A privacy protection aggregation statistical analysis method for cloud-oriented encrypted data

Abstract

The application discloses a privacy protection aggregation statistical analysis method for cloud encryption data, and belongs to the cross technical field of cryptography and cloud computing security. In the system initialization stage, the method generates a homomorphic encryption key and sorts the terminals according to a logical ring and groups them according to the square root order. Each terminal forms a three-channel encoding vector from the original data, applies ring zero-sum pseudo-random masking based on left and right neighbor shared seeds and independently sampled zero-mean Gaussian noise samples, and then encrypts the terminal ciphertext by uploading the homomorphic encryption public key to the fog node. The fog node aggregates the terminal ciphertext in the group, and the cloud server aggregates the global aggregation ciphertext across groups. The application significantly reduces the communication and operation overheads while ensuring the strength of differential privacy, supports single-ciphertext multi-moment joint query, decouples the differential privacy sensitivity from the original data range, and can resist the collusion threats of the cloud and the key holder and part of the terminals, and has wide application scenarios.

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of cryptography and cloud computing security, and specifically relates to a privacy protection aggregation statistical analysis method for encrypted data in the cloud. Background Technology

[0002] With the rapid development of cloud computing, the Internet of Things, and big data technologies, an increasing number of terminal devices, including wearable devices, smart meters, and industrial sensors, are continuously generating massive amounts of data and outsourcing this data to the cloud for aggregation and statistical analysis. Upon receiving this data, the cloud must perform aggregation calculations to recover key statistical quantities such as mean, variance, and standard deviation for various business applications. However, raw data often carries sensitive user information, and uploading raw data directly to the cloud in plaintext poses a serious risk of privacy breaches. Therefore, privacy-preserving aggregation and statistical analysis methods for encrypted data in the cloud have become a key research focus at the intersection of cloud computing security and cryptography.

[0003] To address these needs, researchers both domestically and internationally have proposed several mainstream technical approaches. Homomorphic encryption-based aggregation schemes, represented by Paillier additive homomorphic encryption, BFV integer homomorphic encryption, and CKKS approximate homomorphic encryption, utilize algebraic isomorphisms in the ciphertext field to enable the cloud to directly perform aggregation operations in the ciphertext space, with the final result decrypted by the key holder. Differential privacy-based aggregation schemes provide provable privacy protection for statistical query results by superimposing carefully calibrated random noise onto the query results or original data. These schemes are mainly categorized into centralized differential privacy mechanisms, localized differential privacy mechanisms, and distributed differential privacy mechanisms. Secure aggregation schemes utilize paired masks or secret sharing to achieve ciphertext aggregation without relying on homomorphic encryption. Schemes based on a layered collaborative architecture of edge, fog, and cloud perform local aggregation first at fog nodes or edge nodes closer to the terminal to reduce the computational burden on the cloud.

[0004] However, the existing solutions still have several fundamental technical problems when facing the need for joint analysis of multiple statistics in actual deployments. Most existing aggregation schemes based on homomorphic encryption only support first-order moment queries such as mean, while second-order moment queries such as variance and standard deviation require encrypting and uploading two independent ciphertexts, one for the original data and the other for its squared value. This results in a multiple increase in uplink communication overhead per terminal, homomorphic computation overhead in the cloud, and overall processing latency. When the dynamic range of the original data is large, the dynamic range of the homomorphic encryption fixed-point or floating-point encoding used in existing schemes will significantly expand, crowding out the limited precision bit width budget of the homomorphic encryption scheme, causing the estimation accuracy to degrade as the data range increases. Existing aggregation schemes based on homomorphic encryption have significant security vulnerabilities under a threat model of collusion between the cloud server and the key holder. Attackers can recover the original plaintext data of any single terminal by submitting a single terminal's ciphertext request for decryption. Existing differential privacy schemes inject noise amplitude that is strongly coupled with the dynamic range of the original data. In scenarios with large amounts of original data, the noise standard deviation increases significantly with the data range, severely worsening the trade-off between privacy and availability, and degrading statistical accuracy to an unacceptable level for business applications. Existing differential privacy schemes often employ a uniform privacy budget allocation strategy that does not differentiate between mean-based and variance-based queries, making it difficult to independently adjust the budget based on the query initiator's different priorities for mean and variance accuracy. Most existing edge, fog, and cloud layered aggregation schemes are designed solely to reduce communication overhead, failing to fully utilize the layered architecture's control over ciphertext noise accumulation. In scenarios with extremely large terminal scales, ciphertext noise will continue to accumulate along a single-level aggregation path until it reaches the noise budget limit of homomorphic encryption, leading to decryption failure. Existing schemes generally lack fault-tolerant recovery paths that deeply coordinate with zero-sum masks or secret-sharing mechanisms in scenarios where some terminals dynamically disconnect, making it difficult to maintain the correctness of aggregation results and leading to systematic biases in statistical estimation.

[0005] Given the numerous problems with the existing technologies, there is an urgent need for a privacy-preserving aggregate statistical analysis method for cloud-encrypted data that can efficiently support joint computation of multi-order moments in a single ciphertext, provide privacy and availability guarantees independent of data range, resist collusion attacks between the cloud and the key holder, and deeply collaborate with a hierarchical aggregation architecture while supporting dynamic fault tolerance at the terminal. Summary of the Invention

[0006] To address the problems existing in the background technology, this invention provides a privacy-preserving aggregated statistical analysis method for encrypted data in the cloud, applicable to a three-layer system of edge, fog, and cloud, including multiple terminal devices, multiple fog nodes, cloud servers, a key management center, and a query initiator. The method includes the following steps: S1: System initialization; The key management center generates a homomorphic encryption public key and a homomorphic encryption private key and distributes the homomorphic encryption public key; The cloud server arranges all the terminal devices into a logical ring and organizes adjacent terminal devices to negotiate and share a seed; The cloud server divides all the terminal devices into multiple terminal groups and assigns a fog node as a group aggregation node for each terminal group; S2: Three-channel joint encoding; Each terminal device performs normalization transformation and squaring operation on the raw data it collects, and uses the normalized value, the normalized squared value and a constant as the first channel value, the second channel value and the third channel value respectively to form a three-channel encoding vector; S3: Circular zero-sum mask application; Each terminal device, based on its shared seed with its left neighbor terminal device and its shared seed with its right neighbor terminal device, applies a pseudo-random mask to the first channel value and the second channel value of the three-channel encoding vector using a pseudo-random number generator, such that the sum of the pseudo-random masks of all terminal devices in the same channel is zero, thus obtaining a masked encoding vector; S4: Distributed differential privacy noise injection; Each terminal device independently samples a zero-mean Gaussian noise sample from the first channel value and the second channel value of the masked encoding vector and superimposes them onto the corresponding channel, so that the aggregated distribution of the zero-mean Gaussian noise samples injected by all terminal devices in the same channel satisfies the requirements of the centered differential privacy Gaussian mechanism, thus obtaining the noise-added encoding vector; S5: Layered aggregation of edge, fog, and cloud layers; each terminal device uses the homomorphic encryption public key to call a homomorphic encryption algorithm supporting ciphertext addition on the noise-added coding vector to obtain terminal ciphertext and upload it to its respective fog node; the fog node performs homomorphic addition on all terminal ciphertexts within its terminal group to obtain group aggregated ciphertext and uploads it to the cloud server; the cloud server performs homomorphic addition on all group aggregated ciphertexts to obtain global aggregated ciphertext and sends it to the key management center; S6: Decryption and Statistical Recovery; The key management center uses the homomorphic encryption private key to call the homomorphic decryption algorithm corresponding to the homomorphic encryption algorithm on the global aggregated ciphertext, extracts the normalized value summation term, the normalized square value summation term, and the terminal count term from the decryption result, calculates the mean estimate, variance estimate, and standard deviation estimate of the original data based on the moment statistics recovery relationship and inverse normalization transformation, and returns the obtained estimates to the query initiator.

[0007] Furthermore, step S1 specifically includes: S11: The key management center runs a homomorphic encryption key generation algorithm according to preset security level parameters to generate the homomorphic encryption public key and the homomorphic encryption private key; the key management center distributes the homomorphic encryption public key to all terminal devices, all fog nodes, and the cloud server through an authenticated communication channel; the homomorphic encryption private key is stored locally by the key management center. S12: The key management center publishes to all terminal devices the global lower bound a of the original data for this aggregation task, the global upper bound b of the original data, and the differential privacy budget. Sum of differential privacy violation probability Where a is the global lower bound of the original data; b is the global upper bound of the original data; Total budget for differential privacy; The probability of differential privacy violation is defined as follows: the global lower bound 'a' and the global upper bound 'b' of the original data are predetermined based on the business scenario to which the aggregation task belongs. S13: The cloud server sorts all N terminal devices according to the lexicographical order of their identifiers and forms the logical ring, such that the preceding terminal device of each terminal device is its left neighbor, and the following terminal device is its right neighbor. The left neighbor of the first terminal device is the Nth terminal device, and the right neighbor of the Nth terminal device is the first terminal device; where N is the total number of terminal devices. S14: Each pair of adjacent terminal devices negotiates a shared seed through a certified Diffie-Hellman key exchange protocol, and each terminal device locally stores the shared seed with its left neighbor terminal device and the shared seed with its right neighbor terminal device; S15: The cloud server divides all N terminal devices into M terminal groups, where M is the total number of terminal groups and M is equal to the square root of N rounded up; the cloud server assigns a fog node as a group aggregation node for each terminal group and broadcasts the terminal group number to which each terminal device belongs and the communication address of the corresponding fog node to all terminal devices and all fog nodes.

