Internet-of-things-oriented privacy protection data security prediction method

Abstract

The invention discloses an Internet of Things-oriented privacy data security prediction method, which comprises the following steps of: on an edge side, performing security fusion calculation on multi-source sensor data by utilizing a multi-party security calculation technology, synchronously generating a message authentication code with addition homomorphism to verify the data integrity, and performing security fusion calculation on the multi-source sensor data through an asymmetric encryption and Hash verification mechanism. The method comprises the following steps of: securely transmitting data to a cloud, sequentially completing verification of transmission integrity, homomorphic labels and timeliness after the cloud decrypts the data, constructing a distributed index in an encrypted domain by using a locality sensitive hash algorithm after the verification is passed, quickly retrieving historical similar data fragments, and finally, according to the retrieved similar data, obtaining a new encrypted domain. According to the method, the privacy protection weighted prediction of missing or abnormal data is realized, the problem of partial loss and tampering of the Internet of Things data can be effectively solved on the premise of guaranteeing the privacy and integrity of the data in the whole process, and the method has the advantages of high prediction accuracy, high system security and high communication and calculation efficiency, and is suitable for large-scale Internet of Things application scenes.

Description

Technical Field

[0001] This invention relates to the fields of information security and Internet of Things (IoT) application technology, and in particular to a privacy-preserving data security prediction method for the Internet of Things. Background Technology

[0002] With the widespread application of IoT technology, hundreds of millions of smart devices are continuously generating massive amounts of data, driving the rapid development of smart cities, smart homes, industrial automation, and health monitoring. However, IoT systems are generally deployed in open, dynamic, and not entirely trustworthy network environments, and data faces unprecedented privacy and security challenges throughout the entire process of collection, transmission, storage, and processing.

[0003] On the one hand, traditional multi-party computation (MPC) only considers how computation is performed between multiple devices, or mostly between servers, without considering how the underlying sensor data is encrypted and transmitted after MPC. On the other hand, traditional encryption schemes often only consider how data is encrypted and decrypted, without considering how to handle data loss in an IoT environment. Furthermore, time-series-based locality-sensitive hashing (LSH) schemes only focus on data prediction and do not consider the entire data transmission process.

[0004] Currently, most common data protection methods focus on communication link encryption or access control, lacking continuous protection for data during use and computation. Furthermore, most existing solutions fail to deeply integrate data integrity verification mechanisms with privacy-preserving computation processes, failing to achieve lightweight tamper-proofing and source trust assurance during data fusion and forwarding phases.

[0005] Therefore, the industry urgently needs a data security processing method that covers the entire "edge-cloud" link and balances privacy, integrity, and availability. This method should enable efficient and secure data fusion and forwarding in the IoT environment, support data retrieval and analysis under protected conditions, and ultimately achieve accurate and verifiable predictions of anomalies or missing information based on trusted historical data, thereby constructing a truly privacy-preserving data governance system suitable for the IoT environment. Summary of the Invention

[0006] The purpose of this invention is to solve key technical problems in the prior art, such as secure fusion of multi-smart sensor data at the edge, confidentiality and integrity assurance in transmission and storage, efficient similarity retrieval under protected conditions, and privacy prediction of missing data based on similar history. The invention proposes a privacy-preserving data security prediction method for the Internet of Things.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: A privacy-preserving data security prediction method for the Internet of Things includes the following steps: Step S1: Record the raw sensor readings Perform edge-side security fusion and integrity tag generation to obtain the output data packet; Step S2: Perform elliptic curve encryption on the output data packet to generate a complete ciphertext component, and transmit the complete ciphertext component to the cloud server; Step S3: The cloud server decrypts the complete ciphertext component to obtain the original plaintext data, and then verifies the integrity of the original plaintext data. Step S4: Based on historical data from the cloud server, construct a distributed local hash table within the encrypted domain, and combine it with similar fragment retrieval to obtain a global similarity matrix. ; Step S5: Predict missing data based on the global similarity matrix.

