Data aggregation method, device, system, equipment, medium and program product

Abstract

The invention discloses a data aggregation method, device, system, equipment, medium and program product, and belongs to the technical field of information security, the data aggregation method comprises the following steps: generating two key pairs according to received public parameters, and sending the public key pair to a server side; sharing the first private key and the random number to obtain a plurality of private key shares and random number shares, encrypting the shares and sending the shares to a server side; generating a first shared key according to the first private key of the client and the first public key of any second client; encrypting the privacy data according to the first shared key and the random number to obtain a privacy ciphertext, and sending the privacy ciphertext to the server side; receiving a third set; and decrypting the private key share of the offline user and the random number share of the online user and sending the decrypted private key share and the decrypted random number share to the server. And the server side cannot eliminate the random number mask of the offline client side during aggregation decryption, so that the leakage of private data of the offline client side is avoided.

Description

Technical Field

[0001] This application relates to the field of information security technology, specifically to a data aggregation method, apparatus, system, device, medium, and program product. Background Technology

[0002] With the widespread use of mobile devices, more and more private data is being exploited and leaked, making it impossible to guarantee the privacy of user data. To improve user data privacy and prevent the leakage of private information, data aggregation is becoming increasingly important. Using data aggregation technology, servers can collect and analyze data to make intelligent decisions. To date, although many privacy-preserving data aggregation methods have been proposed and used, most methods employ public-key cryptography algorithms, which can lead to significant computational and communication costs for users. Summary of the Invention

[0003] The purpose of this application is to provide a data aggregation method, apparatus, system, device, medium, and program product to address the shortcomings of existing technologies that only have one layer of key masking, which may lead to the leakage of privacy data.

[0004] To achieve the above objectives, the first aspect of this application provides a data aggregation method applied to a client, the method comprising:

[0005] Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server.

[0006] The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs.

[0007] The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs.

[0008] A first shared key is generated based on the first private key of this client and the first public key of any second client. The client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing public key pairs. The first public key is the public key in the first key pair of the second client.

[0009] The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server.

[0010] Receive the third set, which is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set;

[0011] Decrypt the private key share of the disconnected client and send it to the server;

[0012] Decrypt the random number share from the online client and send it to the server;

[0013] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0014] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregated decryption, the online client only decrypts and sends the private key share of the offline client to the server, while also decrypting the random number share of the online client. It does not decrypt the random number share of the offline client. This encryption and decryption condition allows the server to eliminate the key mask and random number mask of the online client's private ciphertext during aggregated decryption, but it cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0015] In some feasible embodiments, two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server, including:

[0016] The first key pair and the second key pair are generated using a key exchange algorithm;

[0017] Combine the first public key from the first key pair with the second public key from the second key pair to form a public key pair and send it to the server.

[0018] Based on the aforementioned technical means, two key pairs are generated to encrypt private data during data transmission, providing a basic support for mask generation to ensure privacy and security.

[0019] In some feasible embodiments, the first private key and the random number are shared to obtain multiple private key shares and multiple random number shares, including:

[0020] A threshold secret sharing algorithm is used to share the first private key and the random number separately, resulting in multiple private key shares and multiple random number shares.

[0021] Based on the above technical means, the first private key and the random number are shared. Subsequent decryption can be achieved with a sufficient number of private key shares and random number shares, so that data transmission decryption can support client disconnection.

[0022] In some feasible embodiments, the private key share and the random number share are encrypted based on the second private key and then sent to the server, including:

[0023] A second shared key is generated using the second private key of this client and the second public key of any second client, resulting in multiple second shared keys. The second public key is the public key in the second key pair of the second client.

[0024] A symmetric authentication encryption algorithm is used to encrypt a private key share and a random number share based on any second shared key, resulting in multiple private key share ciphertexts and multiple random number share ciphertexts, which are then sent to the server.

[0025] Based on the aforementioned technical means, a second shared key is generated using the second private key and the second public key of any other client. This shared key is used to encrypt the private key share and random number share when sharing them. After encryption, the shared key share or random number share is sent to the server. When it is necessary to decrypt the private key share or random number share later, each client can only parse the private key share and random number share associated with itself and cannot parse other shares, thus protecting the privacy of disconnected clients.

[0026] In some feasible embodiments, the privacy data is encrypted using a first shared key and a random number to obtain privacy ciphertext, including:

[0027] Assume that each client in the second set has been sorted according to certain rules;

[0028] Calculate the hash value of the random number generated by this client;

[0029] Calculate the hash value of all first shared keys for this client;

[0030] The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data;

[0031] The privacy key is constructed by using the privacy data, the hash value of the random number, the hash values ​​of all first shared keys, and the hash values ​​of each first shared key to encrypt the privacy data.

[0032] Based on the aforementioned technical means, the privacy data uses the hash values ​​of all first shared keys of the current client and the hash value of the random number. Since the first shared key is built on the first private key, the first private key and the random number of the current client need to be decrypted simultaneously during the decryption process to achieve decryption. This adds a double mask to the privacy data to ensure privacy and security.

[0033] A second aspect of this application provides a data aggregation method applied on a server side, the data aggregation method comprising:

[0034] Generate common parameters and send them to all clients;

[0035] Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair;

[0036] Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set.

[0037] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0038] Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client;

[0039] The random number share of the online client is received after being decrypted by the online client, so as to eliminate the random number mask of the online client's private ciphertext. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value.