[0008] Furthermore, step S2 specifically includes: S21: Terminal device i collects raw data in the current aggregation round t. Where i is the terminal device number, ranging from 1 to N; t is the current aggregation round number; The raw data collected by terminal device i in the current aggregation round t; S22: Terminal device i processes the raw data according to the following formula. Perform a normalization transformation to obtain the normalized value. : ; In the formula, The normalized value for terminal device i; The raw data for terminal device i; The normalization center is denoted by , and its value is equal to the sum of the original data's global lower bound *a* and the original data's global upper bound *b* divided by 2; *r* is the normalization radius, and its value is equal to the difference between the original data's global upper bound *b* and the original data's global lower bound *a* divided by 2; - is the subtraction operator; / is the division operator. The obtained normalized value It falls within the closed interval [-1,1]; S23: Terminal device i returns the normalized value Performing a squaring operation yields a normalized square value; the normalized square value is... The square of, denoted as The normalized squared value It falls within the closed interval [0,1]; S24: Terminal device i will normalize the value The normalized squared value is used as the first channel value. Using the value 1 as the second channel value and 1 as the third channel value, the three-channel encoding vector of terminal device i is formed. ; The three-channel encoding vector of terminal device i.

[0009] Furthermore, step S3 specifically includes: S31: For channel number k, terminal device i uses the shared seed with its right neighboring terminal device as the key of the pseudo-random number generator, and uses the concatenated byte string of the current aggregation round number t and channel number k as the input of the pseudo-random number generator, and calls the pseudo-random number generator to obtain a positive pseudo-random number. Where k is the channel number, which can be 1 or 2; The positive pseudo-random number for terminal device i in the k-th channel; S32: For the same channel number k, terminal device i uses the shared seed with its left neighboring terminal device as the key of the pseudo-random number generator, and the concatenated byte string of the current aggregation round number t and channel number k as the input of the pseudo-random number generator, and calls the pseudo-random number generator to obtain a reverse pseudo-random number. ; The reverse pseudo-random number for terminal device i in the k-th channel; S33: Terminal device i calculates the pseudo-random mask for the k-th channel using the following formula. : ; In the formula, Let i be the pseudo-random mask for the k-th channel of terminal device i; Let i be a positive pseudo-random number in the k-th channel of terminal device i; `-` represents the inverse pseudo-random number generated by terminal device `i` on the `k`th channel; `-` represents the subtraction operator. S34: Terminal device i takes channel number k as 1 and 2 respectively, and repeats S31 to S33 to obtain the first channel pseudo-random mask. Second channel pseudo-random mask Terminal device i will use the pseudo-random mask of the first channel. Superimposed on the three-channel encoding vector The first channel value, and the pseudo-random mask of the second channel. Superimposed on the three-channel encoding vector The second channel value, the three-channel encoding vector The third channel value remains unchanged, constituting the masked encoding vector of terminal device i. ; The masked encoding vector for terminal device i; After step S3 is completed, due to the ring topology of the logic ring, the forward pseudo-random number and the reverse pseudo-random number corresponding to each shared seed appear exactly once with opposite signs in the sum of the pseudo-random masks of all the terminal devices, thus canceling each other out. Therefore, the sum of the pseudo-random masks of all N terminal devices in the same channel is always zero.

[0010] Furthermore, step S4 specifically includes: S41: Determine the masked encoding vector Global sensitivity of the first two channels: Global sensitivity of the first channel The value is 2, which is the global sensitivity of the second channel. The value is 1; where The first channel's global sensitivity; This is the global sensitivity of the second channel; and stated The value is determined by the normalized value. The normalized square value falls within the closed interval [-1, 1]. This is derived from the condition falling within the closed interval [0,1]. S42: Calculate the differential privacy total budget Allocated to two channels, the first channel receives the privacy budget. Second Channel Privacy Budget The With the The sum equals the total differential privacy budget. ; Budget for first-pass privacy; Budget for second-channel privacy; S43: Calculate the standard deviation of the total noise after aggregation of the k-th channel using the following formula. : ; In the formula, The standard deviation of the total noise after aggregation of the k-th channel; The global sensitivity of the k-th channel; Differential privacy violation probability; The privacy budget for channel k; k is the channel number, which can be 1 or 2; × is the multiplication operator; This is the square root operator; ` / ` is the logarithmic operator with the natural constant as its base; ` / ` is the division operator. S44: Terminal device i independently samples a sample with a mean of zero and a variance equal to the specified value in the k-th channel. The square of the Gaussian noise samples divided by the total number of terminal devices N ;in Here, Gaussian noise is the sampled by terminal device i in the k-th channel; N is the total number of terminal devices; terminal device i independently and repeatedly samples the channel number k by taking 1 and 2 respectively to obtain the Gaussian noise sample of the first channel. Second channel Gaussian noise sample ; S45: Terminal device i will send the first channel Gaussian noise sample Superimposed on the masked encoding vector The first channel value, and the second channel Gaussian noise sample Superimposed on the masked encoding vector The second channel value, the masked encoding vector The third channel value remains unchanged, constituting the noise-encoded vector of terminal device i. ; The noise-encoded vector for terminal device i; After step S4 is completed, since the sum of independent zero-mean Gaussian distributions is still a zero-mean Gaussian distribution, it can be seen that when all N terminal devices participate in the aggregation, the aggregated sum of the Gaussian noise samples of all the terminal devices in the k-th channel follows a distribution with a mean of zero and a variance equal to the mean of the Gaussian noise sample. The squared Gaussian distribution satisfies the parameter ( , The differential privacy Gaussian mechanism requires...

[0011] Furthermore, step S5 specifically includes: S51: Terminal device i uses the homomorphic encryption public key to add noise to the encoded vector. The homomorphic encryption algorithm is invoked to obtain the terminal ciphertext. ; The terminal ciphertext is the terminal ciphertext of terminal device i; terminal device i transmits the terminal ciphertext through a secure communication channel. Uploaded to its respective fog node; S52: After fog node j receives the terminal ciphertext uploaded by all terminal devices in its j-th terminal group, it sequentially performs the homomorphic addition operation on all the terminal ciphertexts in its j-th terminal group to obtain the j-th aggregated ciphertext. ; Let j be the aggregated ciphertext of the j-th group; j is the terminal group number, ranging from 1 to M; S53: Fog node j transmits the j-th group of aggregated ciphertext through the secure communication channel. Uploaded to the cloud server; S54: After receiving the group aggregated ciphertext uploaded by all M fog nodes, the cloud server performs the homomorphic addition operation on all M group aggregated ciphertexts in sequence to obtain the global aggregated ciphertext C; C is the global aggregated ciphertext; the cloud server sends the global aggregated ciphertext C to the key management center; After step S5 is completed, the total number of homomorphic addition operations performed by the fog node and the cloud server is approximately twice the square root of N, which keeps the ciphertext noise accumulation of the homomorphic encryption algorithm below the level of a single-level aggregation scheme.

[0012] Furthermore, step S6 specifically includes: S61: The key management center uses the homomorphic encryption private key to call the homomorphic decryption algorithm on the global aggregated ciphertext C to obtain a three-dimensional vector; the first component of the three-dimensional vector is used as the normalized summation term. The second component is used as a term in the summation of normalized squared values. The third component serves as the terminal counting term n; where The term is the summation of normalized values; is the normalized square summation term; n is the terminal count term, representing the actual number of terminal devices participating in this aggregation; S62: Calculate the estimated mean of the raw data using the following formula. : ; In the formula, This is an estimate of the mean of the original data; r is the normalization center; r is the normalization radius; `n` represents the normalized summation term; `n` represents the terminal count term; `+` is the addition operator; `×` is the multiplication operator; ` / ` is the division operator. S63: Calculate the variance estimate of the original data using the following formula. : ; In the formula, This is the estimate of the variance of the original data, i.e., the estimate of the standard deviation of the original data. The square of; The square of the normalized radius r; r is the normalized radius; The term is the summation of normalized squared values; n is the terminal count term. The term is the summation of normalized values; / n) 2 for The square of the quotient when divided by n; S64: Estimated variance of the original data Take the square root of the larger of the two values ​​and zero to obtain the estimated standard deviation of the original data. ; This is an estimate of the standard deviation of the original data; S65: The key management center estimates the mean value of the original data. The original data variance estimate The estimated standard deviation of the original data The terminal count item n is returned as an aggregated statistical result to the query initiator.

[0013] The beneficial effects achieved by this invention are as follows: This invention normalizes and squares the raw data collected by each terminal, using these transformations as the first and second channel values ​​respectively. A constant is then used as the third channel value, and the two values ​​are merged to form a single three-channel encoded vector. This vector is then encrypted and uploaded as a single ciphertext in subsequent steps, and aggregation is completed in the cloud using only homomorphic addition. Compared to conventional schemes that encrypt and upload first-order and second-order moment information separately, this invention significantly reduces the uplink communication volume per terminal per round and the total number of homomorphic addition operations in the cloud. This results in a significant improvement in overall communication and computational efficiency in large-scale terminal scenarios. Furthermore, because the normalization transformation limits the range of the encoded normalized value and the normalized squared value to a bounded closed interval centered at zero and a bounded closed interval with zero as the lower bound, respectively, the dynamic range of the encoding is completely decoupled from the absolute magnitude of the original data. This significantly reduces the precision loss of fixed-point or floating-point encoding in the homomorphic encryption scheme. In application scenarios with a large dynamic range of the original data, this avoids the precision degradation problem commonly seen in comparison schemes, ensuring the stability and accuracy of mean and variance estimation.

[0014] In step S3 of this invention, all terminals are constructed into a logical ring connected end-to-end according to device identifiers. Each terminal negotiates a shared seed with only its two adjacent terminals on the left and right. Based on this, the difference between the pseudo-random positive and negative numbers derived from the shared seeds of the left and right neighbors is applied as a mask to the first two channels of the encoded vector. In the ring topology, each shared seed appears exactly once with opposite signs in the summation of the pseudo-random masks of all terminals, thus completely canceling each other out. The sum of the pseudo-random masks of all terminals is always zero. Therefore, the statistics obtained after decryption of the aggregated ciphertext naturally eliminate the mask without affecting the accuracy. However, if the ciphertext of a single terminal is decrypted independently, its first two channels are still hidden by the pseudo-random mask. Even in the extreme threat model of collusion between the cloud server and the key management center, plus collusion among some terminals, as long as the two neighbors of the attacked target terminal do not all participate in the collusion, the original data of the non-colluding terminals is still protected against inference independently of the differential privacy layer. Furthermore, since each terminal only needs to store one shared seed locally and one shared seed with its two left and right neighbors, the key storage overhead of this invention is significantly reduced compared to the secure aggregation scheme under a fully connected topology, which facilitates key management and subsequent fault-tolerant expansion in large-scale terminal scenarios.

