An end-cloud cooperative data processing method, device, system and related equipment

Abstract

This invention provides a data processing method, apparatus, system, and related equipment for edge-cloud collaboration, relating to the field of edge-cloud collaboration technology. The method includes: receiving a public key from an edge terminal and a request from a consumer terminal at the cloud; performing business operations on the original ciphertext to obtain business ciphertext; generating and encrypting a random challenge value based on a timestamp and a hardware random number; merging the encrypted challenge value and the business ciphertext into a challenge ciphertext using homomorphic addition and sending it to the edge terminal; receiving a decrypted plaintext response from the edge terminal and extracting the plaintext result, wherein the response includes the plaintext result and the random challenge value; reencrypting the plaintext result and performing homomorphic recalculation to obtain a verification ciphertext; and when the verification ciphertext matches the business ciphertext, feeding the result back to the consumer terminal. This invention forms a closed-loop mechanism through random challenge values, homomorphic binding, and recalculation verification, effectively improving security performance in the edge-cloud collaboration environment and reducing the risk of malicious tampering.

Description

Technical Field

[0001] This invention relates to the field of edge-cloud collaboration technology, and in particular to a data processing method, apparatus, system and related equipment for edge-cloud collaboration. Background Technology

[0002] With the deep integration of the digital economy and edge-cloud collaborative architecture, the demand for data circulation as a core production factor is becoming increasingly urgent. Privacy-preserving computing technology, as a key path to achieving "data usable but invisible," has already seen initial applications in fields such as energy, finance, and government. However, in existing edge-cloud collaboration schemes based on cryptographic protocols, system security and computational trustworthiness still face severe challenges because edge terminals are outside the control of computing nodes.

[0003] On the one hand, existing solutions generally suffer from a lack of credibility verification for computation results. Since edge terminals typically possess decryption privileges, driven by profit, they may maliciously tamper with the decrypted computation results, leading consumers to obtain false data and potentially causing serious business decision-making errors such as power dispatching mistakes or financial risk control failures. On the other hand, there is an irreconcilable contradiction between the resource adaptability of edge terminals and data security. Edge devices with limited computing power cannot support complex integrity proof algorithms, while simple decryption and forwarding logic is highly vulnerable to differential attacks or high-frequency sniffing, putting the original data at risk of being reverse-engineered and cracked. Furthermore, existing technologies lack effective behavior auditing mechanisms and cannot dynamically monitor the frequency of decryption operations and network status, leaving the computation process in a "black box" state. Once a leak occurs, it is difficult to trace the responsible party.

[0004] In summary, existing technologies cannot simultaneously meet the core requirements of tamper-proof results and auditable processes while ensuring lightweight edge computing. This has become a bottleneck restricting the large-scale deployment of privacy computing. Summary of the Invention

[0005] This invention provides a data processing method, apparatus, system, and related equipment for edge-cloud collaboration, which addresses the low security of edge cloud computing in existing technologies and improves the privacy and data security of edge-cloud collaborative systems.

[0006] This invention provides a data processing method for edge-cloud collaboration, comprising:

[0007] Receive homomorphic encryption public keys sent by edge terminals and data processing requests sent by consumer terminals;

[0008] Upon receiving the original ciphertext of the data to be processed from the edge terminal, the system performs business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain the business ciphertext; and...

[0009] A globally unique random challenge value is generated based on a timestamp and a hardware random number, and the random challenge value is encrypted using the public key to obtain an encrypted challenge value;

[0010] Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext, which is then sent to the edge terminal.

[0011] The edge terminal receives the plaintext response after decrypting the challenge ciphertext, and extracts the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0012] The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext.

[0013] When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

[0014] According to a data processing method for edge-cloud collaboration provided by the present invention, the step of generating a globally unique random challenge value based on a timestamp and a hardware random number, and encrypting the random challenge value using the public key to obtain an encrypted challenge value includes:

[0015] Obtain a physical random sequence using a hardware random number generator;

[0016] Get the current timestamp;

[0017] A random challenge value is generated by performing a hash operation on the physical random sequence and the timestamp using a preset hash algorithm.

[0018] According to a data processing method for edge-cloud collaboration provided by the present invention, the step of receiving the plaintext response from the edge terminal after decryption of the challenge ciphertext, and extracting the plaintext result from the plaintext response includes:

[0019] In the plaintext space, a subtraction operation is performed on the plaintext response to subtract the random challenge value, thus obtaining the plaintext result.

