It decrypts the new global aggregated encrypted data and global difference comparison ciphertext based on the corresponding private key, and calculates global statistical results including global sum, global mean, global variance, and global extrema based on the global decryption results.

2. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, During the data encryption and uploading process, the original data is preprocessed to obtain preprocessed data, including: Preprocessing operations, including cleaning, format standardization, encoding, and combination and arrangement, are performed on the raw data to obtain preprocessed data, so as to obtain a data structure that meets the system requirements.

3. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, During data encryption and uploading, corresponding range identifiers are assigned to the encrypted data, including: A bucketing encoding algorithm is used to assign corresponding interval identifiers to the encrypted data.

4. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, The encrypted aggregation and collaborative computation process for each group of edge servers includes the calculation of local statistical results such as local sums, local means, and local variances, including: The calculation process of the local sum: Each edge server in the edge server group that does not distribute a private key performs aggregation calculation on the encrypted data corresponding to the preprocessed data from the same user terminal based on the Paillier encryption algorithm to obtain the first local aggregated encrypted data, and sends the first local aggregated encrypted data to the edge server in the same edge server group that distributes a private key; Each edge server in the edge server group that distributes a private key decrypts the first local aggregated encrypted data according to the corresponding private key to obtain the local sum, and encrypts the local sum according to the improved ImpPaillier encryption algorithm based on the corresponding public key, and sends the encrypted local sum to the central server; The process of calculating the local mean is as follows: The local mean is calculated based on the local sum and the total number of local ciphertexts; where the total number of local ciphertexts is the amount of raw data of all user terminals served by the edge servers that distribute private keys in each group of edge servers; The calculation process of local variance is as follows: In each group of edge servers, the edge server without a private key aggregates the encrypted data corresponding to the squares of the preprocessed data from the same user terminal using the Paillier encryption algorithm to obtain a second local aggregated encrypted data. This second local aggregated encrypted data is then sent to the edge server in that group that has a private key. The edge server with a private key decrypts the second local aggregated encrypted data using its private key to obtain a local sum of squares. Based on the improved Impaillier encryption algorithm and the corresponding public key, it encrypts the local sum of squares and sends it to the central server. The local mean of squares is calculated based on the local sum of squares and the total number of local ciphertexts. Finally, the local variance is calculated based on the local mean and the local mean of squares.

5. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, The ciphertext aggregation and collaborative computation process for each group of edge servers includes the calculation of local statistical results for local extrema, including: Each edge server in the group that does not distribute a private key determines the extreme value candidate interval based on the interval identifier of the encrypted data, and filters out all encrypted data within the extreme value candidate interval; it randomly selects two encrypted data from all the encrypted data within the extreme value candidate interval, constructs a local difference comparison ciphertext based on the homomorphic property of the Paillier key and the second secure random number, and sends the local difference comparison ciphertext to the edge server in the group that distributes a private key; In each group of edge servers, the edge server that has distributed the private key decrypts the local difference comparison ciphertext according to the corresponding private key to obtain the local comparison result, and sends the local comparison result to the edge server in the same group that has not distributed the private key. Each edge server in the group that does not distribute private keys selects one piece of encrypted data from the remaining encrypted data within the extreme value candidate interval based on the local comparison result to construct the next round of local difference comparison ciphertext, until the comparison of all encrypted data within the extreme value candidate interval is completed, and the local extreme value is obtained.

6. The cloud-edge-device collaborative data security joint computing method according to claim 4, characterized in that, The calculation process of global statistical results, including global sum, global mean, and global variance, during encrypted aggregation and global computation includes: The calculation process of the global sum: The cloud center server aggregates the encrypted local sums from all edge servers based on the improved Impaillier encryption algorithm to obtain the first global aggregate encrypted data. The first global aggregate encrypted data is then decrypted according to the corresponding private key to obtain the global sum. The calculation process of the global mean is as follows: The global mean is calculated based on the global sum and the total number of global ciphertexts; where the total number of global ciphertexts is the amount of raw data from all user terminals in the entire region; The calculation process of the global variance is as follows: The cloud center server aggregates the local sums of squares from all edge servers based on the improved Impaillier encryption algorithm to obtain the second global aggregated encrypted data. The second global aggregated encrypted data is decrypted according to the corresponding private key to obtain the global sum of squares. The global mean of squares is calculated based on the global sum of squares and the total number of global ciphertexts. The global variance is calculated based on the global mean and the global mean of squares.

7. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, The calculation process of global statistical results, including global extrema, during ciphertext aggregation and global computation includes: Construct a global difference comparison ciphertext by randomly selecting two edge servers to send comparison ciphertext data, and decrypt the global difference comparison ciphertext using the corresponding private key to obtain the global comparison result; Based on the global comparison results, the next round of global difference comparison ciphertext is constructed from the comparison ciphertext data sent by any of the remaining edge servers. This process continues until the comparison ciphertext data of all edge servers are compared, at which point the global extreme value is obtained.

8. The cloud-edge-device collaborative data security joint computing method according to claim 1, characterized in that, The system also includes a service requester; the corresponding method also includes: Data query process: The data requester initiates a computation query request to the cloud center server or the edge server to obtain the global statistical results obtained from the cloud center server or the local statistical results obtained from the edge server.

9. A cloud-edge-device collaborative data security joint computing system, characterized in that, The system includes authoritative and trusted institutions, user terminals, edge servers, and a cloud center server. One edge server serves all user terminals in a region, and every two edge servers form a group. The authoritative and trustworthy institution includes a security system parameter selection module, a first secure random number generation module, a secure random number distribution module, a key generation module, and a key distribution module. The security parameter selection module is used to select security system parameters according to system requirements. The first secure random number generation module generates a first secure random number that meets the system requirements. The secure random number distribution module distributes the first secure random number to each edge server. The key generation module generates key parameters based on the Paillier encryption algorithm and the improved Impaillier encryption algorithm according to the security system parameters. The key distribution module distributes the public key in the key parameters to each user terminal and edge server, and distributes the private key in the key parameters to the cloud center server and any edge server in each group of edge servers. Each user terminal in the region includes a local data acquisition module, a data preprocessing module, a first data encryption module, an interval identification module, and a data and identification sending module. The local data acquisition module is used to collect the user's local raw data. The data preprocessing module is used to preprocess the raw data. The first data encryption module is used to encrypt the preprocessed data and the square of the preprocessed data based on the Paillier encryption algorithm and the corresponding public key. The interval identification module is used to assign interval identifiers to the encrypted data. The data and identification sending module is used to send the encrypted data and the corresponding assigned interval identifiers to the corresponding edge server. Each edge server group without a distributed private key includes a first ciphertext aggregation module, a second secure random number generation module, a first extreme value comparison module, and a first data transmission module. The first ciphertext aggregation module is used by the edge servers in each group without a distributed private key to aggregate encrypted data from the same user terminal based on the Paillier encryption algorithm to obtain locally aggregated encrypted data. The second secure random number generation module is used to generate a second secure random number. The first extreme value comparison module is used to locate extreme value candidate intervals based on the interval identifier of the encrypted data, and construct local difference comparison ciphertext within the extreme value candidate intervals by using the second secure random number and the encrypted data. The first data transmission module is used to send the locally aggregated encrypted data and the local difference comparison ciphertext to the edge servers in the group that have distributed private keys. Each edge server group, distributed with a private key, includes a computational collaboration module, a second data sending module, a second data encryption module, and a third data sending module. The computational collaboration module constructs a local difference comparison ciphertext based on the local comparison ciphertext, decrypts the local aggregate encrypted data and the local difference comparison ciphertext using the private key, and calculates local statistical results, including local sums, local means, local variances, and local extrema, based on the local decryption results. The second data sending module sends the local statistical results to edge servers in the group that do not have a distributed private key. The second data encryption module encrypts the local decryption results using the improved Impaillier encryption algorithm and the corresponding public key. The third data sending module sends the locally encrypted data to the central server. Each edge server in each group also includes a third secure random number generation module, a comparison ciphertext construction module, and a fourth data sending module; the third secure random number generation module is used to generate a third secure random number; the comparison ciphertext construction module is used to construct comparison ciphertext data based on the first secure random parameter, the third random number, and the encrypted data, and encrypt the comparison ciphertext data based on the Paillier encryption algorithm and the corresponding public key; the fourth data sending module is used to send the new comparison ciphertext data to the central server; The cloud center server includes a second ciphertext aggregation module, a second extreme value comparison module, and a global calculation module. The second ciphertext aggregation module is used to perform aggregation calculations on the locally aggregated encrypted data from all edge servers based on the improved Impaillier encryption algorithm to obtain globally aggregated encrypted data. The second extreme value comparison module is used to construct a global difference comparison ciphertext based on the new comparison ciphertext data from all edge servers. The global calculation module is used to decrypt the globally aggregated encrypted data and the global difference comparison ciphertext based on the corresponding private key, and calculate global statistical results including global sum, global mean, global variance, and global extreme values ​​based on the global decryption results.

10. The cloud-edge-device collaborative data security joint computing system according to claim 9, characterized in that, The system also includes a data requester; the data requester initiates a computation query request to the cloud center server or the edge server to obtain global statistical results obtained from the cloud center server or local statistical results obtained from the edge server.

Images