[0015] In step S4 of this invention, based on the bounded range obtained from the normalization in step S2, the global sensitivity of the first and second channels is directly determined as constants independent of the magnitude of the original data. Then, according to the fundamental combination theorem of differential privacy, the total privacy budget is allocated to each channel. Zero-mean Gaussian noise samples with variance scaling, independently sampled by each terminal, are then superimposed onto the masked encoding vector. Due to the property that the sum of independent and identically distributed zero-mean Gaussian random variables is still a zero-mean Gaussian distribution, the variance of the distribution obtained after aggregating the Gaussian noise samples independently sampled by all terminals in the same channel precisely satisfies the noise standard deviation requirement of the centralized Gaussian mechanism for the aggregation result. Therefore, this invention achieves privacy protection of equal strength to centralized differential privacy without introducing any trusted aggregator. The beneficial effect of this design is that the amplitude of the injected differential privacy noise is only related to the constant sensitivity of the normalization space and is completely decoupled from the dynamic range of the original data. In scenarios with a large dynamic range of the original data, compared with traditional localized differential privacy schemes, it significantly reduces the required injected noise amplitude and significantly improves the estimation accuracy of the mean and variance. Meanwhile, the adjustability of the privacy budget for each channel allows the protection strength of the mean estimation and variance estimation to be adjusted independently according to the needs of the query initiator. This also allows the Gaussian noise injected in this step to be superimposed with the pseudo-random mask in step S3, forming a dual protection layer of pseudo-random hiding and Gaussian perturbation when the single ciphertext is decrypted independently.

[0016] In step S5 of this invention, all terminals are divided into several terminal groups based on the square root of the total number of terminals. Each group's corresponding fog node first aggregates all terminal ciphertexts within its group to obtain the group-aggregated ciphertext. Then, the cloud server performs a second aggregation on all group-aggregated ciphertexts to obtain the globally aggregated ciphertext. The ciphertext noise in homomorphic encryption schemes accumulates linearly with the number of homomorphic additions. The two-level aggregation architecture designed in this invention significantly reduces the number of serial additions on a single ciphertext path compared to a single-level aggregation scheme, and significantly reduces the accumulated ciphertext noise. This invention can continue to use the standard homomorphic encryption parameter set in ultra-large-scale scenarios with significantly increased terminal scale without increasing the ciphertext parameter scale or frequently performing relinearization operations. After aggregation within a group, the fog node can also call modulus switching operations as needed based on the remaining modulus chain length of the ciphertext to release a layer of noise budget, further increasing the upper limit of the terminal scale that this invention can support. Building upon this foundation, the present invention further introduces a fault-tolerant extension step based on Shamir secret sharing. Each terminal secretly splits the pseudo-random mask generated in this round into multiple shares and distributes them to backup terminals. When some terminals go offline, resulting in the violation of the zero-sum property, the recovery coordinator gathers a sufficient number of shares to reconstruct the pseudo-random mask of the offline terminals and constructs a compensation ciphertext, which is then superimposed on the aggregated ciphertext to restore the zero-sum property. This allows the present invention to correctly restore the mean and variance of the original data even in actual deployments where terminals experience dynamic disconnections, and the compensation process does not affect the long-term shared seed, thus maintaining long-term privacy guarantees. The homomorphic encryption, Diffie-Hellman key exchange, pseudo-random number generator, Shamir secret sharing, and Gaussian sampling cryptographic primitives used in this invention are all publicly published mature solutions, supported by mature open-source implementations that can be directly reused. The computational overhead required for a single aggregation on the terminal side can be completed on mainstream embedded processors, facilitating engineering deployment in real-world edge scenarios such as the Internet of Things, wearable devices, and smart meters. Attached Figure Description

[0017] Figure 1 The above are comparison charts of the aggregated statistical accuracy of Examples 1, 2, and 3 with Comparative Examples 1 and 3, where (a) is a comparison chart of the relative error of mean estimation and (b) is a comparison chart of the relative error of variance estimation.

[0018] Figure 2 The above are overhead comparison charts of Examples 1, 2, and 3 with Comparative Examples 1 and 4, where (a) is a comparison chart of uplink communication volume per terminal per round, and (b) is a comparison chart of the number of equivalent serial homomorphic additions in the cloud.

[0019] Figure 3 This is a comparison chart of the privacy protection strength of a single terminal under the collusion threat of Examples 1, 2, and 3 and Comparative Examples 2 and 3. It is also a line graph showing the change of the attacker's estimated variance with the collusion ratio k / N.

[0020] Figure 4 This is a comparison chart of CKKS encrypted noise budget consumption between Examples 1 and 3 and Comparative Examples 1 and 4, and a line graph showing the noise budget consumption ratio as a function of the number of terminals N.

[0021] Figure 5 This is a flowchart of a privacy protection aggregation statistical analysis method for cloud-based encrypted data, according to the present invention. Detailed Implementation

[0022] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. In addition, the forms of the various structures described in the following embodiments are merely illustrative. The present invention is not limited to the structures described in the following embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] The privacy-preserving aggregated statistical analysis method for encrypted cloud data provided by this invention is deployed in an edge-fog-cloud three-layer system comprising multiple terminal devices, multiple fog nodes, a cloud server, a key management center, and a query initiator. The terminal devices are deployed at the data acquisition site and are responsible for processing the collected raw data. The method performs normalization, squaring, encoding, masking, differential privacy noise injection, and homomorphic encryption. Fog nodes are deployed at the edge near the terminal device, serving as group aggregation nodes. The cloud server is located in the cloud and is responsible for global aggregation. The Key Management Center (KMC) is responsible for generating homomorphic encryption key pairs, holding the homomorphic encryption private key, and acting as the final decryptor. The query initiator is the final requester of the statistical results and can be the business party, regulator, or the terminal device itself. In this three-layer architecture, adjacent layers exchange data through an authenticated and encrypted communication channel. The overall process of this invention is executed sequentially from steps S1 to S6, as described above. Figure 5 The following will explain each point in detail.

[0024] Step S1 is the system initialization step, specifically including sub-steps S11 to S15. In S11, the KMC runs a homomorphic encryption key generation algorithm according to preset security level parameters to generate a homomorphic encryption public key and a homomorphic encryption private key. Homomorphic encryption generally refers to a specific type of encryption scheme where operations on the ciphertext space and their corresponding operations on the plaintext space maintain an algebraic isomorphic relationship. The homomorphic encryption algorithm used in this method is a homomorphic encryption algorithm that supports ciphertext addition, that is, for any plaintext... , Homomorphic encryption algorithm right and The ciphertext obtained by encrypting each , The result of the ciphertext addition operation, after homomorphic decryption, equals and The plaintext addition is performed. A preferred implementation of this method supports two variants: the Paillier homomorphic encryption scheme and the CKKS homomorphic encryption scheme. The Paillier scheme was publicly proposed by Paillier in 1999, and its plaintext space is modulo... set of nonnegative integers ,in The modulus of the Paillier encryption public key is preferably a large integer with a bit length of 2048 bits or more. The CKKS scheme, publicly proposed by Cheon et al. in 2017, allows homomorphic operations of addition and multiplication on approximations over a complex polynomial ring; its polynomial ring dimension is preferably [value missing]. The preferred total bit width of the modular chain is between 400 and 500 bits, and the preferred security level parameter is 128 bits. The homomorphic encryption public key is distributed to all terminal devices, all fog nodes, and the cloud server via the KMC through an authenticated communication channel, while the homomorphic encryption private key is stored locally by the KMC.

[0025] In S12, the KMC publishes the parameters required for this aggregation task to all terminal devices, including the global lower bound of the original data. Global upper bound of raw data Differential privacy total budget Sum of differential privacy violation probability Among them, the global lower bound of the original data. and the global upper bound of the original data The data is pre-estimated based on the business scenario to which the aggregation task belongs. For example, in a smart grid scenario, the terminal device is a household electricity meter, and the raw data... For the cumulative monthly electricity consumption, then and It can be directly given by the business procedures of the power supply service area; differential privacy total budget Used to balance the strength of privacy protection with the availability of statistical estimates A smaller value implies stronger privacy protection and lower estimation accuracy; the preferred value range is between 0.1 and 10. (Differential privacy violation probability) The preferred value is The following small quantities, among which This represents the total number of terminal devices.

[0026] In S13, the cloud server sorts all terminal device identifiers in lexicographical order. The terminal devices are sorted such that each terminal device's left neighbor is the preceding terminal device in the sequence, and its right neighbor is the following terminal device; the left neighbor of the first terminal device is the [number]th terminal device. The terminal device, the first The right neighbor of each terminal device is the first terminal device, forming a logical loop connected end-to-end. The sorting result is broadcast to all terminal devices via the cloud server. The logical loop structure used in this method supports a zero-sum mask generation mechanism in the subsequent S3 step, where each shared seed is used once by two adjacent terminal devices.

[0027] In S14, each pair of adjacent terminal devices negotiates a shared seed using a certified Diffie-Hellman key exchange protocol. The Diffie-Hellman key exchange protocol, publicly proposed by Diffie and Hellman in 1976, allows communicating parties to establish a shared key over a public channel without revealing the key itself; its certified version preferably uses the X25519 protocol based on the Curve 25519 elliptic curve to resist man-in-the-middle attacks. After negotiation, each terminal device locally stores the shared seed with its left neighbor and the shared seed with its right neighbor. The bit length of the shared seed is preferably between 128 bits and 256 bits to match the key length of the PRG.