[0020] According to a data processing method for edge-cloud collaboration provided by the present invention, the step of feeding back the plaintext result to the consumer terminal when the verification ciphertext matches the business ciphertext includes:

[0021] Calculate the first hash value of the ciphertext;

[0022] Calculate the second hash value of the verification ciphertext;

[0023] When the first hash value is equal to the second hash value, the plaintext result is fed back to the consumer terminal.

[0024] According to the present invention, a data processing method for edge-cloud collaboration is provided, the method further includes:

[0025] The edge terminal receives a decryption statistics warning, which is triggered when the edge terminal's local decryption frequency exceeds a preset threshold.

[0026] In response to the warning, a preset security policy is executed, wherein the security policy includes one or more of suspending the computing session, logging the anomaly log, or suspending public key permissions.

[0027] According to the present invention, a data processing method for edge-cloud collaboration is provided, the method further includes:

[0028] Real-time monitoring of the resource utilization of the edge terminal and the network latency between the edge terminal;

[0029] When the resource utilization or network latency fluctuates abnormally, the threshold is dynamically tightened, and an updated threshold instruction is sent to the edge terminal.

[0030] The present invention also provides a data processing device for edge-cloud collaboration, comprising:

[0031] The receiving module is used to receive the homomorphic encryption public key sent by the edge terminal and the data processing request sent by the consumer terminal.

[0032] The calculation module includes a calculation unit and a generation unit. The calculation unit is used to perform business calculations on the original ciphertext of the data to be processed sent by the edge terminal, based on the homomorphic computing engine and the business information in the data processing request, to obtain business ciphertext.

[0033] The generation unit is used to generate a globally unique random challenge value based on a timestamp and a hardware random number, and to encrypt the random challenge value using the public key to obtain an encrypted challenge value.

[0034] The merging module is used to merge the encryption challenge value and the business ciphertext based on the homomorphic addition operator to obtain the challenge ciphertext and send it to the edge terminal;

[0035] An extraction module is used to receive the plaintext response from the edge terminal after decrypting the challenge ciphertext, and to extract the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0036] The verification module is used to encrypt the plaintext result based on the public key to obtain encrypted ciphertext, and to perform business calculations on the encrypted ciphertext using the homomorphic computing engine to obtain verification ciphertext.

[0037] The feedback module is used to send the plaintext result back to the consumer terminal when the verification ciphertext matches the business ciphertext.

[0038] The present invention also provides a cloud device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the above-described edge-cloud collaborative data processing methods.

[0039] The present invention also provides an edge-cloud collaborative data processing system comprising a consumer terminal, a cloud device as described above, and an edge terminal, wherein the consumer terminal and the edge terminal are respectively connected to the cloud device, and the edge terminal is used for:

[0040] Generate a homomorphic encryption key pair and send the public key to the cloud device;

[0041] Receive the challenge ciphertext sent by the cloud device regarding the business calculation result;

[0042] The challenge ciphertext is decrypted using the private key to obtain the plaintext response;

[0043] The plaintext response is sent to the cloud device so that the cloud device can verify the authenticity of the calculation result through a random challenge value.

[0044] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the aforementioned edge-cloud collaborative data processing methods.

[0045] This invention provides a cloud-edge collaborative data processing method, apparatus, system, and related equipment. Through deep coupling of the homomorphic addition operator and a random challenge mechanism, a fully verifiable privacy computation closed loop is constructed. This solution innovatively utilizes the algebraic properties of homomorphic addition to inject a globally unique random challenge value generated by hash fusion into the business ciphertext. This design forces the response from the edge terminal to conform to a specific mathematical structure, enabling the cloud to accurately determine the integrity of the computation result through simple plaintext stripping and recalculation comparison without accessing the private key. This mechanism fundamentally curbs the possibility of data tampering at the edge, ensuring the authenticity and reliability of the results obtained by the consumer. Simultaneously, the solution fully considers the resource bottlenecks of edge devices, retaining the heavy business logic and recalculation verification in the cloud. The edge only needs to perform basic addition and decryption, greatly improving the system's adaptability to large-scale, power-sensitive devices. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0047] Figure 1 This is the first flowchart of the edge-cloud collaborative data processing method provided by the present invention;

[0048] Figure 2 This is the second flowchart of the edge-cloud collaborative data processing method provided by the present invention;

[0049] Figure 3 This is a schematic diagram of the cloud device provided by the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0051] This embodiment first describes an edge-cloud collaborative data processing method provided by the present invention. This method can run based on applications, plugins, or embedded software, and is particularly suitable for privacy-focused collaborative computing scenarios where edge terminal resources are limited and "raw data does not leave the edge and is usable but not visible." Examples include data circulation businesses in multiple fields such as power, finance, social security, healthcare, and smart homes.