[0008] Furthermore, the specific steps of step S1 include: Step S11: Set a reasonable range of values L and U are the lower and upper limits set based on prior knowledge or physical laws. If the sensor's original reading... Values ​​outside the reasonable range Then the original sensor readings will be used. Replace with the mean statistic of the time window W; otherwise, retain the original sensor readings. To realize the raw readings of the sensor Perform cleaning; the cleaned data is recorded as follows. ; Step S12: Pre-generate Beaver multiplication triples (K1, K2, K), where K is a number randomly generated by the edge server, and the components of the Beaver multiplication triple (K1, K2, K) are securely distributed to the two sensors. By combining the cleaned data from the two sensors and exchanging mask data, the secret shared form of the data product of the two sensors is obtained through collaborative calculation and sent to the edge server. Step S13: For each predefined time window T, the server calculates the mean of the security features from p sensors within the window using a secure addition protocol, and constructs a daily time window feature vector based on this mean. ={ },in This represents the mean of the multi-sensor data fusion results within the x-th time window, where m is the total number of time windows per day. Step S14: Obtain the feature vector =[ After that, the server generates a timestamp and a nonce to prevent replay, and calculates the integrity tag using inner product operations. Then the feature vector =[ The output data packet is composed of an integrity tag, a timestamp, and a nonce to prevent replay.

[0009] Furthermore, the integrity label is calculated using inner product operations. The expression is:

[0010] in, To enable edge servers and cloud servers to share homomorphic MAC key vectors, vi is the data in Vt, ki is the data in Khanc, and i is from 1 to m.

[0011] Furthermore, the specific steps of step S2 include: Step S21: Use elliptic curve cryptography to encrypt the feature vector in the output data packet. Integrity label The timestamp and the nonce (a random number used to prevent replay) are encrypted one by one, and an integer is randomly selected on the cloud server. k As a private key 'n' represents the order of the elliptic curve chosen, which is multiplied by a specific factor G generated from the elliptic curve E to generate the public key. Then the public key Transmitted to the edge server; Step S22: The edge server receives the public key Q from the cloud server, encodes the plaintext into points on the curve, and randomly generates a number r. Calculate ciphertext components and Then based on the ciphertext components and Constructing a complete ciphertext Send to the cloud server.

[0012] Furthermore, the computation of ciphertext components and The expression is:

[0013]

[0014] M is the plaintext code to be encrypted, which is a point on the curve, and G is a base point on the elliptic curve.

[0015] Furthermore, the specific steps of step S3 include: Step S31: The cloud server receives the complete ciphertext from the edge server. , private key k Substituting into the intermediate value calculation formula yields the intermediate value. Based on the median value Decrypt and recover plaintext Then decrypt and recover the plaintext. Decoding yields the original plaintext data; Step S32: Use the pre-shared key Recalculate the integrity label to obtain the integrity label. Compare and verify integrity labels and integrity label If the data is consistent, proceed to the next step; otherwise, it is determined that the data content has been tampered with, and a security event is recorded. Step S33: Check the validity of the timestamp. ,in This indicates the current time, where `timestamp` represents the time the edge server encapsulated the data, and `time_window` represents the duration of the data. At this point, the system checks if the random number is unique, queries the random number usage record database to verify if the nonce has been reused. If a duplicate is found, it's considered a replay attack; otherwise, the random number is recorded, and the desired data is obtained for the next step. .

[0016] Furthermore, the formula for calculating the intermediate value is as follows: .

[0017] Furthermore, the specific steps of step S4 include: Step S41: Construct a three-dimensional tensor Historical data is stored in a structured format, where N is the total number of servers of the same type, U is the total number of historical dates, and T is the total number of time windows within a single day. This represents the data for the k-th time period on the j-th date in the i-th server; Step S42: For each server node Its historical data is unfolded from a three-dimensional tensor to construct a two-dimensional data matrix. ; Step S43: Generate R T-dimensional random vectors Define a single hash function ; Step S44: Construct a random matrix Its column vectors are R T-dimensional random vectors. Then for each server Data matrix Perform distributed hash calculation to obtain its corresponding binary hash matrix. Then, the R-bit hash signature of each row of the matrix corresponding to one day's data is obtained to form a local hash table; Step S45: For each local hash table, construct a date similarity matrix. The matrix is ​​a U×U square matrix. It is constructed by creating L independent hash tables and summing their similarity matrices. ; Step S46: Aggregate the local similarity matrices of all N servers to form a global similarity matrix. .

[0018] Furthermore, regarding the target date ,according to choose Most similar date set Predict the target server On the date Time window Missing data.

[0019] Compared with existing technologies, the advantages of this invention are: This invention addresses the risks of privacy breaches and data integrity corruption during data collection, fusion, and transmission in the Internet of Things (IoT) environment. It proposes a privacy-preserving data security prediction method that integrates multi-party secure computation and locality-sensitive hashing. By achieving secure data fusion and integrity tag generation at the edge and performing decryption verification and similar data retrieval in the cloud, it achieves accurate prediction of missing or abnormal data without exposing the original data throughout the process. This effectively solves the problem of reliable recovery of IoT data when it is partially lost or tampered with. It boasts high security, prediction accuracy, and system practicality, making it suitable for large-scale data application scenarios such as smart cities and industrial IoT. Attached Figure Description

[0020] Figure 1 The flowchart presents a privacy-preserving data security prediction method for the Internet of Things (IoT) proposed in this invention.

