A method and device for privacy protection of streaming data based on homomorphic computation

Abstract

This invention belongs to the field of streaming data privacy protection and is a method and apparatus for streaming data privacy protection based on encrypted computation, comprising the following steps: S1: Constructing a streaming data sensitivity determination model, and dividing the real-time incoming data into high-sensitivity fragments, medium-sensitivity fragments, and low-sensitivity fragments according to the time dimension of the data and the relationship between the data subject and object; S2: Allocating high-sensitivity fragments to edge nodes for light encrypted computation, medium-sensitivity fragments to edge-cloud collaborative encrypted computation, and low-sensitivity fragments to the cloud for full encrypted computation; S3: Dynamically adjusting the granularity of fragmentation and the division ratio of computation tasks according to the window sliding period of the streaming data; S4: Establishing a secure channel between the edge and the cloud through a secure key negotiation mechanism to achieve fusion verification of the encrypted computation results and output the final processing result.

Description

Technical Field

[0001] This invention belongs to the field of streaming data privacy protection, and in particular, it is a streaming data privacy protection method and apparatus based on dense state computation. Background Technology

[0002] In the context of big data, massive amounts of data are generated in real time by multiple edge nodes and aggregated in the cloud for tasks such as statistical analysis and data mining. This data is usually user privacy data or corporate trade secrets.

[0003] Therefore, how to protect users' privacy data during data processing has become an important research topic.

[0004] Existing privacy protection algorithms commonly use statistical obfuscation and data anonymization, which cannot meet the business needs that require high accuracy.

[0005] Therefore, existing technologies include privacy protection solutions based on trusted hardware, such as a privacy data sharing method based on Intel SGX software protection extension instructions. This method relies on trusted hardware, encrypts the processed data, and then uses a privacy data sharing application sandbox built on Intel SGX to calculate and store sensitive data.

[0006] This method shifts computation from the cloud to the edge, but trusted hardware is expensive and not suitable for widespread adoption.

[0007] Therefore, there is an urgent need for a method and apparatus for protecting the privacy of streaming data based on dense-state computation to solve the above problems. Summary of the Invention

[0008] This invention proposes a method and apparatus for protecting the privacy of streaming data based on dense-state computation.

[0009] A method and apparatus for protecting the privacy of streaming data based on dense-state computation, comprising the following steps: S1: Construct a streaming data sensitivity determination model, and divide the real-time incoming data into high-sensitivity fragments, medium-sensitivity fragments, and low-sensitivity fragments according to the time dimension of the data and the relationship between the data subject and the object. S2: Allocate high-sensitivity fragments to edge nodes to perform light dense-state computation, medium-sensitivity fragments to edge-cloud collaborative computation to perform hybrid dense-state computation, and low-sensitivity fragments to the cloud to perform full dense-state computation; S3: Dynamically adjust the granularity of the partitions and the partitioning ratio of the computational tasks based on the window sliding period of the streaming data; S4: Establish a secure channel between the edge and the cloud through a secure key negotiation mechanism to achieve fusion verification of the encrypted computation results and output the final processing result.

[0010] Preferably, in step S1, the data stream is monitored in real time. When the monitored data volume reaches a threshold, the monitored data is divided into several periodic time windows. Based on the data sensitivity within the time window, the data within the time window is divided into three granularities: the low-sensitivity granularity is the largest, the medium-sensitivity granularity is the second largest, and the high-sensitivity granularity is the smallest. The time granularity is determined by the product of a preset time period length and a granularity coefficient, wherein the granularity coefficient is negatively correlated with the granularity sensitivity.

[0011] Preferably, in S2, the computing tasks deployed at the edge are a subset of basic time-series system computing, the computing tasks deployed in the cloud are a subset of full time-series system computing, and the tasks of edge-cloud collaborative computing are a set of collaborative operators; the set of collaborative operators is the difference between the subset of full time-series system computing and the subset of basic time-series system computing; the set of operators includes any one of window count, average, weighted average, weighted median, maximum, minimum, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features.