[0040] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0041] Based on the above technical means, during aggregated decryption, the server will only receive the private key share of the offline client and the random number share of the online client, and will not receive the random number share of the offline client. Thus, the server can eliminate the key mask and random number mask of the online client's private ciphertext, but cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0042] In some feasible embodiments, receiving a share of the offline client's private key to eliminate the key masking of the online client's private ciphertext by the offline client includes:

[0043] Assume that each client in the second set has been sorted according to certain rules;

[0044] Receive the private key share from the disconnected client;

[0045] The first private key of the offline client is reconstructed based on the privacy share of the offline client and the threshold secret sharing algorithm;

[0046] Based on the first private key of the offline client and the first public key of the online client, a first shared key between the offline client and each client in the third set is generated according to the key exchange algorithm.

[0047] Calculate the hash value of each first shared key;

[0048] The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data;

[0049] The key mask for the private ciphertext of the online client is eliminated by using the hash value of the first shared key and the hash values ​​of each first shared key to encrypt private data.

[0050] Based on the aforementioned technical means, the decryption process reconstructs the first private key of the offline client according to the private key share of the offline client. Then, it generates the first shared key of the offline client based on the first private key and the first public key of other clients. Finally, it eliminates the key mask of the offline client's privacy ciphertext to the online client by using the hash value of the first shared key and the hash values ​​of each first shared key to encrypt privacy data. The data transmission process supports client disconnection.

[0051] In some feasible embodiments, receiving a random number share from the online client to eliminate the random number masking of the online client's private ciphertext includes:

[0052] Receive random number shares from online clients;

[0053] Reconstruct the random numbers of the online client based on the random number share of the online client and the threshold secret sharing algorithm;

[0054] Calculate the hash value of a random number;

[0055] The random number mask used by the online client to remove the privacy ciphertext of the online client is eliminated based on the hash value of the random number.

[0056] Based on the above technical means, only online clients will decrypt the random number share, thereby reconstructing the random number of the online client and eliminating the random number mask of the online client's private ciphertext. On the one hand, it supports client disconnection; on the other hand, if the client is offline, the random number mask of the disconnected client's private ciphertext cannot be eliminated, thus ensuring the privacy and security of the disconnected client.

[0057] A third aspect of this application provides a data aggregation method, the data aggregation method comprising:

[0058] The server generates common parameters and sends them to all clients.

[0059] The client generates two key pairs based on the received public parameters and sends the public key pairs to the server.

[0060] The server receives the public key pair and forwards it to all clients in the first set, which is the set of all clients that participate in sharing the public key pair.

[0061] The client shares the first private key and the random number to obtain multiple private key shares and multiple random number shares. Based on the second private key, the private key shares and random number shares are encrypted and sent to the server. The first private key is the private key in the first key pair of two key pairs, and the second private key is the private key in the second key pair of two key pairs.

[0062] The server receives the private key share ciphertext and the random number share ciphertext and forwards them to all clients in the second set. The second set is a subset of the first set.

[0063] The client generates a first shared key based on its own first private key and the first public key of any second client, wherein the client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client.

[0064] The client encrypts the privacy data using the first shared key and a random number to obtain the privacy ciphertext, and then sends it to the server.

[0065] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0066] Receive the third set through the client;

[0067] The client decrypts the private key share of the disconnected client and sends it to the server.

[0068] The client decrypts the random number share of the online client and sends it to the server.

[0069] The server receives the private key share from the offline client to eliminate the key masking of the online client's private ciphertext by the offline client.

[0070] The server receives random number shares from online clients to eliminate the random number masking of online clients' private ciphertexts. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value.

[0071] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0072] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, and also decrypts the random number share of the online client, but does not decrypt the random number share of the offline client. The server can remove the key mask and random number mask of the online client's privacy ciphertext, but cannot remove the random number mask of the offline client, thus supporting client disconnection while preventing the leakage of the offline client's privacy data.

[0073] A fourth aspect of this application provides a data aggregation apparatus, the data aggregation apparatus including a first processing unit, the first processing unit being arranged at a client, for:

[0074] Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server.

[0075] The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs.

[0076] The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs.

[0077] A first shared key is generated based on the first private key of this client and the first public key of any second client. The client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing public key pairs. The first public key is the public key in the first key pair of the second client.

[0078] The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server.

[0079] Receive the third set, which is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set;

[0080] Decrypt the private key share of the disconnected client and send it to the server;

[0081] Decrypt the random number share from the online client and send it to the server;

[0082] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0083] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, while also decrypting the random number share of the online client. It does not decrypt the random number share of the offline client, so that the server can eliminate the key mask and random number mask of the online client's private ciphertext, but cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0084] A fifth aspect of this application provides a data aggregation apparatus, the data aggregation apparatus including a second processing unit disposed on a server side, the second processing unit being used for:

[0085] Generate common parameters and send them to all clients;

[0086] Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair;

[0087] Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set.

[0088] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0089] Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client;

[0090] The random number share of the online client is received to eliminate the random number mask of the online client's private ciphertext. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value.

[0091] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0092] Based on the above technical means, during aggregated decryption, the server will only receive the private key share of the offline client and the random number share of the online client, and will not receive the random number share of the offline client. Thus, the server can eliminate the key mask and random number mask of the online client's private ciphertext, but cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0093] A sixth aspect of this application provides a data aggregation system, the data aggregation system comprising a client and a server;

[0094] The client is used for:

[0095] Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server.

[0096] The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs.

[0097] The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs.

[0098] A first shared key is generated based on the first private key of this client and the first public key of any second client, wherein this client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client;

[0099] The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server.