[0052] For ease of understanding, in this embodiment, "cloud device" refers to a cluster of cloud devices with powerful computing capabilities, deployed with a homomorphic computing engine and business model, responsible for performing business operations in encrypted state. "Consumer terminal" refers to a business system or terminal that needs to use the data processing results; it does not access the original data but only obtains verified computation results through the cloud device. "Edge terminal (data provider)" refers to hardware devices distributed at the network edge, responsible for collecting and decrypting original privacy data.

[0053] The following is combined Figures 1-2 The specific implementation process of this method will be described in detail below. This embodiment uses a cloud device as the execution subject. Specifically, it includes:

[0054] S10. Receive the homomorphic encryption public key sent by the edge terminal and the data processing request sent by the consumer terminal.

[0055] Specifically, before data processing, the consumer terminal registers through the built-in identity authentication module of the cloud device and submits business calculation requests (e.g., tiered electricity pricing calculation models in the smart grid field, credit limit assessment rules in the financial field). The consumer terminal establishes asynchronous or synchronous communication with the cloud device by initiating real-time query requests or by pre-subscribing to result push services. The cloud device verifies the compliance of the consumer terminal's access permissions. After successful verification, the cloud device deploys the corresponding business model and homomorphic computing engine. The cloud device can also be configured with audit log storage rules. The audit log includes the original encrypted hash, calculation parameters, challenge values, and result verification status, and its retention time meets preset compliance requirements for subsequent review by management personnel or other relevant personnel.

[0056] Edge terminals (such as smart meters and industrial sensors) generate homomorphic encryption key pairs through their internal lightweight encryption modules. The private key (SK) is securely stored in the hardware security module (HSM) inside the edge terminal to prevent the key from being illegally stolen or cracked offline; the public key (PK) is uploaded to the cloud device through encrypted secure channels such as TLS / mTLS.

[0057] Furthermore, for security reasons, cloud devices and edge terminals agree on a threshold for decryption frequency through pre-negotiation. This threshold is used to defend against cryptographic attacks implemented through high-frequency decryption requests, such as differential attacks and brute-force attacks. If the number of decryptions for the same business model in a single day exceeds the preset threshold (e.g., 3 times in a single day), the edge terminal will trigger a local alarm and synchronize it to the cloud device to perform the corresponding processing.

[0058] Taking a smart grid scenario as an example, the system architecture provided in this embodiment includes edge terminals, cloud devices, and consumer terminals. The edge terminal is specifically a smart meter with a built-in HSM module, lightweight BGV encryption component, and decryption frequency statistics module. This smart meter is responsible for collecting raw energy consumption characteristic data, including: daily electricity consumption, peak hour percentage, number of device types, and off-peak electricity consumption. The cloud device deploys a tiered electricity price logistic regression model, with each feature parameter having a preset weight. For example, the weight of daily electricity consumption is 0.4, the weight of peak hour percentage is 0.3, the weight of number of device types is 0.2, and the weight of off-peak electricity consumption is 0.1, with a model bias term of 0.05. The business rule defines the mapping relationship between electricity price and model score as: electricity price = model score × 10, with a range of 0-50 yuan. The consumer terminal is specifically the power company's business system, which subscribes to the tiered electricity price calculation results after identity authentication.

[0059] As an example, daily energy consumption data is as follows: daily electricity consumption 5 kWh (0x00000005), peak period percentage 30% (0x0000001E), number of device types 6 (0x00000006), and off-peak electricity consumption 2 kWh (0x00000002). The smart meter uses a private key to encrypt the above data, generating the original ciphertext. C data Transmitted to cloud devices via TLS 1.3.

[0060] S20. Upon receiving the original ciphertext of the data to be processed sent by the edge terminal, perform business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain business ciphertext; and generate a globally unique random challenge value based on the timestamp and hardware random number, and encrypt the random challenge value using the public key to obtain an encrypted challenge value.

[0061] Specifically, the edge terminal acquires raw privacy data, such as smart home energy consumption data, personal health data, or business operation data, through built-in sensors or data acquisition modules. Then, the edge terminal uses its lightweight homomorphic encryption module and a preset public key (PK) to encrypt the raw privacy data, generating the original ciphertext. C data This encryption process consumes very little computing resources at the edge and does not involve complex business operations. The edge terminal transmits data via TLS 1.3 or other encrypted secure channels. C data Transmitted to cloud devices. Since the transmission process only involves the exchange of encrypted data, it not only eliminates the risk of plaintext privacy data leakage at the source, but also significantly reduces the consumption of communication bandwidth due to the efficient encapsulation characteristics of homomorphic ciphertext.