[0021] Figure 2 This diagram illustrates an application example of the privacy-preserving data security prediction method for the Internet of Things proposed in this invention. Detailed Implementation

[0022] The invention will now be further explained with reference to the accompanying drawings.

[0023] like Figure 1 As shown, this invention provides a privacy-preserving data security prediction method for the Internet of Things, comprising the following steps: Step S1: Record the raw sensor readings Perform edge-side security fusion and integrity tag generation to obtain the output data packet.

[0024] Step S2: Perform elliptic curve encryption on the output data packet to generate a complete ciphertext component, and transmit the complete ciphertext component to the cloud server.

[0025] Step S3: The cloud server decrypts the complete ciphertext component to obtain the original plaintext data, and then verifies the integrity of the original plaintext data.

[0026] Step S4: Based on historical data from the cloud server, construct a distributed local hash table within the encrypted domain, and combine it with similar fragment retrieval to obtain a global similarity matrix. .

[0027] Step S5: Predict missing data based on the global similarity matrix.

[0028] In step S1, for a certain sensor node at time... readings Given a reasonable range of values .when Less than L or If it is greater than U, then It can be represented by mean(W), in other cases... ,in These are the original readings; L and U are the lower and upper limits set based on prior knowledge or physical laws. If the value exceeds a reasonable range, it is replaced with the statistic of the time window W in which it occurs, where W represents the average or median of the previous k time points. This indicates the data after cleaning.

[0029] Let the two sensors be sensor A and sensor B. The data from sensor A after cleaning at time t is: The data from smart sensor B after cleaning is The edge server randomly generates a number. , Split K into and , Split into and , Split into and ,Will , Assigned to smart sensor A, , , Assigned to smart sensor B.

[0030] Set mask , Smart sensor A calculation , Smart Sensor B Calculation , The intelligent sensor B will calculate and Send it to smart sensor A, smart sensor A will and Send the calculated results to sensor B as needed: .

[0031] Smart sensor A calculates:

[0032] Smart Sensor B Calculation:

[0033] Here, the signal is configured to allow only smart sensor A to perform calculations. That's fine; smart sensor B doesn't need to perform recalculation. Smart sensor A will calculate the... The data is transmitted to the edge server, and smart sensor B will... The data is transmitted to the edge server, which then adds the data from smart sensors A and B together. Without leaking the original data and In this case, S obtained the data from the multiplication of smart sensor A and B.

[0034] The edge server aggregates the security calculation results from multiple sensors to construct a complete feature vector. For each time window T, which is self-defined and represents a time interval, the edge server collects security-computed statistical features from p sensors and calculates the mean of each sensor within the time window using a secure addition protocol. ,in This represents the instantaneous data obtained by multiplying smart sensor A and smart sensor B at time tj. Based on the obtained data, we constructed a time window covering all times within a given date. ={ }, where m represents the number of time windows within a given date. This represents the mean of the instantaneous product of the data from the two smart sensors during the x-th time period. and .

[0035] A linear homomorphic message authentication code scheme is used to generate integrity labels for feature vectors. This scheme is based on vector dot product operations and has additive homomorphism, allowing integrity verification even after subsequent linear operations are performed on the data. Edge servers and cloud servers pre-share a homomorphic MAC key vector. This key vector is generated and distributed via a security protocol during system initialization, and the feature vector... If the dimension is m, then the key vector , each of which It is a random number, selected from a finite field. The edge server obtains the feature vector from step S13. =[ Generate the current timestamp (timestamp) and a random number (nonce) to prevent replay attacks. The next step is to calculate the complete... As feature vectors with vector inner product ,initialization For i from 1 to m, execute All operations are performed within a finite field. The feature vector, integrity label, timestamp, and random number are combined into the output packet. .

[0036] In step S2, the output packet The following are some of the parameters used as input for elliptic cryptography:

[0037] Assuming v is data generated by the edge server, and is one of the data in step S14, it is encoded using Koblitz as a point M on an elliptic curve to construct the equation of the elliptic curve. A large prime number p is defined, and parameters a and b are chosen, the values ​​of a and b satisfying... The equation of the elliptic curve is We select a base point G to compute the public key Q. Here, a point addition operation is defined as follows: , Suppose two points Q1 and Q2 are two points on the curve. If Q1 = Q2, then

[0038] like but

[0039] Calculate the public key using dot addition. Here, the multiplication of k and G means that each operation is a dotted addition, not a simple multiplication of k and G. After obtaining Q, it is transmitted from the cloud server to the edge server.