[0100] Receive the third set;

[0101] Decrypt the private key share of the disconnected client and send it to the server;

[0102] Decrypt the random number share from the online client and send it to the server;

[0103] The server is used for:

[0104] Generate common parameters and send them to all clients;

[0105] Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair;

[0106] Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set.

[0107] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0108] Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client;

[0109] Receive a random number share from the online client to eliminate the random number masking of the online client's private ciphertext;

[0110] The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to the threshold value.

[0111] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0112] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, and also decrypts the random number share of the online client, but does not decrypt the random number share of the offline client. The server can remove the key mask and random number mask of the online client's privacy ciphertext, but cannot remove the random number mask of the offline client, thus supporting client disconnection while preventing the leakage of the offline client's privacy data.

[0113] The seventh aspect of this application provides an electronic device, comprising:

[0114] The memory is configured to store instructions; and

[0115] The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the data aggregation method.

[0116] An eighth aspect of this application provides a machine-readable storage medium storing instructions for causing a machine to perform the data aggregation method.

[0117] The ninth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the data aggregation method.

[0118] The above technical solution can encrypt and share the client's first key and random number. During aggregation and decryption, the online client will only decrypt and send the private key share of the offline client to the server, and at the same time decrypt the random number share of the online client, but will not decrypt the random number share of the offline client. This allows the server to eliminate the key mask and random number mask of the online client's privacy ciphertext, but cannot eliminate the random number mask of the offline client, thus avoiding the leakage of the offline client's privacy data. It also supports the existence of client disconnection in the communication system.

[0119] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0120] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0121] Figure 1 This illustration schematically shows a data aggregation method flowchart applied to a client according to an embodiment of this application;

[0122] Figure 2 This illustration schematically shows a data aggregation method flow diagram applied to the server side according to an embodiment of this application;

[0123] Figure 3 The illustration shows a schematic flowchart of a data aggregation method according to an embodiment of this application. Detailed Implementation

[0124] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0125] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0126] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0127] Figure 1 The illustration shows a schematic diagram of a client-side data aggregation method according to an embodiment of this application. Figure 1As shown in the figure, this application provides a data aggregation method, which is applied to a client. The data aggregation method may include the following steps:

[0128] Step 101: Generate two key pairs based on the received public parameters and send the public key pairs to the server. In some feasible embodiments, the public parameters received by the client are generated and sent by the server in the system. The public parameters include a prime number q of length 2λ bits determined according to the given security parameter λ, a q-order multiplicative cyclic group G, a generator g∈G, and a hash function F:{0,1}. * →{0,1} 2λ And a prime number p of length λ bits, the common parameters are represented as params=(p,q,g,G,F), the given parameters also include the number of clients N participating in data aggregation and the threshold value t.

[0129] In some feasible embodiments, two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server, including:

[0130] First, a first key pair and a second key pair are generated through a key exchange algorithm. Each key pair includes a public key and a private key. The first key pair includes a first private key and a first public key, and the second key pair includes a second private key and a second public key.

[0131] Then, the first public key from the first key pair and the second public key from the second key pair are combined into a public key pair and sent to the server. This triggers the server to receive the public key pair and forward it to all clients in the first set. The server then compiles a public key list from the public key pairs of all clients participating in sharing the public key and forwards it to the clients. In some feasible embodiments, the clients send their public key pairs to the server. Once the number of public key pairs collected by the server exceeds a threshold, the set of these clients is designated as the first set, and the public key list is forwarded to all clients in the first set.

[0132] Thus, two keys are generated to encrypt private data during data transmission, providing the foundation for mask generation to ensure privacy and security.

[0133] Step 102: Share the first private key and the random number to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of two key pairs. In some feasible embodiments, a threshold secret sharing algorithm is used to share the first private key and the random number to obtain multiple private key shares and multiple random number shares. The threshold value of the threshold secret sharing algorithm is t. Therefore, during aggregate decryption, collecting t private key shares is sufficient to decrypt the first private key, and collecting t random number shares is sufficient to decrypt the random number. Thus, both the first private key and the random number are shared, and subsequent decryption only requires a sufficient number of private key shares and random number shares to achieve the desired result, enabling data transmission decryption to support client disconnection.

[0134] Step 103: Encrypt the private key share and the random number share based on the second private key and send them to the server. The second private key is the private key in the second key pair of two key pairs.

[0135] In some feasible embodiments, the private key share and the random number share are encrypted based on the second private key and then sent to the server, including:

[0136] A second shared key is generated using the second private key of this client and the second public key of any second client, resulting in multiple second shared keys. The second public key is the public key in the second key pair of the second client. In some feasible embodiments, a key exchange algorithm is used to generate the second shared key.

[0137] A symmetric authentication encryption algorithm is used to encrypt a private key share and a random number share based on any second shared key, resulting in multiple ciphertexts of the private key shares and multiple ciphertexts of the random number shares, which are then sent to the server. One second shared key is used to encrypt one private key share and one random number share. In some feasible embodiments, both the encrypted random number ciphertext and the private key ciphertext are sent to the server. Once the number of private key share ciphertexts and random number share ciphertexts collected by the server exceeds a threshold, the server forwards the set of random number ciphertexts and the set of private key ciphertexts to all clients in the second set. The number of random number share ciphertexts and private key share ciphertexts from each client is counted.

[0138] Based on the aforementioned technical means, a second shared key is generated using the second private key and the second public key of any other client. This shared key is used to encrypt the private key share and random number share when sharing them. After encryption, the shared key share or random number share is sent to the server. When it is necessary to decrypt the private key share or random number share later, each client can only parse the private key share and random number share associated with itself and cannot parse other shares, thus protecting the privacy of disconnected clients.