[0028] In S15, the cloud servers will all Each terminal device is divided into There are 1 terminal group, among which The total number of terminal groups, equal The square root of the product is rounded up. The number of terminal devices in each group is approximately... The square root of the number of terminals, with each group having a similar size. The preferred grouping strategy is consistent hashing or round-robin scheduling to support load balancing and reduce remapping overhead when terminal devices change. The cloud server assigns a fog node as the group aggregation node for each terminal group and broadcasts the terminal group number to which each terminal device belongs and the communication address of the corresponding fog node to all terminal devices and all fog nodes. The square root order of the noise level determines the controllable level of noise accumulation in the subsequent S5 step, which is a key prerequisite parameter for this method to adapt to large-scale terminal scenarios.

[0029] Step S2 is the three-channel joint encoding step, which specifically includes sub-steps S21 to S24.

[0030] In S21, the terminal equipment In the current aggregation round Collect raw data ,in The terminal device number is assigned, with a value ranging from 1 to... ; This is the current aggregation round number, a non-negative integer that increments with each round. For terminal devices In the current aggregation round The collected raw data falls within the closed interval. . real scalar.

[0031] In S22, the terminal equipment The original data is processed according to the following formula. Perform a normalization transformation to obtain the normalized value. : ; In the formula, For terminal devices The normalized value; For terminal devices The original data; The normalization center is set to a value equal to the global lower bound of the original data. With respect to the global upper bound of the original data Sum divided by 2; The normalization radius is equal to the global upper bound of the original data. With respect to the global lower bound of the original data Divide the difference by 2; This is the subtraction operator; This is the division operator.

[0032] Will equal Substituting into the above formula, we can obtain Equal to -1; will equal Substituting into the above formula, we can obtain It equals 1. (Due to the original data) Falling into a closed interval The result obtained after the above normalization transformation Constantly falling into the closed interval .

[0033] In S23, the terminal device For the normalized value Perform the square operation to obtain the normalized square value. ,in for The square of. From Falling into a closed interval It can be directly deduced Falling into a closed interval .

[0034] In S24, the terminal device The normalized value The normalized squared value is used as the first channel value. Using the value 1 as the second channel value and 1 as the third channel value, the three are combined in sequence to form the terminal device. Three-channel encoding vector ,in For terminal devices The three-channel encoding vector. The three-channel encoding vector... In this vector, the first channel carries first-order moment information for subsequent mean estimation; the second channel carries second-order moment information for subsequent variance estimation; and the third channel carries count information for subsequent counting of participating devices. Integrating these three types of information into a single vector allows subsequent homomorphic encryption, homomorphic addition, and homomorphic decryption processes to operate on only a single ciphertext. Compared to conventional schemes that encrypt first-order and second-order moments separately, this reduces the uplink communication per terminal device by approximately half, and the number of homomorphic operations in the cloud by approximately half. Furthermore, because... and They fall into bounded closed intervals respectively and Its dynamic range is related to the original data. It is independent of the absolute magnitude and is more favorable to the fixed-point or floating-point encoding precision of subsequent homomorphic encryption schemes.

[0035] Step S3 is the ring zero-sum mask application step, specifically including sub-steps S31 to S34. Before describing the sub-steps in detail, the pseudo-random number generator used in this step is briefly explained. A pseudo-random number generator (PRG) is a deterministic function that takes a short random key as input and outputs a long pseudo-random bit sequence; its output is computationally indistinguishable from a true random sequence. The PRG used in this method is preferably AES-CTR-DRBG conforming to the NISTSP800-90A standard, i.e., a counter-mode deterministic random bit generator based on the AES block cipher, which features reentrancy, parallel expansion, and the ability to output long sequences.

[0036] In S31, the channel number is... Terminal equipment Using the shared seed with the right-neighboring terminal device as the PRG key, and the current aggregation round number... With channel number The concatenated byte string is used as the PRG input, and the PRG is called to obtain a positive pseudo-random number. ,in The channel number is assigned, with a value of 1 or 2. For terminal devices In the The channel's forward pseudo-random number. In implementation, the bit sequence output by the PRG is truncated or mapped according to the type and value range of the value carried by the current channel. For example, under the CKKS scheme, it is mapped to a floating-point number within a finite range, and under the Paillier scheme, it is truncated to a signed integer with a finite bit width.

[0037] In S32, the same channel is numbered. Terminal equipment Using the shared seed with the left-neighboring terminal device as the PRG key, and the current aggregation round number... With channel number The concatenated byte string is used as the PRG input, and the PRG is called to obtain a reverse pseudo-random number. ,in For terminal devices In the The channel's reverse pseudo-random number.

[0038] In S33, terminal equipment Calculate the first one according to the following formula Pseudo-random mask for the channel : ; In the formula, For terminal devices In the The pseudo-random mask of the channel; For terminal devices In the Positive pseudo-random numbers for the channel; For terminal devices In the Reverse pseudo-random number for the channel; This is the subtraction operator.

[0039] In S34, the terminal device Channel numbering Repeat steps S31 to S33 for steps 1 and 2 respectively to obtain the pseudo-random mask for the first channel. Second channel pseudo-random mask Terminal equipment The Superimposed on the three-channel encoding vector The first channel value, the Superimposed on the three-channel encoding vector The second channel value, the three-channel encoding vector The third channel value remains unchanged, constituting the terminal device. masked encoded vector ,in For terminal devices The masked encoded vector.

[0040] The zero-sum property of the masked encoded vector obtained in step S3 is formally derived below. The terminal device in the first The sum of the pseudo-random masks of the channels is denoted as ,right From 1 to Take the sum. Will Substituting the definition and applying the distributive property of summation, we can obtain... equal reduce Note that under a logical ring topology, By terminal equipment When the shared seed is generated with its right neighboring terminal device, Traverse 1 to hour, The shared seed set involved in the item exactly covers the ring. Adjacent edges; By terminal equipment When the shared seed is generated with its left-hand neighboring terminal device, Traverse 1 to hour, The shared seed set involved in the item also covers the same There are adjacent edges. Under the same input... and Below, the pseudo-random numbers obtained from the PRG for the same shared seed are identical, therefore the pseudo-random numbers corresponding to each shared seed are... The item appears once and in The terms appear once each, and after subtraction, they completely cancel each other out. Therefore... It is always equal to zero. The zero-sum property ensures that after homomorphic addition aggregation of the masked encoding vectors of all terminal devices, the pseudo-random mask components on the first two channels naturally cancel each other out, without affecting the final statistical recovery.

[0041] The zero-sum mask mechanism based on logical rings belongs to a generalized secure aggregation method. This method uses a logical ring topology to replace the fully connected topology of Bonawitz et al.'s original scheme, reducing the number of shared seeds required by each terminal from the number of nodes connected to the node. Proportional The number of keys is reduced to a fixed 2 per terminal, facilitating key management and fault tolerance expansion in large-scale terminal scenarios. The masked encoding vector... When decrypted individually, the values ​​in the first two channels are hidden by a pseudo-random mask. Under the PRG security assumption, the true value is unknown. The attacker could not from Separate from or Therefore, even in the extreme case where the cloud server and the KMC collude to decrypt the ciphertext of a single terminal individually, the mechanism can still provide anti-inference protection for the original data of non-colluding terminal devices.

[0042] Step S4 is the distributed differential privacy noise injection step, specifically including sub-steps S41 to S45. Differential privacy, abbreviated as DP, was publicly proposed by Dwork et al. in 2006 and is a mathematical framework for providing provable privacy protection for statistical query results. For the query function... and adjacent datasets and If probabilistic mechanism Makes any output set ,inequality If it is established, it is called a mechanism. The parameters are satisfied Differential privacy is achieved by superimposing Gaussian noise, whose standard deviation matches the query sensitivity and privacy parameters, onto the query results to ensure privacy. Adjacent datasets are defined as two datasets that differ by exactly one record. The Gaussian mechanism is a classic dynamic programming (DP) implementation mechanism that achieves DP guarantees by superimposing Gaussian noise, whose standard deviation matches the query sensitivity and privacy parameters, onto the query results.

[0043] In S41, the masked encoding vector is determined. Global sensitivity of the first two channels. Global sensitivity Defined as a query function For all neighboring datasets and Difference in the query results The absolute value supremum. The first channel corresponds to the query function. Adjacent datasets are only connected by a single terminal device. Different, due to Values ​​are taken in closed intervals Therefore, the supremum of the absolute value of the query difference is... The absolute value, i.e., the global sensitivity of the first channel. The value is 2, where This represents the global sensitivity for the first channel. The second channel corresponds to the query function. Only one adjacent dataset is between them. different, Values ​​are taken in closed intervals Therefore, the supremum of the absolute value of the query difference is... That is, the global sensitivity of the second channel. The value is 1, where This is the global sensitivity of the second channel. and stated All are constants, and their magnitudes are different from those of the original data. and Completely unrelated; this characteristic is determined by the normalization transformation of S2. Compared to traditional localized differential privacy schemes where sensitivity is proportional to... With this design, the sensitivity of this method is constant, which significantly reduces the required DP noise amplitude in application scenarios with large amounts of original data.

[0044] In S42, the differential privacy total budget is... Allocated to two channels, the first channel receives the privacy budget. Second Channel Privacy Budget ,satisfy and The sum equals the total differential privacy budget. ,in Budget for first-pass privacy; The second channel privacy budget should be allocated equally. and All Half; it can also be adjusted according to the importance of the statistics. For example, if the query initiator is more concerned about the accuracy of the mean, it can be... Take as , Take as By the fundamental combinatorial theorem of differential privacy, if the first channel satisfies the following parameters: The DP, the second channel satisfies the parameters as follows If the DP is such that the global output of the two after serial combination satisfies the parameter is: DP.