[0040] Encryption is performed on the edge server. A random number r is selected and generated for each encryption operation. The value of r is between 1 and n-1. The ciphertext components are then calculated. , Construct a complete ciphertext Send to the cloud server.

[0041] In step S3, the cloud server receives the encrypted data transmitted from the edge server. Calculate its median value Decrypt and recover plaintext , Substituting each value yields The obtained M is decoded back into the original plaintext data, and the feature vector is extracted. =[ Integrity tag timestamp, nonce.

[0042] Use pre-shared keys Recalculate integrity labels Meanwhile, the integrity labels are compared and verified. and integrity label If the data is consistent, proceed to the next step; otherwise, it is determined that the data content has been tampered with, and a security event is recorded.

[0043] Check the validity of the timestamp. ,in This indicates the current time, while the timestamp represents the time the edge server encapsulated the data. The time window is typically around 5-10 minutes, representing the duration of the data. At this point, the uniqueness of the random number is checked by querying the random number usage record database to verify if the nonce has been reused. If a duplicate is found, it's considered a replay attack. If no duplicate is found, the random number is recorded, and the desired data is obtained for the next step. ={ }

[0044] In step 4, a tensor data structure with three dimensions is constructed. Where N represents the number of servers of the same type, U represents the number of historical dates, and T represents the number of time windows within a single day.

[0045] A group of servers of the same type belonging to different parties.

[0046] Data from different days on a single server.

[0047] Data at different times of the day.

[0048] ={ }yes The data here is a partial calculation using time period data from a single day.

[0049] , representing the i-th sensor, ; , indicating the j-th day, , , representing the data in the k-th time period. , This represents the data for the k-th time period on the j-th date in the i-th server.

[0050] For each server node The data matrix is ​​constructed as follows:

[0051] Generate R T-dimensional random vectors Define a single hash function

[0052] in Indicates server The data vector on day j.

[0053] Constructing a random matrix

[0054] Each column here represents a T-dimensional random vector, and there is a total of R T-dimensional random vectors forming a random matrix V.

[0055] Calculate the hash matrix

[0056] For each of the hash matrix tables mentioned above, construct a date similarity matrix.

[0057] in Indicates date sky, ,express To determine the similarity of individual hash tables over a given day, construct L hash tables and sum them up. Let L represent the similarity of the L hash tables for the i-th sensor.

[0058] Aggregate the similarity matrix of all servers

[0059] In step 5, This represents the sum of the similarities between all servers over a single day. This represents the sum of similarities between days U and U, for dates with missing target values. ,according to Choice and Most similar date Individual, set , indicating with The K most similar dates are used to predict the target server. Missing values, that is On the date Time window Missing data.

[0060]

[0061] This method protects data privacy on each server through distributed LSH processing, performs similarity fusion at the center, and ultimately achieves accurate data missing prediction. As is known from common technical knowledge, this invention can be implemented through other embodiments that do not depart from its spirit or essential characteristics. Therefore, the disclosed embodiments described above are merely illustrative and not exhaustive. All modifications within the scope of this invention or its equivalents are included in this invention.