[0139] Step 104: Generate a first shared key based on the first private key of this client and the first public key of any second client. The first client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing the public key pair. The first public key is the public key in the first key pair of the second client. In some feasible embodiments, a key exchange algorithm is used to generate the first shared key.

[0140] Step 105: Encrypt the privacy data using the first shared key and a random number to obtain the privacy ciphertext, and send it to the server.

[0141] In some feasible embodiments, the privacy data is encrypted using a first shared key and a random number to obtain privacy ciphertext, including:

[0142] Assume that each client in the second set has been sorted according to certain rules;

[0143] Calculate the hash value of the random number generated by this client;

[0144] Calculate the hash value of all first shared keys for this client;

[0145] The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data;

[0146] The privacy key is constructed by using privacy data, the hash value of a random number, the hash values ​​of all first shared keys, and the hash values ​​of each first shared key to encrypt the privacy data. In some feasible embodiments, the method for determining the hash values ​​of each first shared key to encrypt the privacy data based on the client sorting result can be: when encrypting the privacy data, subtract the hash values ​​of the first shared keys of the current client and the clients sorted before the current client, and add the hash values ​​of the first shared keys of the current client and the clients sorted after the current client; or: when encrypting the privacy data, add the hash values ​​of the first shared keys of the current client and the clients sorted before the current client, and subtract the hash values ​​of the first shared keys of the current client and the clients sorted after the current client.

[0147] Based on the aforementioned technical means, the privacy data uses the hash values ​​of all first shared keys of the current client and the hash value of the random number. Since the first shared key is built on the first private key, the first private key and the random number of the current client need to be decrypted simultaneously during the decryption process to achieve decryption. This adds a double mask to the privacy data to ensure privacy and security.

[0148] Step 106: Receive the third set, which is the set of clients that sent the private ciphertext received by the server. The third set is a subset of the second set, so that the client can determine which clients will participate in this ciphertext parsing.

[0149] Step 107: Decrypt the private key share of the offline client and send it to the server. In some feasible embodiments, users only need to participate in aggregate decryption when they are online. Therefore, when the client is online, it needs to generate a second shared key between itself and the offline client using a key exchange algorithm based on its own second private key and the second public key of the offline client. Then, it uses a symmetric authentication encryption algorithm to decrypt the private key ciphertext of the offline client based on the second shared key to obtain the private key share of the offline client.

[0150] Step 108: Decrypt the random number share of the online client and send it to the server; the number of clients in the first, second, and third sets is greater than the threshold value in the public parameters. In some feasible embodiments, when the client is online, it needs to generate a second shared key between itself and the online client using a key exchange algorithm based on its own second private key and the second public key of the online client. A symmetric authentication encryption algorithm is then used to decrypt the random number ciphertext of the online client based on the second shared key to obtain the random number share of the offline client.

[0151] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregated decryption, the online client only decrypts and sends the private key share of the offline client to the server, while also decrypting the random number share of the online client. It does not decrypt the random number share of the offline client. This encryption and decryption condition allows the server to eliminate the key mask and random number mask of the online client's private ciphertext during aggregated decryption, but it cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0152] It should be clarified that steps 107 and 108 can be performed simultaneously or in reverse order.

[0153] Figure 2 The illustration shows a schematic diagram of a server-side data aggregation method according to an embodiment of this application. Figure 2 As shown in the embodiments of this application, a data aggregation method is provided. This method is applied to a server-side environment; in some feasible embodiments, the server-side environment may be a cloud server. The data aggregation method may include the following steps:

[0154] Step 201: Generate common parameters and send them to all clients. In some feasible embodiments, the common parameters include a prime number q of length 2λ bits determined according to a given security parameter λ, a q-factor multiplicative cyclic group G, a generator g∈G, and a hash function F:{0,1}. * →{0,1} 2λ And a prime number p of length λ bits, the common parameters are denoted as params = (p, q, g, G, F), and the given parameters also include the number of clients N participating in the data aggregation and the threshold value t. All clients are all clients participating in the data aggregation.

[0155] Step 202: Receive the public key pair and forward it to all clients in the first set. The first set is the set of all clients participating in sharing the public key pair. The public key pair is generated by the user and sent to the server. After the number of public key pairs collected by the server exceeds a threshold, the server designates the set of these clients as the first set, and then forwards the public key list to all clients in the first set.

[0156] Step 203: Receive the private key share ciphertext and random number share ciphertext and forward them to all clients in the second set. The second set is a subset of the first set, consisting of all clients participating in sharing the private key share and random number share. Once the number of private key share ciphertexts and random number share ciphertexts collected by the server exceeds a threshold, the server forwards the random number ciphertext set and the private key ciphertext set to all clients in the second set. The number of random number share ciphertexts and private key share ciphertexts from each client is recorded as a count.

[0157] Step 204: Receive the private ciphertext and forward the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and it is a subset of the second set. This allows the client to determine which clients will participate in the ciphertext parsing.

[0158] Step 205: Receive the private key share from the offline client to remove the key mask from the offline client's private ciphertext of the online client.

[0159] In some feasible embodiments, receiving a share of the offline client's private key to eliminate the key masking of the online client's private ciphertext by the offline client includes:

[0160] Assume that each client in the second set has been sorted according to certain rules;

[0161] Receive the private key share from the disconnected client;

[0162] The first private key of the offline client is reconstructed based on the privacy share of the offline client and the threshold secret sharing algorithm;

[0163] Based on the first private key of the offline client and the first public key of the online client, a first shared key between the offline client and each client in the third set is generated according to the key exchange algorithm.