[0012] Preferably, in step S3, the dynamic adjustment is triggered by monitoring new data entering the sliding time window, and the adjustment is performed in segments based on the relationship between the data sensitivity score and a preset threshold. If the data within the window before the current timestamp has not been fully calculated and the sensitivity score is higher than the high sensitivity threshold, it is classified as a high sensitivity segment. If the sensitivity score is between the high sensitivity threshold and the medium sensitivity threshold, it is divided into medium sensitivity segments; If the sensitivity score is lower than the medium sensitivity threshold, it is classified as a low sensitivity segment.

[0013] Preferably, the lightweight encrypted computation in S2 includes lightweight partial homomorphic encryption and lightweight secret sharing; the hybrid encrypted computation includes full partial homomorphic encryption, lightweight secret sharing, and full secret sharing; the full encrypted computation includes full homomorphic encryption and full secret sharing; wherein, the lightweight partial homomorphic encryption uses an additive homomorphic algorithm, which combines a finite field generator with plaintext data and a random factor for encryption; the full homomorphic encryption uses an algorithm that supports ciphertext addition and multiplication operations.

[0014] Preferably, in step S4, the security key negotiation employs an improved end-to-end key exchange method, including: S41: The edge device generates a random private key and calculates the public key, then sends it to the cloud; S42: The cloud generates a random private key and calculates the public key, sends it to the edge device, and returns a receipt confirmation flag at the same time; S43: The edge device only calculates the shared key by combining the cloud public key and its own private key after receiving a valid confirmation identifier; S44: Cloud synchronization combines the edge public key with its own private key to calculate a shared key.

[0015] Preferably, in step S4, the fusion verification includes: when the edge sends the encrypted calculation result to the cloud, the calculation result is collected and aggregated at the edge and sent through a secure key negotiation mechanism; when the cloud sends the result to the edge, the encrypted text is forwarded through secure key negotiation; the fusion verification calculates the hash value of the decrypted fused data and compares it with the hash values ​​of the calculation results at the edge and the cloud, and determines the result is valid when the hash values ​​are consistent.

[0016] This invention also discloses a streaming data privacy protection device based on dense-state computation, comprising: The model building module is used to build a streaming data sensitivity determination model, which divides the real-time incoming data into high-sensitivity, medium-sensitivity, and low-sensitivity fragments. The computation allocation module is used to allocate high-sensitivity shards to edge nodes for dense computation, medium-sensitivity shards to edge-cloud collaborative dense computation, and low-sensitivity shards to the cloud for dense computation. The dynamic adjustment module is used to dynamically adjust the granularity of the shards and the partitioning ratio of the computational tasks based on the window sliding period of the streaming data. The fusion verification module is used to establish a secure channel between the edge and the cloud through a secure key negotiation mechanism, realize the fusion verification of the encrypted computation results, and output the final processing result.

[0017] Preferably, the calculation and allocation module includes: Edge computing units are configured as a subset of basic time-series statistical computing, containing basic statistical operators with low computing power overhead. The cloud computing unit is configured as a full-scale time series statistics computing subset, including all time series statistics and feature extraction operators; The collaborative computing unit is configured as a set of collaborative operators, covering all operators not deployed at the edge. The operators include any one of the following: window count, average, weighted average, weighted median, maximum, minimum, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features.

[0018] Preferably, the dynamic adjustment module includes: dynamically adjusting the category assignment of data segments based on the relationship between the sensitivity score of the data within the sliding time window and a preset threshold; if the sensitivity score is higher than the high sensitivity threshold, the data is assigned to a high sensitivity segment; if the score is between the high sensitivity threshold and the medium sensitivity threshold, the data is assigned to a medium sensitivity segment; if the score is lower than the medium sensitivity threshold, the data is assigned to a low sensitivity segment. This invention offers the following advantages: By segmenting raw data according to its sensitivity, and employing techniques such as dense-state computation, fully homomorphic computation, and partial homomorphic encryption, the correctness of the dense-state computation results is ensured, thereby protecting data privacy in streaming data computation while guaranteeing the accuracy of the computation. This solution is suitable for large-scale data computation, effectively protecting the privacy of the raw data while ensuring the accuracy of the computation. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the steps of a streaming data privacy protection method based on dense state computation according to the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly described below in conjunction with the examples.