[0045] In S43, the calculation is performed according to the following formula. Standard deviation of total noise after channel aggregation : In the formula, For the first The standard deviation of total noise after channel aggregation; For the first Channel global sensitivity; Differential privacy violation probability; For the first Channel privacy budget; The channel number is 1 or 2; the above formula is the standard formula for the Gaussian mechanism parameters. At that time -Sufficient conditions for DP.

[0046] In S44, the terminal device In the Each channel independently samples a sample with a mean of zero and a variance equal to the stated value. The square of the number of terminal devices divided by the total number of terminal devices Gaussian noise samples ,in For terminal devices In the Gaussian noise samples obtained from channel sampling; This represents the total number of terminal devices. Terminal devices Channel numbering The Gaussian noise samples for the first channel are obtained by independently and repeatedly sampling 1 and 2 respectively. Second channel Gaussian noise sample In practice, Gaussian sampling preferably employs the Box-Muller transform method or a numerical sampling method based on the inverse cumulative distribution function to ensure the independence and numerical accuracy of the sampling results.

[0047] The formal derivation of the aggregated distribution of the distributed Gaussian noise is given below. Let... Gaussian noise samples independently collected by each terminal device Independent in pairs, Follows a mean of 0 and a variance of The sum of independent Gaussian random variables follows a normal distribution. This is based on the well-known property that the sum of these variables still follows a Gaussian distribution. right From 1 to The summation result follows a pattern with a mean of 0 and a variance equal to 0. Multiply Divide by Right now The noise follows a normal distribution. Therefore, the standard deviation of the aggregated noise is exactly equal to that calculated by S43. This satisfies the Gaussian mechanism's requirement for the noise standard deviation in the polymerization results; therefore, all terminal devices in the [missing information]... The aggregation effect of the independent Gaussian noise injected into the channel satisfies the following parameters: Differential privacy; and then, using the fundamental combinatorial theorem described in S42, for... and The two channels are combined, and the global statistics output satisfies the following parameters: Differential privacy. This distributed sampling is equivalent to centralized sampling in principle, enabling this method to achieve the same level of privacy protection as centralized DP without introducing any trusted aggregator.

[0048] In S45, terminal equipment Gaussian noise sample from the first channel Superimposed on the masked encoding vector The first channel value, and the second channel Gaussian noise sample Superimposed on the masked encoding vector The second channel value, the masked encoding vector The third channel value remains unchanged, constituting the terminal device. Noise-encoded vector ,in For terminal devices The noise-encoded vector. Due to the aforementioned The sample itself already contains a pseudo-random mask generated from a shared seed. After superimposing Gaussian noise samples, the resulting... It possesses dual protection against PRG masking and Gaussian noise perturbation. Even in the extreme scenario where an attacker colludes with the cloud server and the KMC, and independently decrypts the ciphertext on a single terminal device, the obtained plaintext is still protected by the above two layers and cannot be accurately recovered. or .

[0049] Step S5 is the edge-fog-cloud layered aggregation step, which specifically includes sub-steps S51 to S54.

[0050] In S51, terminal equipment The noisy encoded vector is encrypted using the homomorphic encryption public key. The homomorphic encryption algorithm is invoked to obtain the terminal ciphertext. ,in For terminal devices The terminal encrypted data. Terminal device. The terminal ciphertext is transmitted through a secure communication channel. Uploaded to its respective fog node.

[0051] In S52, fog node Received the belonging number After all terminal devices within a terminal group upload the encrypted terminal data, the corresponding terminal group is then processed. The homomorphic addition operation is performed sequentially on the ciphertext of all terminals within the terminal group to obtain the first... Combine ciphertext ,in For the first Combine encrypted text; The terminal group number is a value ranging from 1 to 1. The homomorphic addition operation is the ciphertext-level addition operation defined by the homomorphic encryption scheme used: for the CKKS scheme, it is a direct addition of ciphertexts, and for the Paillier scheme, it is a multiplication operation between ciphertexts.

[0052] In S53, fog nodes The first... through a secure communication channel Combine ciphertext Uploaded to the cloud server.

[0053] In S54, the cloud server receives all After the group of encrypted messages uploaded by each fog node are processed, all... Each group of aggregated ciphertexts is sequentially subjected to the homomorphic addition operation to obtain the global aggregated ciphertext. ,in This is a globally aggregated ciphertext. The cloud server will store the globally aggregated ciphertext... Send to the KMC.

[0054] The following explains the principle behind the control of ciphertext noise accumulation by the hierarchical aggregation structure. For homomorphic encryption schemes such as CKKS and BFV, which are based on error-based learning problems, the ciphertext naturally contains a small amount of noise introduced during the encryption process. Each ciphertext addition operation causes the noise variance to accumulate linearly according to the sum of independent and identically distributed noise. If a single-level aggregation method is used, that is, the cloud server directly controls the noise accumulation... Each terminal ciphertext is sequentially subjected to homomorphic addition, and the accumulated ciphertext noise variance is approximately The variance of single-addition noise is multiplied by 1; when When the noise level is high, the accumulated noise may approach or exceed the upper limit of the ciphertext noise budget, leading to decryption failure. The hierarchical aggregation method in this approach will accumulate... The next addition is broken down into approximately [a fog layer]. The square root addition and the cloud layer The square root of the addition is performed at two levels. After the fog nodes are aggregated within the group, the aggregated ciphertext of the group can be processed as needed. Perform a ciphertext refresh operation to release the ciphertext noise budget, restoring the group of ciphertext noise budgets entering the cloud to a lower level; the cloud then accumulates approximately... The square root of the encrypted group, the noise growth is also controlled to approximately Within the order of the square root of addition. Equivalently, the order of magnitude of the accumulated ciphertext noise is greater than that of a single-stage scheme. Down to This results in a total number of terminal devices Reachable Even in larger-scale scenarios, homomorphic encryption schemes can still use standard parameter sets. The introduction of fog nodes also provides a natural fault isolation domain and a distributed authentication location, providing architectural support for subsequent fault-tolerant expansion steps.

[0055] Step S6 is the decryption and statistical recovery step, which specifically includes sub-steps S61 to S65.

[0056] In S61, the KMC uses the homomorphic encryption private key to encrypt the globally aggregated ciphertext. Invoke the homomorphic decryption algorithm corresponding to the homomorphic encryption algorithm to obtain a three-dimensional vector; use the first component of the three-dimensional vector as a normalized summation term. The second component is used as a term in the summation of normalized squared values. The third component serves as the terminal counting term. ,in The term is the summation of normalized values; This is the summation term of the normalized squared values; This is the terminal count term, representing the number of terminal devices that actually participated in the aggregation in this round.

[0057] The following is about S61. , , The composition is formally derived. The noise-encoded vector obtained from S45 is... The construction method and the solvable commutativity of homomorphic addition, ciphertext The decrypted first component is equal to the sum of all values ​​submitted to the terminal devices on the first channel, and is expanded as follows: Under the condition that all terminal devices successfully submit encrypted messages, the zero-sum property derived from S34... Therefore The mean is 0 and the variance is A single Gaussian perturbation; similarly, we can obtain The mean is 0 and the variance is A single Gaussian perturbation; The above expansion shows that the decryption result obtained after ciphertext aggregation naturally eliminates the pseudo-random mask component, retaining only the summation related to the original statistics and the Gaussian perturbation that matches the DP mechanism.

[0058] In S62, the estimated mean of the original data is calculated using the following formula. : ; In the formula, This is an estimate of the mean of the original data; As the normalization center; The normalized radius; The term is the summation of normalized values; For terminal count items; The above formula is derived. The mean of the original data is denoted as... The normalization relation obtained from S22 The inverse solution yields Take the desired result from both sides. Mean of normalized values The summation term of the normalized value is divided by the actual number of participating terminal devices, i.e. As an unbiased estimator, the estimator is substituted into... The expression is then used to obtain the above formula.

[0059] In S63, the variance estimate of the original data is calculated using the following formula. : ; In the formula, This is the estimate of the variance of the original data, i.e., the estimate of the standard deviation of the original data. The square of; normalized radius The square of; The normalized radius; This is the summation term of the normalized squared values; For terminal count items; The term is the summation of normalized values; for Divide by The square of the quotient; the variance of the original data is denoted as... ,Depend on And the properties of variance operations regarding the invariance of constant shifts and the square-magnification of constant coefficients, have: Normalized variance The formula for the second moment of variance is equal to ;in Depend on Make an unbiased estimate. Depend on Making an unbiased estimate and substituting it into the equation, we obtain the above formula.

[0060] In S64, the variance estimate of the original data... Take the larger of the two values ​​and zero, then take the square root of the resulting non-negative value to obtain the estimated standard deviation of the original data. ,in This is an estimate of the standard deviation of the original data. The numerical processing of taking the larger value is to prevent the influence of DP Gaussian noise on the data in scenarios with small samples or high privacy budgets. The resulting difference produces a sufficiently large negative perturbation, thereby causing Numerical stability protection is set for occasional negative values.

[0061] In S65, the KMC estimates the mean of the original data. The original data variance estimate The estimated standard deviation of the original data and the terminal count item The aggregated statistical results are returned to the query initiator. Throughout the entire process, neither the query initiator, the cloud server, the fog node, nor any single entity or non-full aggregation combination within the KMC accesses the raw data of any terminal device. The plaintext value, the resulting aggregated statistical results carry - Differential privacy guarantee.

[0062] The following section provides a detailed explanation of a specific implementation variant of the homomorphic encryption algorithm using the CKKS homomorphic encryption scheme. The CKKS scheme is a scheme that supports approximate homomorphic encryption of complex or real numbers; its plaintext space is a subset of the complex polynomial ring, and each ciphertext can carry multiple plaintext slots in parallel in Single Instruction Multiple Data (SIMD) mode, with each slot independently carrying a complex or real number; ciphertext addition corresponds to parallel addition between plaintext slots, so the three-channel joint addition aggregation required by this method can be completed in parallel by slot.