[0062] The cloud device receives C data Then, the legitimacy of the consumer terminal's data calculation request is verified through the identity authentication module. Once verification is successful, the cloud device invokes the homomorphic computing engine to... C data Substitute the pre-set business model of the consumer terminal, such as the tiered electricity pricing logistic regression model, perform homomorphic mapping operations, and generate business ciphertext. C result .

[0063] To ensure the verifiability of the calculation results, the cloud device needs to synchronously generate a one-time and globally unique random challenge value. rIn one optional implementation, the cloud device generates a random challenge value by directly linearly superimposing or cascading timestamps and hardware random numbers. In another preferred implementation, the cloud device uses a more confusing hash operation to generate the random challenge value, specifically including the following steps:

[0064] S21. Obtain a physical random sequence through a hardware random number generator.

[0065] Specifically, it utilizes a hardware random number generator (HRNG) built into the cloud device to generate physically true random numbers. These random numbers are generated based on uncontrollable physical processes such as chip thermal noise, voltage fluctuations, or quantum tunneling effects, and are inherently unpredictable and unreproducible.

[0066] S22. Get the current timestamp.

[0067] Specifically, to obtain nanosecond-level precision of 10 -9 The system's real-time timestamp. For example, if the current time is "2025-12-17 10:23:45.123456789", the precision reaches 10^10. -9 The high-precision time base ensures that the system will not generate conflicting challenge values ​​within the same nanosecond.

[0068] S23. Using a preset hash algorithm, perform a hash operation on the physical random sequence and the timestamp to generate a random challenge value.

[0069] Specifically, secure hash functions such as SHA-256 are used to perform hash mapping on the concatenation result of the physical random sequence and the nanosecond-level timestamp, generating a random challenge value r of fixed length (e.g., 32 bytes).

[0070] After generating a random challenge value r, the cloud device encrypts it using a public key (PK) to obtain the encrypted challenge value. Enc(r) .

[0071] In addition, to support the subsequent result verification process, the cloud device also simultaneously calculates the encrypted business data. C result The first hash value (such as the SM3 hash value) H 1) And perform local audits and retain records.

[0072] Taking the smart grid as an example, cloud devices verify the legitimacy of the power company's computing requests and call the BGV homomorphic computing engine to perform the calculations. C data Perform tiered electricity pricing model calculations and generate encrypted business messages. C result Random challenge values ​​are generated in the cloud. r =0x00003039 (decimal 12345), obtained by encrypting with PK. Enc (r) The cloud device combines the two using a homomorphic addition operator to generate the challenge ciphertext. C challenge = Enc (r) ⊕ C result .

[0073] In addition, the cloud can also compute encrypted business data. C result The corresponding first hash value H 1 and retain, rather than C result If the SM3 hash function is used, H 1=SM3( C result And store it in the audit log module.

[0074] S30. Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext and sent to the edge terminal.

[0075] Specifically, the cloud device invokes the addition operator in the homomorphic encryption protocol to encrypt the challenge value within the ciphertext space. Enc (r) With business secrets C result Perform a summation operation to generate the challenge ciphertext. C challenge .

[0076] C challenge = Enc (r) ⊕ C result ;

[0077] Here, ⊕ represents a homomorphic addition operation within the ciphertext space. This step establishes a strong binding between the challenge value and the business result at the ciphertext level, ensuring that any unauthorized tampering with the ciphertext will be detected during subsequent decryption and comparison. After generating the challenge ciphertext, the cloud device sends it to the edge terminal via a secure channel such as TLS 1.3.

[0078] S40. Receive the plaintext response from the edge terminal after decrypting the challenge ciphertext, and extract the plaintext result from the plaintext response.

[0079] Specifically, the edge terminal receives the challenge ciphertext. C challenge Then, the private key (SK) stored in the Hardware Security Module (HSM) is used for decryption. Since the edge terminal in this solution only needs to perform the basic "decrypt and return" operation and does not participate in any business logic calculation, the consumption of computing resources is greatly reduced, making it compatible with computing-limited devices such as smart meters and industrial sensors.