Claims

1. A privacy protection data security prediction method for Internet of Things, characterized in that, The method comprises the following steps: Step S1: raw sensor readings perform edge-side security fusion and integrity tag generation to obtain an output data packet; Step S2: elliptic curve encryption is performed on the output data packet to generate a complete ciphertext component, and the complete ciphertext component is transmitted to a cloud server; Step S3: the cloud server decrypts the complete ciphertext component to obtain original plaintext data, and then performs integrity verification on the original plaintext data; Step S4: Constructing distributed local hash table in the encryption domain based on the historical data of the cloud server, combining similar segment retrieval, and obtaining a global similarity matrix ; Step S5: missing data is predicted based on a global similarity matrix. 2.The IoT-oriented privacy-preserving data security prediction method of claim 1, wherein: The specific steps of the step S1 comprise: Step S11: Set a reasonable value range , L and U are the lower limit and upper limit set according to prior knowledge or physical law, if the sensor original reading exceeds the reasonable value range , the sensor original reading is replaced by the mean statistical quantity of the time window W, otherwise the sensor original reading is retained, to realize the cleaning of the sensor original reading , and the cleaned data is recorded as ; Step S12: pre-generate Beaver multiplication triple (K1, K2, K), wherein K is an edge server randomly generated a number, and the components of the Beaver multiplication triple (K1, K2, K) are securely distributed to two sensors, combined with the cleaned data of the two sensors, the secret sharing form of the data product of the two sensors is calculated through the exchange of mask data, and sent to the edge server; Step S13: For each predefined time window t, the server computes the mean of the secure features from the p sensors within the window by the secure addition protocol, and builds a daily time window feature vector based on the mean ={ }wherein represents the mean of the multi-sensor data fusion result within the xth time window, x is any value between 1 and m, and m is the total number of single-day time windows. Step S14: Obtain the feature vector [ ] After that, the server generates a timestamp timestamp and a replay protection random number nonce, and calculates an integrity label through an inner product operation , and then combines the feature vector [ ], the integrity label, the timestamp timestamp and the replay protection random number nonce into an output data packet. 3.The IoT-oriented privacy-preserving data security prediction method of claim 2, wherein: The integrity tag is calculated by an inner product operation is expressed as: wherein, to share homomorphic MAC key vectors with the edge server and the cloud server, vi is data in Vt, ki is data in Khamc, and i is 1 to m. 4.The IoT-oriented privacy-preserving data security prediction method of claim 1, wherein: The specific steps of the step S2 comprise: Step S21: using elliptic curve encryption to encrypt the feature vector in the output data packet , integrity label , timestamp and anti-replay nonce one by one, and randomly select an integer on the cloud server k as a private key, , n represents the order of the selected elliptic curve, which is operated with the base point G generated by the elliptic curve E to generate a public key , and then the public key is transmitted to the edge server; Step S22: the edge server receives the public key Q transmitted from the cloud server, encodes the plaintext into a point on the curve, randomly generates a number r, , calculates the ciphertext component and , and constructs the complete ciphertext and according to the ciphertext components and sends the complete ciphertext to the cloud server. 5.The IoT-oriented privacy-preserving data security prediction method of claim 4, wherein: The computed ciphertext component And The expression is: Wherein the plaintext code required for encryption is a point on a curve, and G is a base point on an elliptic curve. 6.The IoT-oriented privacy-preserving data security prediction method of claim 4, wherein: The specific steps of the step S3 comprise: Step S31: the cloud server receives the complete ciphertext from the edge server , the private key k is brought into the intermediate value calculation formula to obtain the intermediate value , based on the intermediate value , the ciphertext is decrypted to recover the plaintext , and the decrypted and recovered plaintext is decoded to obtain the original plaintext data; Step S32: using the pre-shared key re-computing the integrity label to obtain an integrity label , comparing the verification integrity label and the integrity label , if consistent, then performing the next step, if inconsistent, then determining that the data content is tampered, recording a security event; Step S33: checking validity of the time stamp wherein represents the current time, timestamp is the time when the edge server encapsulates the data, time_window is the duration of the data, and at this time, it is checked whether the random number is unique, the random number record library is queried, it is verified whether the nonce is repeatedly used, if it is found that it is repeated, it is determined as a replay attack, if no repetition is found, the random number is recorded, and the desired data in the next step is obtained ={ }.

7. The privacy-preserving data security prediction method for Internet of Things of claim 6, wherein: The intermediate value calculation formula is: 。 8.The IoT-oriented privacy-preserving data security prediction method of claim 1, wherein: The specific steps of the step S4 comprise: Step S41: Construct a three-dimensional tensor Structuring the historical data, where N is the total number of servers of the same type, U is the total number of historical dates, and T is the total number of time windows in a single day, represents the data of the i-th server, the j-th date, and the k-th time period. Step S42: For each server node unfolding its historical data from a three-dimensional tensor, a two-dimensional data matrix is constructed ; Step S43: generating R T-dimensional random vectors , defining a single hash function ; Step S44: Construct a random matrix Its column vectors are R T-dimensional random vectors. Then for each server Data matrix Perform distributed hash calculation to obtain its corresponding binary hash matrix. Then, the R-bit hash signature of each row of the matrix corresponding to one day's data is obtained to form a local hash table; Step S45: For each local hash table, a date similarity matrix is constructed This matrix is a UxU matrix, by constructing L independent hash tables and accumulating their similarity matrices, i.e. ; Step S46: aggregate all the local similarity matrices of the N servers to form a global similarity matrix . 9.The IoT-oriented privacy-preserving data security prediction method of claim 8, wherein: The specific steps of the step S5 comprise: For a target date , a most similar set of dates is selected according to , the target server predicts missing data for the date in a time window .

Images