[0164] Calculate the hash value of each first shared key;

[0165] The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data;

[0166] The key mask for the private ciphertext of the online client is eliminated by using the hash value of the first shared key and the hash values ​​of each first shared key to encrypt private data.

[0167] In some feasible embodiments, the method for determining the hash value of each first shared key to participate in encrypting privacy data based on the client sorting result can be as follows: when encrypting privacy data, subtract the hash value of the first shared key of the current client and the clients sorted before the current client, and add the hash value of the first shared key of the current client and the clients sorted after the current client; or, when encrypting privacy data, add the hash value of the first shared key of the current client and the clients sorted before the current client, and subtract the hash value of the first shared key of the current client and the clients sorted after the current client. It should be noted that the method of this application uses aggregate decryption. Therefore, when eliminating the key mask of offline clients' privacy ciphertext of online clients based on the hash value of the first shared key and the method of participating in encryption of privacy data using the hash values ​​of each first shared key, the hash value of each first shared key needs to participate in aggregate decryption in the same way as when encrypting privacy data, and does not need to use the reverse method. That is, if when encrypting private data, the hash value of the first shared key of the current client and the client ranked before the current client is subtracted, and the hash value of the first shared key of the current client and the client ranked after the current client is added, then when decrypting private data, the hash value of the first shared key of the current client and the client ranked before the current client is subtracted, and the hash value of the first shared key of the current client and the client ranked after the current client is added.

[0168] Based on the aforementioned technical means, the decryption process reconstructs the first private key of the offline client according to the private key share of the offline client. Then, it generates the first shared key of the offline client based on the first private key and the first public key of other clients. Finally, it eliminates the key mask of the offline client's privacy ciphertext to the online client by using the hash value of the first shared key and the hash values ​​of each first shared key to encrypt privacy data. The data transmission process supports client disconnection.

[0169] Step 206: Receive random number shares from online clients to eliminate the random number masking of online client privacy ciphertexts. The number of private key shares from offline clients and the number of random number shares from online clients are both greater than or equal to a threshold value; the number of clients in the first set, second set, and third set is greater than the threshold value in the public parameters. The number of private key shares from offline clients and the number of random number shares from online clients are obtained by decryption from online clients in the third set.

[0170] In some feasible embodiments, receiving a random number share from the online client to eliminate the random number masking of the online client's private ciphertext includes:

[0171] Receive random number shares from online clients;

[0172] Reconstruct the random numbers of the online client based on the random number share of the online client and the threshold secret sharing algorithm;

[0173] Calculate the hash value of a random number;

[0174] The random number mask used by the online client to remove the privacy ciphertext of the online client is eliminated based on the hash value of the random number.

[0175] Based on the above technical means, only online clients will decrypt the random number share, thereby reconstructing the random number of the online client and eliminating the random number mask of the online client's private ciphertext. On the one hand, it supports client disconnection; on the other hand, if the client is offline, the random number mask of the disconnected client's private ciphertext cannot be eliminated, thus ensuring the privacy and security of the disconnected client.

[0176] According to the above technical solution, during aggregated decryption, the server will only receive the private key share of the offline client and the random number share of the online client, and will not receive the random number share of the offline client. Thus, the server can eliminate the key mask and random number mask of the online client's privacy ciphertext, but cannot eliminate the random number mask of the offline client, thus avoiding the leakage of the offline client's privacy data.

[0177] It should be clarified that steps 206 and 205 can be performed simultaneously or in reverse order.

[0178] Figure 3 This is a schematic diagram illustrating a data aggregation method flow according to an embodiment of this application. Figure 3 As shown in the figure, this application provides a data aggregation method, which may include the following steps:

[0179] Step 301: Generate common parameters on the server side and send them to all clients;

[0180] Step 302: The client generates two key pairs based on the received public parameters and sends the public key pairs to the server.

[0181] Step 303: Receive the public key pair from the server and forward it to all clients in the first set, which is the set of all clients participating in sharing the public key pair;

[0182] Step 304: The client shares the first private key and the random number to obtain multiple private key shares and multiple random number shares. Based on the second private key, the private key shares and random number shares are encrypted and sent to the server. The first private key is the private key in the first key pair of two key pairs, and the second private key is the private key in the second key pair of two key pairs.

[0183] Step 305: Receive the private key share ciphertext and random number share ciphertext from the server and forward them to all clients in the second set. The second set is the set of all clients that participate in sharing the private key share and random number share. The second set is a subset of the first set.

[0184] Step 306: The client generates a first shared key based on its first private key and the first public key of any second client, wherein the client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client;

[0185] Step 307: The client encrypts the privacy data using the first shared key and a random number to obtain the privacy ciphertext, and then sends it to the server.

[0186] Step 308: Receive the private ciphertext through the server and forward the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0187] Step 309: Receive the third set via the client;

[0188] Step 310: Decrypt the private key share of the offline client through the client and send it to the server;

[0189] Step 311: Decrypt the random number share of the online client through the client and send it to the server;

[0190] Step 312: Receive the private key share from the offline client through the server to eliminate the key mask of the offline client's private ciphertext to the online client;

[0191] Step 313: The server receives random number shares from online clients to eliminate the random number masking of online clients' private ciphertexts. The number of private key shares of offline clients and the number of random number shares of online clients are both greater than or equal to a threshold value; the number of clients in the first set, the second set, and the third set is greater than the threshold value in the public parameters.