[0080] The plaintext response obtained after decryption Resp It has a specific data structure, namely:

[0081] Resp = r +Plaintext result;

[0082] The edge terminal sends the plaintext response via a TLS secure channel. Resp Return to the cloud device. The cloud device receives... Resp Then, utilize the locally stored original random challenge values. r Perform a reverse separation operation in the plaintext space, that is, perform... R candidate = Resp - r This allows us to extract the candidate plaintext results to be verified. R candidate .

[0083] S50. The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext.

[0084] Specifically, cloud devices use the PK encryption of edge terminals. R candidate Obtain the encrypted ciphertext C verify Call the homomorphic computation engine to C verify Perform the same business logic as before to generate the verification ciphertext. C verify-result The edge terminal is only responsible for basic decryption, leaving the heavy recalculation verification to the resource-rich cloud, thus solving the pain point of traditional verification schemes having excessively high performance requirements for the edge terminal.

[0085] Furthermore, to defend against potential privilege abuse and side-channel attacks, cloud devices implement security alerts based on decryption frequency. Specifically, this includes:

[0086] S511. Receive the decryption statistics warning fed back by the edge terminal, the warning being triggered when the local decryption frequency of the edge terminal exceeds a preset threshold.

[0087] Specifically, the edge terminal's statistics module records the trigger time and corresponding business model ID for each decryption in real time. When the decryption frequency within a specific statistical period exceeds a preset security threshold (such as the daily decryption limit for the same model), the edge terminal sends an abnormal warning signal to the cloud device.

[0088] S512. In response to the warning, execute a preset security policy, wherein the security policy includes one or more of suspending the computing session, logging the abnormal log, or suspending public key permissions.

[0089] Specifically, in response to this signal, the cloud device executes various protection strategies, including suspending the current computing session, recording anomaly audit logs, suspending the terminal's public key access permissions, or pushing alarm information to the consumer terminal.

[0090] In addition, the cloud and edge terminals will adjust preset thresholds, i.e., decryption thresholds, specifically including:

[0091] S521. Monitor the resource utilization rate of the edge terminal and the network latency between the edge terminal in real time.

[0092] Specifically, cloud devices monitor the resource utilization (such as CPU load and memory usage) of edge terminals in real time, as well as the network latency of edge-cloud communication.

[0093] S522. When the resource utilization rate or the network latency fluctuates abnormally, the threshold is dynamically tightened, and an updated threshold instruction is sent to the edge terminal.

[0094] Specifically, if unexpected abnormal fluctuations in the above parameters are detected (such as a sharp increase in latency or abnormal resource usage), the cloud device determines that the current computing environment is at risk of attack or system failure. It will automatically reduce the allowed decryption frequency of the terminal and simultaneously send updated threshold instructions to the edge terminals. By dynamically linking the decryption frequency to the network environment and resource status, the system can evolve from simple data verification to behavioral situational awareness, effectively preventing differential attacks.

[0095] In a smart grid implementation, cloud devices calculate the electricity price. C result (Equivalent to 280 yuan) and random challenge value Enc(12345) Perform homomorphic addition and distribute C challenge The electricity meter was decrypted to obtain plaintext. Resp =12345 + 280 = 12625 and return. The electricity meter statistics module records this operation and determines that the threshold has not been exceeded. The server reconstructs the verification ciphertext 280 by calculating 12625-12345.

[0096] S60. When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

[0097] Specifically, the cloud device obtains the candidate plaintext results to be verified. R candidateThen, the final consistency determination is performed through replay logic. To adapt to different homomorphic encryption protocols and security level requirements, this embodiment provides the following two matching methods:

[0098] One matching method employs ciphertext homomorphic subtraction matching. The method for matching the verification ciphertext and the business ciphertext is ciphertext homomorphic subtraction, which calculates... C verify-result ⊖ C result If the result is a homomorphic encryption form with a zero value (i.e., 0 after decryption), then the result is considered consistent.