[0021] Example 1 like Figure 1 As shown, this invention proposes a method and apparatus for protecting streaming data privacy based on dense-state computation, comprising the following steps: (1) Construct a streaming data sensitivity determination model and divide the real-time incoming data into high-sensitivity fragments, medium-sensitivity fragments and low-sensitivity fragments; (2) Assign high-sensitivity fragments to edge nodes to perform light dense-state computation, medium-sensitivity fragments to edge-cloud collaborative computation to perform hybrid dense-state computation, and low-sensitivity fragments to cloud to perform full dense-state computation; (3) Dynamically adjust the granularity of the partitions and the partitioning ratio of the computational tasks according to the window sliding period of the streaming data; (4) Establish a secure channel between the edge and the cloud through a secure key negotiation mechanism to realize the fusion verification of the encrypted calculation results and output the final processing results.

[0022] Furthermore, in step (1), the data stream is monitored in real time. When the monitored data volume reaches a threshold, the monitored data is divided into... There are several time windows, each of which represents one time period. Size, of which This indicates a floor operation, and the time window is periodic. Based on the data sensitivity within the time window, the data within the time window is divided into three granularities: low-sensitivity granules, medium-sensitivity granules, and high-sensitivity granules. The time granularity of low-sensitivity granules is the largest, followed by medium-sensitivity granules, and then high-sensitivity granules. Specifically: a) Low-sensitivity sharding: All time points within the data within the time window are processed according to the smallest time granularity. Divide into parts that satisfy the formula ; b) Medium-sensitivity sharding: All time points within the data window are processed according to the smallest time granularity. Divide into parts that satisfy the formula ; c) High-sensitivity sharding: All time points within the data within a time window are processed according to the smallest possible time granularity. Divide into parts that satisfy the formula .

[0023] Furthermore, in step (2), the edge computing tasks include window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; the cloud computing tasks include window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; the computing tasks to be deployed at the edge are a subset of basic time series statistics computing. Cloud computing tasks are a subset of full-scale time-series system computing. The task of edge-cloud collaborative computing is a set of operators. In other words, collaborative computing tasks cover all operators not deployed at the edge, providing a finer granularity of operator splitting than tasks computed solely by the cloud.

[0024] Furthermore, step (3) specifically includes: 3a) High-sensitivity segmentation: the smallest time granularity is denoted as When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point. The update formula for the sliding window is: ;if Data within the window prior to the current time stamp was not fully calculated, and the data sensitivity score was not met. If so, it will be classified into the high-sensitivity segment; when When, it is divided into medium sensitivity segments; when When this happens, it is classified as a low-sensitivity segment; 3b) Medium-sensitivity sharding: When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point, and the update is based on the sliding window formula. Complete the window sliding; if Data within the window prior to the current time stamp has not been fully calculated, and the data sensitivity score meets the requirements. If it is, then it is classified into the medium sensitivity segment; when When, it is divided into high-sensitivity partitions; when When that happens, it is divided into low-sensitivity segments; 3c) Low-sensitivity sharding: When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point, and the update is based on the sliding window formula. Complete the window sliding; if All data within the window prior to the current time stamp has been fully calculated, and data sensitivity scores have been obtained. If so, it is divided into low-sensitivity fragments; when When, it is divided into medium sensitivity segments; when At that time, it was divided into high-sensitivity segments.