[0192] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, and also decrypts the random number share of the online client, but does not decrypt the random number share of the offline client. The server can remove the key mask and random number mask of the online client's privacy ciphertext, but cannot remove the random number mask of the offline client, thus supporting client disconnection while preventing the leakage of the offline client's privacy data.

[0193] It should be clarified that steps 310 and 311 can be performed simultaneously or in reverse order, and steps 312 and 313 can be performed simultaneously or in reverse order.

[0194] The method of this application is described below with specific implementation steps. In the implementation process of the data aggregation method of this application, firstly, the cloud server in the communication system composed of the cloud server and the client generates common parameters. Given a security parameter λ, the number of clients N, and a threshold value t, a prime number q of length 2λ bits, a q-order multiplicative cyclic group G, a generator g∈G, and a hash function F:{0,1} are selected. * →{0,1} 2λ And a prime number p of length λ bits. The cloud server sends the common parameters params = (p, q, g, G, F) to the client u. i ∈U, where U represents the set of all clients. For simplicity of representation, let U = {1,2,…,N}, that is, let u i =i.

[0195] The client then generates a key and shares it as a public key with the cloud server. Client i∈U generates the first key pair (pk) using the Diffie-Hellman (DH) key exchange algorithm. i ,sk i )←DH.gen(g,q,G) and the second key pair (pk′) i ,sk′ i )←DH.gen(g,q,G), where (pk i ,pk′ i (sk) represents a public key pair. i ,sk′ i This represents the private key pair. The client will send the public key pair (pk) to the client.i ,pk′ i Send to the cloud server. (pk) i ,sk i (pk′) is used to generate the secret input value of the hash function F. i ,sk′ i This is used to generate encryption keys for the Authenticated Encryption (AE) algorithm.

[0196] The cloud server receives public key pairs (pk) from at least t clients. i ,pk′ i After that, let this set of clients be the first set U1 (U1∈U). Let S i =(i,pk i ,pk′ i This represents client i and its two public keys. The cloud server will receive a list of public keys. Forwarded to all clients in the first set U1.

[0197] Then the client shares its first private key and a random number. Client i∈U1 receives the list of public keys sent by the cloud server. Then, it is determined whether |U1|≥t (where |U1| represents the number of clients in set U1). If not, the scheme is terminated to ensure that aggregate decryption can be achieved.

[0198] Client i∈U1 uses the threshold Shamir secret sharing algorithm on the first private key sk i and random number r i Share and generate private key shares and random number share Where sk i,j This indicates that sk i The secret value r assigned to client j i,j This means r i The secret value assigned to client j.

[0199] The second private key sk′ of client i∈U1 i A second shared key is generated using a key exchange algorithm with the second public keys of all clients in the first set other than the current client; the AE algorithm is then used to... and Encryption, i.e. and Let the ciphertext obtained by encrypting the private key share and the random number share be: and and ciphertext C i and T iSend to the cloud server.

[0200] The cloud server collects ciphertext C sent by at least t clients. j and T i Then, denote this set of clients as U2 (U2∈U1), and then the ciphertext... and Forward to all clients in set U2.

[0201] Then, the privacy data is encrypted. Client i∈U2 receives the ciphertext set sent by the cloud server. and Then, it is determined whether |U2|≥t is satisfied. If not, the scheme is terminated to ensure that aggregation decryption can be achieved.

[0202] Each pair of clients i and j uses the DH key exchange algorithm to generate a shared key s. i,j And use it as input to the hash function F.

[0203] Assume that the clients in set U2 have been sorted according to certain rules and the sorting result is known to the cloud server. Client i encrypts private data x. i The ciphertext is as follows:

[0204]

[0205] Then, the client will ciphertext ct i Send to the cloud server, among which This is the client's privacy data.

[0206] The cloud server collects ciphertext ct sent by at least t clients. i Then, denote this set of clients as U3 (U3∈U2), and then send set U3 to all clients.

[0207] Finally, the cloud server performs the aggregation and decryption. After receiving the list U3 sent by the cloud server, the client i∈U3 checks whether |U3|≥t is satisfied. If not, the process terminates to ensure that aggregation and decryption can be achieved.

[0208] For disconnected clients j∈U2\U3, online clients i∈U3 decrypt the private key share using the AE algorithm as AE.dec(DH.agree(pk′)). j ,sk′ i ),c i,j )→sk i,j The share of the decrypted private key Send to the cloud server.

[0209] For online clients j∈U3, the random number share decrypted by online clients i∈U3 using the AE algorithm is AE.dec(DH.agree(pk′). j ,sk′ i ),t i,j )→r i,j The share of the decrypted random number Send to the cloud server.

[0210] The cloud server collects private key shares and random number shares sent by at least t clients, denoted as U4 (U4∈U3). For disconnected clients, the cloud server uses the collected private key shares to reconstruct the private key sk of the disconnected client j∈U2\U3. j ,Right now Then, the reconstructed private key and the online client's public key are used to generate a shared key s using the DH algorithm. i,j This is done to eliminate the mask value generated by offline clients. For online clients, the cloud server uses the collected random number share to reconstruct the random number r for online client j∈U3. j ,Right now Therefore, the cloud server obtains the aggregated result value:

[0211]

[0212] As can be seen from the following formula, this method satisfies the correctness requirement:

[0213]

[0214] The above method has low computational and communication overhead, supports client disconnection, and supports collusion between cloud servers and clients with less than t.