[0099] However, in another implementation, hash feature digest matching is used. (Calculation) C verify-resul The second hash value H verify ,Will H verify Compared with the previously retained H 1. Perform equivalence comparison. In this scheme, hash feature matching is preferred over direct numerical comparison or ciphertext comparison. Homomorphic encryption algorithms (especially non-deterministic encryption protocols) may generate ciphertexts that are not consistent at the binary level when encrypting the same plaintext multiple times, but their algebraic meaning is the same. By comparing the feature hashes processed by the homomorphic engine, encryption noise interference can be eliminated, and the determination of whether ciphertexts point to the same logical result can be made more stable. Hash functions have unidirectional irreversibility. Only feature digests of business ciphertexts are stored in the cloud. H 1. Even if the cloud database is attacked, attackers cannot reverse engineer the business calculation results or original sensitive privacy information using hash values, achieving a complete separation of the "right to know" and the "right to verify." Homomorphic ciphertext typically exhibits strong statistical randomness. If ciphertext features are directly compared, malicious insiders might be able to deduce the plaintext distribution by observing the patterns of ciphertext changes. Hash processing effectively blocks this inference path. When processing complex ciphertext structures containing thousands of coefficients, storing and comparing massive ciphertext blocks incurs enormous overhead. Using fixed-length hash digests as "digital fingerprints" significantly reduces the storage pressure on audit logs and the I / O overhead of comparison calculations.

[0100] Based on the feature comparison results, the cloud device performs the following classification process. If H verify = H 1. Determine that the plaintext result is true and valid and the calculation process is complete. At this point, R candidate The result is confirmed as the final valid result and stored in the data storage module. Simultaneously, according to preset subscription rules or response requests, the result is fed back to the consumer terminal via an encrypted channel. H verify≠ H 1. If the result is found to have been tampered with or transmitted incorrectly, the cloud device immediately marks the calculation as abnormal and refuses to send data to the consumer terminal. At the same time, abnormal characteristics such as the tampering time, hash difference, and associated link status are recorded in the audit log and a security alarm is triggered.

[0101] In a smart grid implementation, the cloud device obtains the data via 12625-12345. R candidate =280 yuan. After recalculation, its generated second hash value... H verify The first hash value corresponding to the original business ciphertext H 1. Completely identical. The server pushes the 280 yuan electricity price quota to the power company's system. The power company only receives the result and does not access the original electricity consumption data. If the smart meter forges its response as 12645 (corresponding to 300 yuan), the server's restored candidate result will be 300. Because the ciphertext hash of 300 after homomorphic operation cannot be compared with the first hash value... H Upon matching, the system immediately identifies and intercepts the tampered result, and simultaneously records in the audit log: Model ID: Ladder_Elec_001, abnormal operation, determined to be data tampering.

[0102] This solution enhances the system's robustness from multiple dimensions through the closed-loop design of "one-time random challenge value + encrypted space binding + plaintext space recalculation". This is because the random challenge value cannot be predicted at the edge terminal. r Any modification to the response value will cause the re-calculation verification to fail. Furthermore, the cloud device, acting as the core hub, completely isolates direct interaction between the consumer terminal and the edge terminal, preventing the data consumer from accessing the original ciphertext. The entire process follows the principle of "one calculation request triggers only one edge response," fundamentally eliminating the possibility of brute-force cracking of privacy data through multiple decryption requests. In addition, audit logs record all key operations from initial encryption, ciphertext calculation, challenge injection to re-calculation comparison, providing regulatory authorities with an immutable compliance verification chain.

[0103] The following describes the edge-cloud collaborative data processing apparatus provided by the present invention. The edge-cloud collaborative data processing apparatus described below corresponds to and can be referred to in relation to the edge-cloud collaborative data processing method described above. The apparatus includes:

[0104] The receiving module is used to receive the homomorphic encryption public key sent by the edge terminal and the data processing request sent by the consumer terminal.

[0105] The calculation module includes a calculation unit and a generation unit. Specifically, the calculation unit is used to perform business calculations on the original ciphertext of the data to be processed sent by the edge terminal, based on the homomorphic computing engine and the business information in the data processing request, to obtain business ciphertext.

[0106] The generation unit is specifically used to generate a globally unique random challenge value based on a timestamp and a hardware random number, and to encrypt the random challenge value using the public key to obtain an encrypted challenge value;

[0107] The merging module is used to merge the encryption challenge value and the business ciphertext based on the homomorphic addition operator to obtain the challenge ciphertext and send it to the edge terminal;

[0108] An extraction module is used to receive the plaintext response from the edge terminal after decrypting the challenge ciphertext, and to extract the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0109] The verification module is used to encrypt the plaintext result based on the public key to obtain encrypted ciphertext, and to perform business calculations on the encrypted ciphertext using the homomorphic computing engine to obtain verification ciphertext.

[0110] The feedback module is used to send the plaintext result back to the consumer terminal when the verification ciphertext matches the business ciphertext.

[0111] Specifically, the generation unit is used to obtain a physical random sequence through a hardware random number generator;

[0112] Get the current timestamp;

[0113] A random challenge value is generated by performing a hash operation on the physical random sequence and the timestamp using a preset hash algorithm.