[0025] Furthermore, the lightweight encrypted computation includes lightweight partial homomorphic encryption and lightweight secret sharing; the hybrid encrypted computation includes full partial homomorphic encryption, lightweight secret sharing, and full secret sharing, wherein the full encrypted computation refers to full homomorphic encryption and full secret sharing.

[0026] The lightweight homomorphic encryption uses an optimized Paillier additive homomorphic algorithm, with the core encryption formula being: Fully homomorphic encryption uses the BFV fully homomorphic encryption algorithm, supporting fully homomorphic addition and multiplication operations on ciphertext. The core ciphertext operation formula is: , .

[0027] Furthermore, step (4) specifically involves: 4a) When it is necessary to send some homomorphic encryption results from the edge to the cloud, several calculation results are collected and aggregated at the edge. The lightweight encryption agent at the edge sends the aggregated results to the cloud through end-to-end communication using a secure key negotiation mechanism. After receiving the secret sharing results, the cloud uses the same secret sharing parameters to decrypt and obtain the plaintext of the aggregated data. When it is necessary to send the full amount of encrypted calculation results from the cloud to the edge, the encryption agent uses secure key negotiation to forward the aggregated ciphertext to the lightweight algorithm agent at the edge. The lightweight algorithm agent receives the aggregated ciphertext and uses the corresponding algorithm to decrypt and obtain the plaintext. 4b) When the encrypted computation results of hybrid computation need to be sent from the edge to the cloud, the lightweight encryption agent collects some of the encrypted computation results using an aggregation operation and sends them to the end-to-end encryption agent in the cloud. After receiving all the computation results, the end-to-end encryption agent sends them to the cloud using a secure secret sharing mechanism. After receiving the secret sharing results, the cloud uses the same secret sharing parameters to decrypt and obtain the plaintext of the aggregated data. When the full encrypted computation results from the cloud need to be sent to the edge, the encryption agent uses secure key negotiation to forward the aggregated ciphertext to the lightweight algorithm agent on the edge. The lightweight algorithm agent receives the aggregated ciphertext and uses the corresponding algorithm to decrypt and obtain the plaintext.

[0028] In step (4), a new logic for fusion and verification of dense state calculation results is added, and the core verification formula is: The result is valid and the final processing result is output only if the equation is true.

[0029] Furthermore, the security key negotiation adopts a Diffie-Hellman-based key exchange method, specifically an improved end-to-end key exchange method. The core negotiation process formula is as follows: 1) Generate random private keys at the edge Calculate the public key Send to the cloud; 2) Generate random private keys in the cloud Calculate the public key Send to the edge device and simultaneously return a receipt confirmation flag. ; 3) The edge end only receives a valid response. Then, calculate the shared key. ; 4) Cloud-based synchronous calculation of shared keys .

[0030] To achieve the above objectives, the present invention may also employ the following technical solutions: A streaming data privacy protection device based on dense-state computation includes: Model building module: Constructs a streaming data sensitivity determination model, which divides the real-time incoming data into high-sensitivity fragments, medium-sensitivity fragments, and low-sensitivity fragments; The computation allocation module allocates high-sensitivity fragments to edge nodes for dense computation, medium-sensitivity fragments to edge-cloud collaborative dense computation, and low-sensitivity fragments to the cloud for dense computation. Dynamic adjustment module: Dynamically adjusts the granularity of the partitions and the partitioning ratio of the computation tasks based on the window sliding period of the streaming data; Fusion Verification Module: Establishes a secure channel between the edge and the cloud through a secure key negotiation mechanism, realizes fusion verification of the encrypted computation results, and outputs the final processing result.

[0031] Furthermore, the computation allocation module specifically comprises: edge computing tasks including window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; cloud computing tasks including window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; and the computing tasks to be deployed at the edge are a subset of basic time series statistics computations. Cloud computing tasks are a subset of full-scale time-series system computing. The task of edge-cloud collaborative computing is a set of operators. In other words, collaborative computing tasks cover all operators not deployed at the edge, providing a finer granularity of operator splitting than tasks computed solely by the cloud.