[0063] When using the CKKS solution, the specific implementation of S51 is as follows: terminal equipment The noise-encoded vector The first, second, and third channel values ​​are sequentially filled into three different plaintext slots of the CKKS plaintext polynomial. The remaining plaintext slots of the CKKS plaintext polynomial are filled with zeros. Then, the CKKS encryption algorithm is called on the CKKS plaintext polynomial using the homomorphic encryption public key to obtain the terminal ciphertext. The specific numbers of the three different plaintext slots, such as number 0, number 1, number 2, or any other three different slot numbers, are uniformly specified by the cloud server in S15 and broadcast to all terminal devices, so that each terminal device adopts a consistent slot mapping, and the channel values ​​can be added independently in the corresponding slot after homomorphic addition aggregation.

[0064] When using the CKKS scheme, the homomorphic addition operations in S52 and S54 are both ciphertext-ciphertext addition operations defined by the CKKS scheme. In S52, fog nodes... In the context of the relevant number The homomorphic addition operation is sequentially performed on the ciphertexts of all terminals within a terminal group to obtain the first... Combine ciphertext Then, according to the first Combine ciphertext The remaining modulus chain length is conditionally judged to determine whether it is lower than a preset modulus chain threshold, and whether to proceed with the decision. Invoke the CKKS modulus-to-digital switching operation. The CKKS modulus-to-digital switching operation is an operation that reduces the ciphertext by a specified modulus factor and releases a corresponding layer of noise budget. When the remaining modulus chain length is lower than the preset modulus chain threshold, the ciphertext is... The CKKS analog-to-digital switching operation is invoked, and the ciphertext obtained after the analog-to-digital switching operation is used as the updated ciphertext. Upload to the cloud server; otherwise, directly upload to the cloud server. Uploaded to the cloud server. The preset modulus chain threshold is preferably half the total modulus chain length. The condition-triggered modulus switching strategy can avoid unnecessary reduction of ciphertext accuracy when the noise budget is still sufficient, and refresh in time before the noise accumulation approaches the budget limit to reserve enough noise budget for the cloud layer.

[0065] The following section provides a detailed explanation of a specific implementation variant of the homomorphic encryption algorithm using the Paillier homomorphic encryption scheme. The Paillier scheme is an additive homomorphic public-key encryption scheme whose security is based on the decisional composite residues assumption; its plaintext space is modulo... integer space ciphertext space is a model an integer space, where The modulus of the Paillier encryption public key; its additive homomorphism is manifested in that, for any plaintext , Ciphertext obtained by Paillier , Model The result of the multiplication below, and then decrypted by Paillier, is equal to Remodel .

[0066] Since the Paillier plaintext space is a set of non-negative integers, and the noise-encoded vector obtained by this method... The first and second channel values ​​are signed real numbers, requiring quantization, Horner encoding, and modulo mapping to be compatible with Paillier's plaintext space. Therefore, when using the Paillier scheme, step S51 is specifically divided into sub-steps S51a to S51c, and the decryption part of step S61 also needs to be divided accordingly.

[0067] In S51a, terminal equipment The noise-encoded vector is processed according to the following formula. The Channel values ​​are quantized into signed first channel values. Quantized Integers : ; In the formula, For terminal devices In the The quantization integer of the channel, It is a signed integer; For the noise-encoded vector The Channel value; Representing 2 power, The value represents the number of bits for fixed-point precision and is a positive integer. This is the floor function; This is the multiplication operator; The channel number is 1, 2, or 3. The fixed-point precision is specified in bits. The preferred choice is a positive integer between 24 and 32. Larger numbers retain more decimal places and have lower quantization errors, but they also affect the protection against carry-over. and Paillier modulus The bit length requirement is also correspondingly high.

[0068] In S51b, the terminal device The first quantized integer is calculated using the following formula. The second quantized integer and the third quantized integer Compressed into a single signed Paillier plaintext integer using Horner encoding. : ; In the formula, For terminal devices Signed Paillier plaintext integers; For terminal devices The first quantized integer; For terminal devices The second quantized integer; For terminal devices The third quantized integer; To prevent carry-over of base, It is a positive integer; for The square of; This is the addition operator; This is the multiplication operator.

[0069] The anti-carry base The value should be such that after aggregation, it is calculated according to... The number system can be unambiguously decomposed channel by channel. The specific constraint is that all... Each terminal device The maximum possible value of the absolute value of the sum is strictly less than 1 / 2. ,all Each terminal device The maximum possible value of the absolute value of the sum is strictly less than 1 / 2. ,and Total number of terminal devices and The product of these three factors is strictly less than the modulus of the Paillier encryption public key. To avoid Paillier plaintext space overflow. An operational... The selection method is to first estimate The upper bound of the absolute value is denoted as , Depend on The range of values , The range of values The possible range of PRG output is obtained by summing the upper limit of 6 times the standard deviation of the Gaussian noise samples; then take... greater than or equal to And aligned upwards to integers obtained by powers of 2. The selection method is relatively conservative, taking into account both the prevention of channel crosstalk and the sufficiency of the Paillier modulus space.

[0070] In S51c, the terminal device The signed Paillier plaintext integer is expressed by the following formula. Mapped to Paillier plaintext space : ; In the formula, For terminal devices Paillier plaintext integer, ; For terminal devices Signed Paillier plaintext integers; The modulo operator; The modulus of the Paillier encryption public key. When hour, ;when hour, The symmetric centralization representation followed by the mapping is a well-known standard implementation of the Paillier scheme carrying signed integers.

[0071] After mapping is completed, the terminal device Using the Paillier encryption public key to the plaintext integer The Paillier encryption algorithm is invoked to obtain the terminal ciphertext. The homomorphic addition operations in S52 and S54 are both ciphertext multiplication operations defined by the Paillier scheme. Ciphertext multiplication is modular... The following will proceed.

[0072] When using the Paillier scheme, the decryption and component decomposition process of S61 is as follows: the KMC uses the homomorphic encryption private key to decrypt the globally aggregated ciphertext. The Paillier decryption algorithm is called to obtain the Paillier decrypted plaintext integer. , Falling into the range ;like Then take As a signed Paillier aggregate plaintext integer Otherwise take As a signed Paillier aggregate plaintext integer ,in For signed Paillier aggregated plaintext integers. Based on the carry-protected radix. number system Sequentially disassembled into the first polymer component Second polymerization component and the third polymerization component ,in for right The value obtained by taking the modulo, for The quotient of income The value obtained by taking the modulo, for The quotient is obtained; and each polymer component is subjected to... Number systems have a sign recovery rule, which states that if a component obtained from the decomposition is greater than a certain value... The value is then subtracted from the component. To restore it to a signed integer. The aforementioned Divide by The normalized summation term is obtained. , will the Divide by The normalized squared summation term is obtained. , will the Divide by The terminal count item is obtained. After disassembly , , This means that subsequent statistics from S62 to S64 will be restored.

[0073] The following details the fault-tolerant extension steps included in the method. In actual deployment, some terminal devices may fail to upload the terminal ciphertext on time in this round of aggregation due to network jitter, local failure, or power outage; these are referred to as offline terminal devices. If no compensation is provided for offline terminal devices, all the zero-sum properties described in S3 depend on... All terminal devices were involved when the premise was compromised. No longer always zero, after decryption and Non-zero terms related to the pseudo-random mask corresponding to the offline terminal device will remain in the data, causing systematic bias in the statistical estimates. To address this, this method introduces fault-tolerant extension steps T1 to T4 based on Shamir secret sharing.

[0074] First, a brief explanation of the Shamir secret-sharing scheme will be given. Shamir secret-sharing is a method of splitting secrets into... Each share and distributed to Fang's cryptographic scheme has a reconstruction threshold of . , any Each share can uniquely reconstruct the secret, while fewer than Each share does not disclose any information about the secret. The scheme is to randomly construct a... The basic operation is to use a polynomial of degree 1 and make the constant term equal to the secret term; Each share corresponds to The polynomial values ​​at different non-zero points; reconstruction is accomplished through Lagrange interpolation. In the Shamir secret-sharing scheme used in the fault-tolerant extension step of this method, The number of backup terminal devices corresponding to each terminal device. It is a positive integer greater than or equal to 3; To reconstruct the threshold, greater than or equal to 2 and less than or equal to Positive integers. and The optimal value is selected in the engineering deployment. A positive integer between 5 and 10 for About half of that, to balance fault tolerance, communication overhead and security.

[0075] In T1, after S15, the cloud server selects from the remaining terminal devices for each terminal device. Each terminal device has a backup terminal device, and the corresponding terminal device is... The identifier of each backup terminal device is broadcast to all terminal devices and all fog nodes. The selection of backup terminal devices preferably uses a consistent hashing method to ensure even distribution of backup relationships and automatic rebalancing when the number of terminals changes.

[0076] In T2, after S34 and before S51, the terminal device For the current aggregation round The generated first channel pseudo-random mask and the second channel pseudo-random mask The Shamir secret sharing scheme is used respectively to... Split into The first mask share, will Split into A second mask share; then the... The first mask share and the aforementioned The second mask share is distributed to the Each backup terminal device temporarily stores the information locally, and each backup terminal device receives and saves one first mask share and one second mask share. The object distributed by Shamir Secret Sharing is the pseudo-random mask generated in the current aggregation round itself, rather than the long-term shared seed negotiated by the Diffie-Hellman protocol as described in S14; therefore, even if the recovery process occurs, the leaked information is limited to the pseudo-random mask in this round and does not jeopardize the security of the long-term shared seed and subsequent rounds.

[0077] In T3, during the execution of S5, if the fog node does not receive a message from the terminal device within its terminal group within the preset timeout period... The uploaded terminal ciphertext Then the fog node determination terminal device For disconnected terminal devices. The fog node is connected to the terminal device. corresponding One backup terminal device selected from the backup terminal devices that is currently online and has not been determined to be offline is chosen as the recovery coordinator, and a masked recovery request is sent to the recovery coordinator. The remaining backup terminal devices... After receiving the share aggregation request from the recovery coordinator, each backup terminal device identifies itself as a terminal device. The saved first mask share and second mask share are sent to the recovery coordinator.