[0114] Specifically, the extraction module is used to perform a subtraction operation on the plaintext response in the plaintext space, subtracting the random challenge value to obtain the plaintext result.

[0115] The feedback module includes:

[0116] The first hash calculation unit is used to calculate the first hash value of the business ciphertext;

[0117] The second hash calculation unit is used to calculate the second hash value of the verification ciphertext;

[0118] The feedback unit is used to send the plaintext result back to the consumer terminal when the first hash value is equal to the second hash value.

[0119] The device further includes a first early warning module, which is specifically used for:

[0120] The edge terminal receives a decryption statistics warning, which is triggered when the edge terminal's local decryption frequency exceeds a preset threshold.

[0121] In response to the warning, a preset security policy is executed, wherein the security policy includes one or more of suspending the computing session, logging the anomaly log, or suspending public key permissions.

[0122] The device further includes a second early warning module, which is specifically used for:

[0123] Real-time monitoring of the resource utilization of the edge terminal and the network latency between the edge terminal;

[0124] When the resource utilization or network latency fluctuates abnormally, the threshold is dynamically tightened, and an updated threshold instruction is sent to the edge terminal.

[0125] The related equipment of the present invention also includes a cloud device. Figure 3 An example is a schematic diagram of the physical structure of a cloud device, such as... Figure 3 As shown, the cloud device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions from the memory 830 to execute a cloud-edge collaborative data processing method, which includes:

[0126] Receive homomorphic encryption public keys sent by edge terminals and data processing requests sent by consumer terminals;

[0127] Upon receiving the original ciphertext of the data to be processed from the edge terminal, the system performs business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain the business ciphertext; and...

[0128] A globally unique random challenge value is generated based on a timestamp and a hardware random number, and the random challenge value is encrypted using the public key to obtain an encrypted challenge value;

[0129] Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext, which is then sent to the edge terminal.

[0130] The edge terminal receives the plaintext response after decrypting the challenge ciphertext, and extracts the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0131] The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext.

[0132] When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

[0133] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0134] This invention also includes an edge-cloud collaborative data processing system, which comprises a consumer terminal, a cloud device, and an edge terminal. The edge terminal is specifically used for:

[0135] Generate a homomorphic encryption key pair and send the public key to the cloud device;

[0136] Receive the challenge ciphertext sent by the cloud device regarding the business calculation result;

[0137] The challenge ciphertext is decrypted using the private key to obtain the plaintext response;

[0138] The plaintext response is sent to the cloud device so that the cloud device can verify the authenticity of the calculation result through a random challenge value.

[0139] The specific process has been described in detail in the previous section on the execution process of cloud devices, and will not be repeated here.

[0140] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer being able to execute the edge-cloud collaborative data processing method provided by the above methods, the method comprising:

[0141] Receive homomorphic encryption public keys sent by edge terminals and data processing requests sent by consumer terminals;

[0142] Upon receiving the original ciphertext of the data to be processed from the edge terminal, the system performs business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain the business ciphertext; and...

[0143] A globally unique random challenge value is generated based on a timestamp and a hardware random number, and the random challenge value is encrypted using the public key to obtain an encrypted challenge value;

[0144] Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext, which is then sent to the edge terminal.

[0145] The edge terminal receives the plaintext response after decrypting the challenge ciphertext, and extracts the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0146] The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext.

[0147] When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

[0148] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the edge-cloud collaborative data processing method provided by the methods described above, the method comprising:

[0149] Receive homomorphic encryption public keys sent by edge terminals and data processing requests sent by consumer terminals;

[0150] Upon receiving the original ciphertext of the data to be processed from the edge terminal, the system performs business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain the business ciphertext; and...

[0151] A globally unique random challenge value is generated based on a timestamp and a hardware random number, and the random challenge value is encrypted using the public key to obtain an encrypted challenge value;

[0152] Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext, which is then sent to the edge terminal.

[0153] The edge terminal receives the plaintext response after decrypting the challenge ciphertext, and extracts the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value;

[0154] The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext.