[0032] Furthermore, the dynamic adjustment module specifically comprises: High-sensitivity partitioning: The smallest time granularity is denoted as When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point. The update formula for the sliding window is: ;if Data within the window prior to the current time stamp was not fully calculated, and the data sensitivity score was not met. If so, it will be classified into the high-sensitivity segment; when When, it is divided into medium sensitivity segments; when When this happens, it is classified as a low-sensitivity segment; Medium-sensitivity sharding: When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point, and the update formula is based on the sliding window. Complete the window sliding; if Data within the window prior to the current time stamp has not been fully calculated, and the data sensitivity score meets the requirements. If it is, then it is classified into the medium sensitivity segment; when When, it is divided into high-sensitivity partitions; when When that happens, it is divided into low-sensitivity segments; Low-sensitivity sharding: When new data is detected, all data within the sliding time window is re-divided according to the smallest granularity, with each timestamp as a data point, and the update formula is based on the sliding window. Complete the window sliding; if All data within the window prior to the current time stamp has been fully calculated, and data sensitivity scores have been obtained. If so, it is divided into low-sensitivity fragments; when When, it is divided into medium sensitivity segments; when At that time, it was divided into high-sensitivity segments.

[0033] Furthermore, the fusion verification module specifically works as follows: when it is necessary to send some homomorphic encryption results from the edge to the cloud, several calculation results are collected and aggregated at the edge. The lightweight encryption proxy at the edge sends the aggregated results to the cloud through end-to-end communication using a secure key negotiation mechanism. After receiving the secret sharing result, the cloud uses the same secret sharing parameters to decrypt and obtain the plaintext of the aggregated data. When it is necessary to send the full encrypted computation results from the cloud to the edge side, the encryption agent uses a security key negotiation to forward the aggregated ciphertext to the lightweight algorithm agent on the edge side. The lightweight algorithm agent receives the aggregated ciphertext and uses the corresponding algorithm to decrypt it to obtain the plaintext. When it is necessary to send the encrypted computation results of hybrid computing from the edge to the cloud, the lightweight encryption agent collects some of the encrypted computation results using an aggregation operation and sends them to the end-to-end encryption agent in the cloud. After receiving all the computation results, the end-to-end encryption agent sends them to the cloud using a secure secret sharing mechanism. After receiving the secret sharing results, the cloud uses the same secret sharing parameters to decrypt and obtain the plaintext of the aggregated data. When it is necessary to send the full encrypted computation results from the cloud to the edge, the encryption agent uses a secure key negotiation to forward the aggregated ciphertext to the lightweight algorithm agent on the edge. The lightweight algorithm agent receives the aggregated ciphertext and uses the corresponding algorithm to decrypt it to obtain the plaintext.

[0034] The fusion verification module has built-in logic for verifying the consistency of dense-state calculation results. The core verification formula is: The result is valid and the final processing result is output only if the equation is true.

[0035] Compared with the prior art, the method and apparatus of the present invention have the following beneficial effects: The present invention adopts a multi-granularity fragmentation privacy protection mechanism, which provides fine-grained protection for the differences in real-time data. At the same time, by dynamically adjusting the fragmentation size and the division of computation tasks, it can improve the efficiency of dense-state computation without affecting the availability of data.

[0036] Example 2 The present invention provides a data privacy protection scheme based on dense state computing, which involves a computing framework consisting of edge nodes and the cloud.

[0037] The edge nodes consist of sensor nodes and edge computing service nodes, which communicate wirelessly; the cloud includes edge computing service nodes and data receiving center nodes, which communicate via wired network.