[0078] In T4, the recovery coordinator, based on the received shares, determines the reconstructing threshold when the number of shares gathered reaches or exceeds the threshold. At that time, the disconnected terminal devices were reconstructed using the Lagrange interpolation reconstruction algorithm of the Shamir secret sharing scheme. The first channel pseudo-random mask and the second channel pseudo-random mask The recovery coordinating party will... As the first channel value, the aforementioned Using the second channel value and zero as the third channel value, a compensation vector is constructed; then, the homomorphic encryption algorithm is called on the compensation vector using the homomorphic encryption public key to obtain the compensation ciphertext; the compensation ciphertext is sent to the fog node via a secure communication channel; the fog node compares the compensation ciphertext with its corresponding... Combine ciphertext Perform the homomorphic addition operation once, and use the resulting ciphertext as the updated ciphertext. Uploaded to the cloud server.

[0079] The following is a formal derivation of the correctness of the compensation direction. When no disconnection occurs, all... The terminal device in the first Pseudo-random mask summation of channels A single offline terminal device is denoted as a terminal device. At that time, the pseudo-random mask of the submitted terminal device set is summed. Expanding equals full Sum of pseudo-random masks for each terminal device minus That is equal to To achieve global aggregation of ciphertext When the pseudo-random mask components on the first and second channels are set to zero, the introduced compensation term should be: Instead ; The sum of the pseudo-random mask submitted by the terminal device is: The sum is exactly zero. In cases with multiple disconnected terminal devices, accumulating the compensation term one by one maintains the zero-sum property. Setting the third channel value of the compensation vector to zero makes the terminal count term... This is exactly equal to the number of terminal devices that actually submitted the encrypted data. Total number of offline terminal devices; obtained from S62 and S63 , To ensure an unbiased estimate of the data from the terminal devices actually participating in this round of aggregation, the physical meaning is clear. Throughout the fault-tolerant expansion process, the fog nodes never come into contact with the plaintext value of the pseudo-random mask, and the recovery coordinator only comes into contact with the plaintext of the pseudo-random mask related to its own round, without touching the long-term shared seed, thus maintaining the long-term privacy guarantee of the method.

[0080] This invention employs three-channel joint encoding, enabling a single ciphertext to simultaneously carry first-order moment information, second-order moment information, and counting information. Compared to conventional schemes that encrypt first-order and second-order moments separately, the number of encryption attempts per terminal device, uplink communication volume, and number of homomorphic operations in the cloud are all reduced to approximately one-half. The normalization transformation will... and The value of is limited to a bounded interval. and , to improve the global sensitivity of the first channel The value is 2, the global sensitivity of the second channel. The value is 1, which is consistent with the magnitude of the original data. and Irrelevant constants. In application scenarios with large volumes of raw data, such as smart grid scenarios where meter readings can reach thousands of kilowatt-hours, if a traditional localized differential privacy scheme is used, the required noise standard deviation is proportional to... The noise standard deviation required by this method is only related to the normalized constant sensitivity, and the required noise amplitude is significantly lower. The ring zero-sum mask provides anti-inference protection for the original data of a single terminal when a single ciphertext is independently decrypted, forming a double protection layer after being superimposed with distributed Gaussian difference privacy noise. Even if an attacker is located on the cloud server and colludes with the KMC, adding at most... In an extreme threat model where multiple terminal devices participate in collusion, the raw data of the remaining non-colluding terminal devices. Still subject to parameters Differential privacy protection. Edge-fog-cloud layered aggregation reduces the cumulative noise level of ciphertext from... Down to This results in a total number of terminal devices In ultra-large-scale scenarios, homomorphic encryption schemes can still use standard parameter sets without frequent relinearization or increasing the size of ciphertext parameters, which facilitates engineering deployment.

[0081] Based on the Shamir secret sharing fault-tolerant extension using pseudo-random masks, the aggregation results can still maintain zero-sum properties and correctly recover statistics even in scenarios where some terminals are offline. Furthermore, the distributed secret shares do not involve long-term shared seeds, thus not compromising long-term privacy guarantees. The cryptographic primitives used in this method are all publicly published and mature schemes, including homomorphic encryption schemes, the Diffie-Hellman key exchange protocol, AES-based PRG, the Shamir secret sharing scheme, and Gaussian sampling, which can be directly used to build prototype systems. The main computational load of a single aggregation on the terminal side includes one homomorphic encryption, two PRG calls per channel, and one Gaussian sampling per channel. The PRG calls and Gaussian sampling have relatively low computational requirements, and the homomorphic encryption takes only tens of milliseconds per cycle on mainstream embedded processors, making it suitable for deployment in edge scenarios such as IoT, wearable devices, and smart meters. The privacy-preserving aggregation statistical analysis method for cloud-encrypted data described in this invention can be applied to scenarios involving massive numbers of terminals, such as smart grid regional electricity consumption statistics, smart medical electronic medical record second-moment statistics, industrial IoT device status aggregation monitoring, financial risk control user profile statistics, and smart transportation trajectory statistics. This method provides parameters... While ensuring differential privacy, it also features high accuracy, low communication overhead, and good anti-collusion strength.

[0082] Example 1: Smart Grid Regional Monthly Electricity Consumption Privacy Protection Aggregated Statistics; This example uses the CKKS homomorphic encryption scheme to apply to the monthly cumulative electricity consumption privacy protection aggregated statistics of 10,000 households' smart meters in a certain power supply area. Total number of terminal devices. Set to 10000, original data The monthly cumulative electricity consumption for each household, expressed in kWh, is determined in advance by the power supply service area's business procedures, with the global lower bound of the raw data set. 0, the global upper bound of the original data The value is 10000. The cloud server is the regional dispatch center server, the fog node is the building gateway, the key management center is an independent security operations center, and the query initiator is the regional dispatch department.

[0083] Step S1 is the system initialization step. In S11, the key management center runs the CKKS key generation algorithm at a 128-bit security level, with a polynomial ring dimension. Pick The total bit width of the modular chain is 438 bits, generating a homomorphic encryption public key. and homomorphic encryption private key and through the authentication channel Distribute to all terminals, fog nodes, and cloud servers. The key management center in S12 publishes the parameters to all terminals. , , , In S13, the cloud server sorts all 10,000 terminals according to the lexicographical order of their device identifiers and forms a logical loop with the first terminal connected to the last. In S14, adjacent terminals negotiate a shared seed of 256 bits using the X25519 protocol based on Curve25519 elliptic curves. In S15, the cloud server divides the 10,000 terminals into groups using consistent hashing. There are 100 terminal groups, each with 100 users, and each group is assigned a fog node as the group aggregation node.

[0084] Step S2 is the three-channel joint coding step. In S21, the terminal device... In the Round-collecting raw data S22 is based on the normalized center Normalized radius Calculate the normalized value The result Falling into a closed interval The normalized squared value is obtained in S23. Falling into the closed interval S24 in As the first channel value, The second channel value and the value 1 are used as the third channel value to form a three-channel encoded vector. .

[0085] Step S3 is the ring zero-sum mask application step. In S31, the terminal device... Using the shared seed with the right neighbor terminal as the key for AES-CTR-DRBG, and Using a concatenated byte string as input, a pseudo-random number generator is called to obtain a positive pseudo-random number. In S32, a reverse pseudo-random number is obtained using a shared seed with the left neighbor terminal as the key and the same input string. In S33, press Calculate the first Channel pseudo-random mask. In S34... Taking 1 and 2 respectively, we obtain the pseudo-random mask for the first channel. Second channel pseudo-random mask , superimposed The first two and third channels remain unchanged, forming a masked encoding vector. .

[0086] Step S4 is the distributed differential privacy noise injection step. In S41, the global sensitivity of the first channel is determined. 2. Second channel global sensitivity The allocation ratio in S42 is 1. Total budget Assigned to In S43, press Calculate the standard deviation of the total noise after aggregation of the first channel. Standard deviation of total noise after aggregation of the second channel Terminal devices in S44 Gaussian noise samples were independently sampled using the Box-Muller transform method. Lieutenant General S45 , Overlay The first two channels form a noise-encoded vector. .

[0087] Step S5 is the edge-fog-cloud layered aggregation step. In S51, the terminal device... Will The three channel values ​​are sequentially filled into the first three SIMD slots of the CKKS ciphertext, and the remaining slots are filled with zeros. The terminal ciphertext is obtained by calling the CKKS encryption algorithm. The encrypted data is uploaded to its respective fog node via a secure channel. In S52, each fog node performs 99 homomorphic additions on the ciphertexts of 100 terminals within the group to obtain the group aggregated ciphertext. S53 Uploaded to the cloud server. In S54, the cloud server performs 99 homomorphic additions on 100 groups of ciphertext to obtain the globally aggregated ciphertext. The data is sent to the key management center. Fog layer analog-to-digital switching is not enabled in this embodiment.

[0088] Step S6 is the decryption and statistical recovery step. In S61, the key management center uses... The CKKS decryption algorithm is used to obtain a three-dimensional vector, and the normalized summation terms are extracted from each vector. Normalized square summation term and terminal count items In S62, press Calculate the estimated mean of the raw data. (In S63, by...) Calculate the variance estimate of the original data. (S64) The estimated standard deviation of the original data is obtained by taking the square root of the larger of the two values ​​and zero. Lieutenant General S65 , , , Return to the query initiator. This embodiment does not enable fault tolerance extensions.