[0155] When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

[0156] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0157] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0158] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data processing method for edge-cloud collaboration, characterized in that, include: Receive homomorphic encryption public keys sent by edge terminals and data processing requests sent by consumer terminals; Upon receiving the original ciphertext of the data to be processed from the edge terminal, the system performs business calculations on the original ciphertext based on the homomorphic computing engine and the business information in the data processing request to obtain the business ciphertext; and... A globally unique random challenge value is generated based on a timestamp and a hardware random number, and the random challenge value is encrypted using the public key to obtain an encrypted challenge value; Based on the homomorphic addition operator, the encryption challenge value and the business ciphertext are merged to obtain the challenge ciphertext, which is then sent to the edge terminal. The edge terminal receives the plaintext response after decrypting the challenge ciphertext, and extracts the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value; The plaintext result is encrypted using the public key to obtain encrypted ciphertext, and the homomorphic computing engine is used to perform business calculations on the encrypted ciphertext to obtain verification ciphertext. When the verification ciphertext matches the service ciphertext, the plaintext result is fed back to the consumer terminal.

2. The data processing method for edge-cloud collaboration according to claim 1, characterized in that, The process involves generating a globally unique random challenge value based on a timestamp and a hardware random number, and then encrypting the random challenge value using the public key to obtain an encrypted challenge value, including: Obtain a physical random sequence using a hardware random number generator; Get the current timestamp; A random challenge value is generated by performing a hash operation on the physical random sequence and the timestamp using a preset hash algorithm.

3. The data processing method for edge-cloud collaboration according to claim 1, characterized in that, The step of receiving the plaintext response from the edge terminal after decrypting the challenge ciphertext, and extracting the plaintext result from the plaintext response, includes: In the plaintext space, a subtraction operation is performed on the plaintext response to subtract the random challenge value, thus obtaining the plaintext result.

4. The edge-cloud collaborative data processing method according to any one of claims 1 to 3, characterized in that, The step of sending the plaintext result back to the consumer terminal when the verification ciphertext matches the service ciphertext includes: Calculate the first hash value of the ciphertext; Calculate the second hash value of the verification ciphertext; When the first hash value is equal to the second hash value, the plaintext result is fed back to the consumer terminal.

5. The data processing method for edge-cloud collaboration according to any one of claims 1 to 3, characterized in that, The method further includes: The edge terminal receives a decryption statistics warning, which is triggered when the edge terminal's local decryption frequency exceeds a preset threshold. In response to the warning, a preset security policy is executed, wherein the security policy includes one or more of suspending the computing session, logging the anomaly log, or suspending public key permissions.

6. The data processing method for edge-cloud collaboration according to claim 5, characterized in that, The method further includes: Real-time monitoring of the resource utilization of the edge terminal and the network latency between the edge terminal; When the resource utilization or network latency fluctuates abnormally, the threshold is dynamically tightened, and an updated threshold instruction is sent to the edge terminal.

7. A data processing device for edge-cloud collaboration, characterized in that, include: The receiving module is used to receive the homomorphic encryption public key sent by the edge terminal and the data processing request sent by the consumer terminal. The calculation module includes a calculation unit and a generation unit. The calculation unit is used to perform business calculations on the original ciphertext of the data to be processed sent by the edge terminal, based on the homomorphic computing engine and the business information in the data processing request, to obtain business ciphertext. The generation unit is used to generate a globally unique random challenge value based on a timestamp and a hardware random number, and to encrypt the random challenge value using the public key to obtain an encrypted challenge value. The merging module is used to merge the encryption challenge value and the business ciphertext based on the homomorphic addition operator to obtain the challenge ciphertext and send it to the edge terminal; An extraction module is used to receive the plaintext response from the edge terminal after decrypting the challenge ciphertext, and to extract the plaintext result from the plaintext response, wherein the plaintext response includes the plaintext result and a random challenge value; The verification module is used to encrypt the plaintext result based on the public key to obtain encrypted ciphertext, and to perform business calculations on the encrypted ciphertext using the homomorphic computing engine to obtain verification ciphertext. The feedback module is used to send the plaintext result back to the consumer terminal when the verification ciphertext matches the business ciphertext.

8. A cloud device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the edge-cloud collaborative data processing method as described in any one of claims 1 to 6.

9. A cloud-edge collaborative data processing system, characterized in that, The device includes a consumer terminal, a cloud device as described in claim 8, and an edge terminal, wherein the consumer terminal and the edge terminal are respectively connected to the cloud device, and the edge terminal is used for: Generate a homomorphic encryption key pair and send the public key to the cloud device; Receive the challenge ciphertext sent by the cloud device regarding the business calculation result; The challenge ciphertext is decrypted using the private key to obtain the plaintext response; The plaintext response is sent to the cloud device so that the cloud device can verify the authenticity of the calculation result through a random challenge value.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the edge-cloud collaborative data processing method as described in any one of claims 1 to 6.

Images