[0038] The interaction process of the entire system specifically includes the following steps: Step 1: The edge computing node initializes the state required for computing. The initialization methods include computing task sharding granularity, computing execution end, computing task execution method, task partitioning method, task parameters, etc. Step 2: After initialization, the sensor end node begins data acquisition and transmits the data wirelessly to the node side according to the parameters configured in Step 1. Step 3: The edge computing node performs the corresponding calculations based on the data received in Step 2, packages the calculated results using edge encryption, and transmits them to the cloud computing node. Step 4: After receiving the edge encrypted data, the cloud computing node unpacks the data according to the parameters configured in Step 1, performs cloud computing on the unpacked data, packages the calculated results using cloud encryption, and finally transmits them to the data receiving center node. Step 5: The data center end node uses the data center security algorithm library or related algorithm library interface to perform calculations on the data calculation result packet, and sends the final calculation result to the result receiving end.

[0039] Based on the above system architecture, this invention proposes a privacy protection scheme, which mainly includes two aspects for privacy protection: one is the division of computational task granularity, and the other is the dense state scheme based on computational task.

[0040] The specific process of node-side encrypted task partitioning and key negotiation protocol: (1) Node-side dense-state task partitioning process: The process of allocating different dense-state computation tasks to nodes, which is based on two computation methods: 1) Edge-side secure computing: Edge-side computing tasks include window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; cloud-side computing tasks include window counting, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features; the computing tasks to be deployed at the edge are a subset of basic time series statistical computing. Cloud computing tasks are a subset of full-scale time-series system computing. The task of edge-cloud collaborative computing is a set of operators. In other words, collaborative computing tasks cover all operators not deployed at the edge, and have a finer granularity of operator splitting than tasks computed solely by the cloud. 2) Encrypted computation: Based on streaming data computation, when data is detected to be entering, the data contained in the time window is segmented for computation. During segmented computation, each timestamp is treated as a data point. Data points are segmented according to the computation granularity. Encrypted computation is used in the segmented computation process. Encrypted computation includes lightweight partial homomorphic encryption, lightweight secret sharing, and full secret sharing. Full homomorphic encryption and full secret sharing directly perform encrypted computation on the encrypted data. Lightweight partial homomorphic encryption, lightweight secret sharing, and full partial homomorphic encryption and lightweight secret sharing first segment the data, with each segment containing only a portion of the encrypted data, and then perform computation and data forwarding. (2) Key negotiation protocol process: The key negotiation protocol is an improvement on the Diffie-Hellman key negotiation protocol. The original Diffie-Hellman key negotiation protocol cannot realize the data verification function in data transmission. When the data receiving end does not receive data, the data transmission will be invalid.

[0041] Therefore, this invention adopts an improved key negotiation protocol based on Diffie-Hellman to realize data transmission and data verification functions. When the cloud does not receive data, the sending end will not continue to send data. At the same time, encryption and decryption are performed based on the shared key generated by negotiation, without the need to directly transmit the private key and key parameters, thus ensuring the correctness of the encrypted calculation.

[0042] The above node-side dense state calculation partitioning process re-divides all data within the sliding time window, treating each timestamp as a data point, and then divides the data points according to the smallest granularity. It is divided into low-sensitivity partitions, medium-sensitivity partitions, and high-sensitivity partitions; Specifically: Step 1: Denote the smallest granularity as When data is detected entering, it is processed according to the smallest granularity. All data within the sliding time window are re-divided, with each timestamp serving as a data point; If the data in the window before the timestamp has not yet been calculated, the calculation task will be assigned to a shard, which will be called shard one. Step 2: If the window data before the timestamp has been calculated, then divide this data into a shard, and denote it as shard two.

[0043] Step 3: If the data within the window before the timestamp has already been calculated, then the calculation task is assigned to the low-sensitivity shard, denoted as shard three.

[0044] Step 4: Divide the data into shards according to different shards. Shard 1 is used for full dense computation executed in the cloud, shard 2 is used for hybrid dense computation in edge-cloud collaboration, and shard 3 is used for lightweight dense computation at the edge.