[0215] Computational overhead

[0216] The client time complexity is O(2n+nl). The computational cost of each client can be decomposed into the following three parts: 1) Performing 2n key negotiations, which requires O(n) time; 2) Shamir secretly sharing to create private key shares, which requires O(n) time; 3) Generating mask values ​​through F, which requires O(nl) time.

[0217] Communication overhead

[0218] The client communication complexity is O(2n). The communication cost for each client can be broken down into three parts: 1) exchanging keys with other clients by sending two public keys and receiving two (n-1) public keys; 2) sending and receiving n-1 encrypted secret shares; 3) sending a data set of data to the server. The mask data. The total communication cost is Among them l dhand l ss These are the number of bits in the public key for key exchange and the number of bits in the secret share, respectively.

[0219] A fourth aspect of this application provides a data aggregation apparatus, the data aggregation apparatus including a first processing unit, the first processing unit being arranged at a client, for:

[0220] Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server.

[0221] The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs.

[0222] The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs.

[0223] A first shared key is generated based on the first private key of this client and the first public key of any second client. The client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing public key pairs. The first public key is the public key in the first key pair of the second client.

[0224] The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server.

[0225] Receive the third set, which is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set;

[0226] Decrypt the private key share of the disconnected client and send it to the server;

[0227] Decrypt the random number share from the online client and send it to the server;

[0228] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0229] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, while also decrypting the random number share of the online client. It does not decrypt the random number share of the offline client, so that the server can eliminate the key mask and random number mask of the online client's private ciphertext, but cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0230] A fifth aspect of this application provides a data aggregation apparatus, the data aggregation apparatus including a second processing unit disposed on a server side, the second processing unit being used for:

[0231] Generate common parameters and send them to all clients;

[0232] Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair;

[0233] Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set.

[0234] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0235] Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client;

[0236] The random number share of the online client is received to eliminate the random number mask of the online client's private ciphertext. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value.

[0237] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0238] Based on the above technical means, during aggregated decryption, the server will only receive the private key share of the offline client and the random number share of the online client, and will not receive the random number share of the offline client. Thus, the server can eliminate the key mask and random number mask of the online client's private ciphertext, but cannot eliminate the random number mask of the offline client, thus preventing the leakage of the offline client's private data.

[0239] A sixth aspect of this application provides a data aggregation system, the data aggregation system comprising a client and a server;

[0240] The client is used for:

[0241] Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server.

[0242] The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs.

[0243] The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs.

[0244] A first shared key is generated based on the first private key of this client and the first public key of any second client, wherein this client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client;

[0245] The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server.

[0246] Receive the third set;

[0247] Decrypt the private key share of the disconnected client and send it to the server;

[0248] Decrypt the random number share from the online client and send it to the server;

[0249] The server is used for:

[0250] Generate common parameters and send them to all clients;

[0251] Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair;

[0252] Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set.

[0253] The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set.

[0254] Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client;

[0255] Receive a random number share from the online client to eliminate the random number masking of the online client's private ciphertext;

[0256] The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to the threshold value.

[0257] The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

[0258] Based on the aforementioned technical means, the client encrypts and shares both the key and the random number. During aggregation and decryption, the online client only decrypts and sends the private key share of the offline client to the server, and also decrypts the random number share of the online client, but does not decrypt the random number share of the offline client. The server can remove the key mask and random number mask of the online client's privacy ciphertext, but cannot remove the random number mask of the offline client, thus supporting client disconnection while preventing the leakage of the offline client's privacy data.

[0259] The seventh aspect of this application provides an electronic device, comprising:

[0260] The memory is configured to store instructions; and

[0261] The processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the data aggregation method.

[0262] An eighth aspect of this application provides a machine-readable storage medium storing instructions for causing a machine to perform the data aggregation method.

[0263] The ninth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the data aggregation method.

[0264] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0265] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0266] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0267] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0268] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0269] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0270] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0271] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0272] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data aggregation method applied to a client, characterized in that, The method includes: Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server. The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs. The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs. A first shared key is generated based on the first private key of this client and the first public key of any second client. The client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing public key pairs. The first public key is the public key in the first key pair of the second client. The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server. Receive the third set, which is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set; Decrypt the private key share of the disconnected client and send it to the server; Decrypt the random number share from the online client and send it to the server; The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

2. The data aggregation method according to claim 1, characterized in that, Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server, including: The first key pair and the second key pair are generated using a key exchange algorithm; Combine the first public key from the first key pair with the second public key from the second key pair to form a public key pair and send it to the server.

3. The data aggregation method according to claim 1, characterized in that, The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares, including: A threshold secret sharing algorithm is used to share the first private key and the random number separately, resulting in multiple private key shares and multiple random number shares.

4. The data aggregation method according to claim 1, characterized in that, The private key share and random number share are encrypted based on the second private key and then sent to the server, including: A second shared key is generated using the second private key of this client and the second public key of any second client, resulting in multiple second shared keys. The second public key is the public key in the second key pair of the second client. A symmetric authentication encryption algorithm is used to encrypt a private key share and a random number share based on any second shared key, resulting in multiple private key share ciphertexts and multiple random number share ciphertexts, which are then sent to the server.

5. The data aggregation method according to claim 1, characterized in that, The privacy data is encrypted using the first shared key and a random number to obtain the privacy ciphertext, which includes: Assume that each client in the second set has been sorted according to certain rules; Calculate the hash value of the random number generated by this client; Calculate the hash value of all first shared keys for this client; The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data; The privacy ciphertext is constructed by using privacy data, the hash value of a random number, the hash values ​​of all first shared keys, and the hash values ​​of each first shared key to encrypt the privacy data.