[0045] The data fragmentation privacy protection process is as follows: Step 1: The encrypted computation of fragment 1 includes fully homomorphic encryption and fully homomorphic computation. That is, after calculating the fragment data, fully homomorphic computation is directly performed on the calculated ciphertext to obtain the result ciphertext.

[0046] Step 2: The encrypted computation of shard two includes partial homomorphic encryption and full partial homomorphic computation. The partial ciphertext after partial computation in shard one is directly used to obtain the ciphertext of the sharded data result using full homomorphic computation.

[0047] Step 3: The cryptographic computation of shard 3 includes lightweight homomorphic encryption and lightweight secret sharing computation. The ciphertext of the computation results of shard 1 is aggregated and then used for cryptographic computation.

[0048] The above technology enables dynamic transmission of computational data. The specific process of dynamic transmission is as follows: Step 1: The node sends computation data to the cloud, and the cloud returns a successful reception message; Step 2: The cloud sends the computation data to the node, and the node returns the computation result.

[0049] The specific dense-state computation process at the node and cloud ends is as follows: Step 1: The edge-side lightweight encryption agent encrypts some data results using an end-to-end encryption agent and sends them to the cloud-based encrypted computing agent via end-to-end communication; Step 2: Send the encrypted result to the cloud-based cryptographic computing agent. After the cloud-based cryptographic computing agent decrypts the ciphertext, it distributes the partial summed and fragmented data through the client-side computing agent, performs mixed cryptographic computing through the server-side computing agent, and sends the result back to the cloud-based cryptographic computing agent for decryption before sending it to the node. Step 3: The node is lightweighted by a lightweight encryption protocol proxy and transmitted in plaintext by an end-to-end encryption protocol proxy.

[0050] The applicant of this invention has provided a detailed description of the embodiments of the invention in conjunction with the accompanying drawings. However, those skilled in the art should understand that the above embodiments are merely preferred embodiments of the invention. The detailed description is only intended to help readers better understand the spirit of the invention and is not intended to limit the scope of protection of the invention. On the contrary, any improvements or modifications made based on the inventive spirit of the invention should fall within the scope of protection of the invention.

[0051] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for protecting the privacy of streaming data based on dense-state computation, characterized in that, Includes the following steps: S1: Construct a streaming data sensitivity determination model, and divide the real-time incoming data into high-sensitivity fragments, medium-sensitivity fragments, and low-sensitivity fragments according to the time dimension of the data and the relationship between the data subject and the object. S2: Allocate high-sensitivity fragments to edge nodes to perform light dense-state computation, medium-sensitivity fragments to edge-cloud collaborative computation to perform hybrid dense-state computation, and low-sensitivity fragments to the cloud to perform full dense-state computation; S3: Dynamically adjust the granularity of the partitions and the partitioning ratio of the computational tasks based on the window sliding period of the streaming data; S4: Establish a secure channel between the edge and the cloud through a secure key negotiation mechanism to achieve fusion verification of the encrypted computation results and output the final processing result.

2. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, In step S1, the data stream is monitored in real time. When the amount of monitored data reaches a threshold, the monitored data is divided into several periodic time windows. Based on the data sensitivity within the time window, the data within the time window is divided into three granularities: the low-sensitivity granularity is the largest, the medium-sensitivity granularity is the second largest, and the high-sensitivity granularity is the smallest. The time granularity is determined by the product of a preset time period length and a granularity coefficient, wherein the granularity coefficient is negatively correlated with the granularity sensitivity.

3. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, In S2, the computing tasks deployed at the edge are a subset of basic time-series system computing, the computing tasks deployed in the cloud are a subset of full time-series system computing, and the tasks of edge-cloud collaborative computing are a set of collaborative operators. The set of collaborative operators is the difference between the subset of full time-series system computing and the subset of basic time-series system computing. The set of operators includes any one of the following: window count, average value, weighted average value, weighted median, maximum value, minimum value, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features.

4. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, In step S3, the dynamic adjustment is triggered by monitoring new data entering the sliding time window, and the adjustment is performed in segments based on the relationship between the data sensitivity score and a preset threshold. If the data in the window before the current timestamp has not been fully calculated and the sensitivity score is higher than the high sensitivity threshold, it is classified as a high sensitivity segment. If the sensitivity score is between the high sensitivity threshold and the medium sensitivity threshold, it is divided into medium sensitivity segments; If the sensitivity score is lower than the medium sensitivity threshold, it is classified as a low sensitivity segment.

5. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, The lightweight encrypted computation in S2 includes lightweight partial homomorphic encryption and lightweight secret sharing; the hybrid encrypted computation includes full partial homomorphic encryption, lightweight secret sharing, and full secret sharing; the full encrypted computation includes full homomorphic encryption and full secret sharing; wherein, the lightweight partial homomorphic encryption adopts an additive homomorphic algorithm, which combines a finite field generator with plaintext data and a random factor for encryption; the full homomorphic encryption adopts an algorithm that supports ciphertext addition and multiplication operations.

6. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, In step S4, the security key negotiation employs an improved end-to-end key exchange method, including: S41: The edge device generates a random private key and calculates the public key, then sends it to the cloud; S42: The cloud generates a random private key and calculates the public key, sends it to the edge device, and returns a receipt confirmation flag at the same time; S43: The edge device only calculates the shared key by combining the cloud public key and its own private key after receiving a valid confirmation identifier; S44: Cloud synchronization combines the edge public key with its own private key to calculate a shared key.

7. The method for protecting streaming data privacy based on dense-state computation according to claim 1, characterized in that, In step S4, the fusion verification includes: when the edge sends the encrypted calculation result to the cloud, the calculation result is collected and aggregated at the edge and sent through a secure key negotiation mechanism; when the cloud sends the result to the edge, the encrypted text is forwarded through secure key negotiation; the fusion verification calculates the hash value of the decrypted fused data and compares it with the hash values ​​of the calculation results at the edge and the cloud, and the result is determined to be valid when the hash values ​​are consistent.

8. A streaming data privacy protection device based on dense-state computation, characterized in that, include: The model building module is used to build a streaming data sensitivity determination model, which divides the real-time incoming data into high-sensitivity, medium-sensitivity, and low-sensitivity fragments. The computation allocation module is used to allocate high-sensitivity shards to edge nodes for dense computation, medium-sensitivity shards to edge-cloud collaborative dense computation, and low-sensitivity shards to the cloud for dense computation. The dynamic adjustment module is used to dynamically adjust the granularity of the shards and the partitioning ratio of the computational tasks based on the window sliding period of the streaming data. The fusion verification module is used to establish a secure channel between the edge and the cloud through a secure key negotiation mechanism, realize the fusion verification of the encrypted computation results, and output the final processing result.

9. A streaming data privacy protection device based on dense-state computation according to claim 8, characterized in that, The calculation and allocation module includes: Edge computing units are configured as a subset of basic time-series statistical computing, containing basic statistical operators with low computing power overhead. The cloud computing unit is configured as a full-scale time series statistics computing subset, including all time series statistics and feature extraction operators; The collaborative computing unit is configured as a set of collaborative operators, covering all operators not deployed at the edge. The operators include any one of the following: window count, average, weighted average, weighted median, maximum, minimum, median, standard deviation, variance, median deviation, energy, time series, entropy, probability density, and wavelet features.

10. A streaming data privacy protection device based on dense-state computation according to claim 8, characterized in that, The dynamic adjustment module includes: dynamically adjusting the category classification of data segments based on the relationship between the sensitivity score of the data within the sliding time window and a preset threshold; if the sensitivity score is higher than the high sensitivity threshold, it is classified into a high sensitivity segment; if the score is between the high sensitivity threshold and the medium sensitivity threshold, it is classified into a medium sensitivity segment; if the score is lower than the medium sensitivity threshold, it is classified into a low sensitivity segment.

Images