6. A data aggregation method, applied on the server side, characterized in that, The method includes: Generate common parameters and send them to all clients; Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair; Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set. The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set. Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client; The random number share of the online client is received to eliminate the random number mask of the online client's private ciphertext. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value. The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

7. The data aggregation method according to claim 6, characterized in that, Receive the private key share from the offline client to remove the key mask from the offline client's private ciphertext of the online client, including: Assume that each client in the second set has been sorted according to certain rules; Receive the private key share from the disconnected client; The first private key of the offline client is reconstructed based on the privacy share of the offline client and the threshold secret sharing algorithm; Based on the first private key of the offline client and the first public key of the online client, a first shared key between the offline client and each client in the third set is generated according to the key exchange algorithm. Calculate the hash value of each first shared key; The method of determining the hash value of each first shared key based on the client sorting result to participate in encrypting privacy data; The key mask for the private ciphertext of the online client is eliminated by using the hash value of the first shared key and the hash values ​​of each first shared key to encrypt private data.

8. The data aggregation method according to claim 6, characterized in that, Receive a random number share from the online client to eliminate the random number masking of the online client's private ciphertext, including: Receive random number shares from online clients; Reconstruct the random numbers of the online client based on the random number share of the online client and the threshold secret sharing algorithm; Calculate the hash value of a random number; The random number mask used by the online client to remove the privacy ciphertext of the online client is eliminated based on the hash value of the random number.

9. A data aggregation method, characterized in that: The data aggregation method includes: The server generates common parameters and sends them to all clients. The client generates two key pairs based on the received public parameters and sends the public key pairs to the server. The server receives the public key pair and forwards it to all clients in the first set, which is the set of all clients that participate in sharing the public key pair. The client shares the first private key and the random number to obtain multiple private key shares and multiple random number shares. Based on the second private key, the private key shares and random number shares are encrypted and sent to the server. The first private key is the private key in the first key pair of two key pairs, and the second private key is the private key in the second key pair of two key pairs. The server receives the private key share ciphertext and the random number share ciphertext and forwards them to all clients in the second set. The second set is a subset of the first set. The client generates a first shared key based on its own first private key and the first public key of any second client, wherein the client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client. The client encrypts the privacy data using the first shared key and a random number to obtain the privacy ciphertext, and then sends it to the server. The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set. Receive the third set through the client; The client decrypts the private key share of the disconnected client and sends it to the server. The client decrypts the random number share of the online client and sends it to the server. The server receives the private key share from the offline client to eliminate the key masking of the online client's private ciphertext by the offline client. The server receives random number shares from online clients to eliminate the random number masking of online clients' private ciphertexts. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value. The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

10. A data aggregation device, characterized in that, The data aggregation device includes a first processing unit, which is located on the client side and is used for: Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server. The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs. The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs. A first shared key is generated based on the first private key of this client and the first public key of any second client. The client and the second client both belong to a second set, which is a subset of the first set. The first set is the set of all clients participating in sharing public key pairs. The first public key is the public key in the first key pair of the second client. The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server. Receive the third set, which is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set; Decrypt the private key share of the disconnected client and send it to the server; Decrypt the random number share from the online client and send it to the server; The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

11. A data aggregation device, characterized in that, The data aggregation device includes a second processing unit, which is disposed on the server side and is used for: Generate common parameters and send them to all clients; Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair; Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set. The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set. Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client; The random number share of the online client is received to eliminate the random number mask of the online client's private ciphertext. The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to a threshold value. The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

12. A data aggregation system, characterized in that, The data aggregation system includes a client and a server. The client is used for: Two key pairs are generated based on the received public parameters, and the public key pairs are sent to the server. The first private key and the random number are shared to obtain multiple private key shares and multiple random number shares. The first private key is the private key in the first key pair of the two key pairs. The private key share and the random number share are encrypted based on the second private key and then sent to the server. The second private key is the private key in the second key pair of the two key pairs. A first shared key is generated based on the first private key of this client and the first public key of any second client, wherein this client and the second client belong to the same second set, and the first public key is the public key in the first key pair of the second client; The private data is encrypted using the first shared key and a random number to obtain the private ciphertext, which is then sent to the server. Receive the third set; Decrypt the private key share of the disconnected client and send it to the server; Decrypt the random number share from the online client and send it to the server; The server is used for: Generate common parameters and send them to all clients; Receive the public key pair and forward it to all clients in the first set, which is the set of all clients that participated in sharing the public key pair; Receive the private key share ciphertext and the random number share ciphertext and forward them to all clients in the second set. The second set is the set of all clients who participated in sharing the private key share and the random number share. The second set is a subset of the first set. The server receives the private ciphertext and forwards the third set to all clients in the third set. The third set is the set of clients that sent the private ciphertext received by the server, and the third set is a subset of the second set. Receive the private key share from the offline client to eliminate the key mask of the offline client's private ciphertext to the online client; Receive a random number share from the online client to eliminate the random number masking of the online client's private ciphertext; The number of private key shares of the offline client and the number of random number shares of the online client are both greater than or equal to the threshold value. The number of clients in the first, second, and third sets exceeds the threshold value in the public parameters.

13. An electronic device, characterized in that, include: The memory is configured to store instructions; as well as A processor configured to retrieve the instructions from the memory and, when executing the instructions, to implement the data aggregation method of any one of claims 1 to 5, any one of claims 6 to 8, or claim 9.

14. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the data aggregation method as described in any one of claims 1 to 5, any one of claims 6 to 8, or claim 9.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the data aggregation method described in any one of claims 1 to 5, any one of claims 6 to 8, or claim 9.

Images