[0089] Example 2: Privacy-Preserving Aggregated Statistics of Systolic Blood Pressure in Hospital Inpatient Wards; This example uses the Paillier homomorphic encryption scheme and is applied to the privacy-preserving aggregated statistics of morning systolic blood pressure of 1000 inpatients in a hospital. The main differences from Example 1 are as follows: First, the homomorphic encryption scheme has been changed. In S11, the key management center adopts the Paillier scheme, and the Paillier encryption public key modulus... Take 2048 bits; the homomorphic addition operation of S5 is implemented as Paillier ciphertext in the modulus. The first is multiplication. The second is changes in the data collection scene and parameters. , This is a systolic blood pressure reading in mmHg, with the raw data at its global lower bound. Global upper bound of raw data Normalization Center Normalized radius Number of terminal groups Differential privacy total budget Differential privacy violation probability Thirdly, the proportion of privacy budget allocation. First Channel Privacy Budget Second Channel Privacy Budget It prefers the mean accuracy. Fourth, step S51 is expanded into sub-steps S51a to S51c, according to the fixed-point precision. Will The first two channel values ​​are quantized into signed integers, based on the anti-carry radix. Align upwards to powers of 2 according to the rules. Perform Horner coding, then press After mapping to the Paillier plaintext space, it is encrypted and uploaded. Fifth, the decryption result of S61 is... The rules for restoring signed numbers in a base are broken down into: , , Then substitute steps S62 to S64. The remaining steps are the same as in Example 1.

[0090] Example 3: Industrial IoT Compressor Vibration RMS Aggregated Monitoring; This example employs the CKKS homomorphic encryption scheme and enables fog layer analog-to-digital switching and Shamir secret sharing fault-tolerant extension, applied to the vibration RMS privacy-preserving aggregated monitoring of 100,000 compressor terminal devices in an industrial park. The main differences from Example 1 are as follows: First, the scale is significantly expanded. , For the root mean square reading of vibration, the global lower bound of the raw data is... Global upper bound of raw data Normalization Center Normalized radius Number of terminal groups Differential privacy total budget Differential privacy violation probability Privacy budget allocation ratio Second, fog layer mode switching is enabled. After each fog node in S52 completes group aggregation, a judgment is made. The remaining modular chain length, when it falls below half the total chain threshold, triggers the CKKS modular switching operation to reduce ciphertext noise before uploading to the cloud server. Thirdly, it enables fault-tolerant extension steps T1 to T4 based on Shamir secret sharing. In T1, the cloud server selects a method for each terminal. One backup terminal; the terminal in T2 will use the pseudo-random mask for the first channel of this round. Second channel pseudo-random mask The Shamir (5,3) scheme is used to divide the data into 5 shares and distribute them to 5 backup terminals. In this embodiment, 5% of the terminals randomly disconnect during phase S5. The fog node in phase T3 sends a mask recovery request to the recovery coordinator. In phase T4, the recovery coordinator reconstructs the mask by aggregating the 3 shares using Lagrange interpolation and constructs a compensation ciphertext, which is then superimposed onto the aggregated ciphertext. The remaining steps are the same as in embodiment 1.

[0091] Comparative Example 1: Conventional Double-Encryption Scheme; This comparative example is based on Example 1, with the difference being the encoding method in step S2. Terminal Device Instead of performing normalization transformation or constructing a three-channel encoding vector, it directly processes the original data. After performing fixed-point encoding, it is encrypted into the first ciphertext, and then... After fixed-point coding, the data is encrypted into a second ciphertext. Each terminal uploads two independent CKKS ciphertexts in a single round. Step S4 applies differential privacy noise to the original data space, and the global sensitivity of the first channel is set to... Second channel global sensitivity Step S5 performs homomorphic addition on both sets of ciphertexts, doubling the number of cloud-based computations. Step S6 decrypts the two globally aggregated ciphertexts to recover the mean and variance. The remaining steps are the same as in Example 1. This comparative example is used to quantitatively examine the beneficial effects of the three-channel joint encoding and normalization transformation in Step S2 of Example 1 on communication overhead, computational overhead, and accuracy in a unified simulation environment.

[0092] Comparative Example 2: Ring-based mask removal scheme; This comparative example is based on Example 1, but removes the entire ring-based zero-sum mask application process in step S3. Terminal device No longer generate positive pseudo-random numbers With reverse pseudo-random numbers No longer apply pseudo-random masks. Instead, the three-channel encoded vector The data is directly fed into step S4 for differential privacy noise injection and then uploaded via step S5. The remaining steps are the same as in Example 1. This comparative example is used to quantitatively examine the contribution of the ring zero-sum mask mechanism in step S3 of Example 1 to the independent anti-inference protection of the original data of the uncolluding terminal.

[0093] Comparative Example 3: Localized Differential Privacy Scheme; This comparative example adopts the classic localized differential privacy mechanism, based on the smart grid scenario of Example 1, removing the normalization transformation in step S2 and the ring zero-sum mask in step S3. Step S4 is changed to the traditional localized differential privacy mechanism, where each terminal uses the original data... Directly inject zero-mean Gaussian noise ,in Sensitivity is proportional to ; Sensitivity of using squared query for variance lookup Construct the corresponding Step S5 still performs homomorphic addition aggregation, and step S6 directly restores the mean and variance of the original spatial summation result. The remaining steps are the same as in Example 1.

[0094] Comparative Example 4: Single-stage aggregation scheme; This comparative example is based on Example 1, but the fog layer structure is removed, thus reducing the number of terminal groups. In step S5, after the cloud server receives all 10,000 terminal ciphertexts, it directly performs 9,999 homomorphic additions to obtain the globally aggregated ciphertext. The ciphertext noise accumulates linearly along the single-level aggregation path. The remaining steps are the same as in Example 1.

[0095] Experiment 1: Comparison of Aggregated Statistical Accuracy; The purpose of this experiment is to quantitatively verify the beneficial effects of the normalized three-channel joint coding in step S2 and the dual-sensitivity sub-channel distributed Gaussian difference privacy mechanism in step S4 of Example 1 on the accuracy of the final aggregated statistics. This experiment uses the methods of Examples 1, 2, and 3, and Comparative Examples 1 and 3. The original data was generated according to the IEEE Std754-2019 double-precision floating-point format. (Smart grid scenario) According to the truncated normal distribution In the interval Internal sampling in medical settings According to the truncated normal distribution In the interval Internal sampling, in industrial scenarios According to the truncated normal distribution In the interval Internal sampling. Number of terminals. Scan at 100, 300, 1000, 3000, 10000, 30000, and 100000. Each data point is independently repeated 100 times, and the average is taken. The relative error of the mean estimation for each scheme is calculated as follows: Calculate the relative error of variance estimation according to calculate.

[0096] The relative error of the mean estimation in Example 1 is calculated according to... Calculate the relative error of variance estimation according to Calculation, where , , , , The relative error of the mean estimation in Comparative Example 1 is given by the larger of the random component in step S4 of this invention and the CKKS fixed-point coding precision floor. When the noise level is low, it is dominated by noise. When the levels are relatively high, the coded floor (approximately 0.018%-0.10%) dominates, primarily due to... Dynamic range reached It occupies approximately 27 effective bits of the CKKS fixed-point code. The relative error of the mean estimation in Comparative Example 3 is calculated as follows: Calculate the relative error of variance estimation according to Calculation, where Example 2 in At this location, the mean error is approximately 1.74% and the variance error is approximately 13.19% according to the corresponding parameters; Example 3 in At this point, the mean error is approximately 0.0097% and the variance error is approximately 0.0538% according to the corresponding parameters. The accuracy data for each scheme are shown in the table below.

[0097] Table 1. Relative errors of mean and variance estimates for each scheme under different numbers of terminals.

[0098] Experimental results are as follows Figure 1 As shown, (a) compares the relative errors of the mean estimates for each scheme, and (b) compares the relative errors of the variance estimates for each scheme. The horizontal axis in the figure represents the number of terminal devices. The scale is logarithmic, and the vertical axis represents the relative error, which is also logarithmic.

[0099] from Figure 1 In (a), it can be observed that the curve of Example 1 follows... The increase forms a straight line with a slope of approximately -1, and the relative error is... Proportional; the curve in Comparative Example 1 is... When smaller, it closely overlaps with Example 1, but when After exceeding 3000, the curve deviates significantly from the curve of Example 1 and tends towards a near-horizontal precision floor line, with a floor level of approximately 0.1%. The slope of the curve in Comparative Example 3 is approximately -0.5, and it remains above the curve of Example 1 throughout its length. The concentration was approximately 100 times higher than that of Example 1. The concentration was approximately 316 times higher than in Example 1. Figure 1 In (b), it can be observed that the variance error curve follows a similar trend to (a), but the absolute level of the vertical axis is higher; the variance error in Comparative Example 3 is... At times as high as 4306%, The variance estimate still reached 136%, meaning that variance estimation in Comparative Example 3 is almost unusable in scenarios with large dynamic range data; Example 2 in The marked point is close to, but slightly higher than, the curve in Example 1, which aligns with its differential privacy budget. More stringent than the expectations of Example 1; Example 3 in The marker point is located significantly below the curve in Example 1, reflecting the industrial scenario. A more lenient privacy budget combined with improved accuracy due to a large number of terminals.

[0100] The accuracy floor of the curve in Comparative Example 1 originates from Dynamic range reaches It occupies approximately 27 bits of CKKS fixed-point coding, significantly reducing the remaining precision bits; in Example 1, step S2 will... and The value of is limited to and The encoding precision floor is much lower than the differential privacy noise level and is invisible, therefore the curve in Example 1 follows... The continuous decay without a lower bound verifies the contribution of the normalization transformation in step S2 to the coding accuracy. The relative error of Comparative Example 3 is proportional to... Therefore, its accuracy is extremely poor in scenarios with a large data range; while the relative error of Example 1 is proportional to... , and the range of the original data Complete decoupling verifies the effect of the normalization transformation in step S2 on the differential privacy sensitivity in step S4. , The contribution of constantization.

[0101] Experiment Example 2: Comparison of communication overhead and cloud computing overhead; The purpose of this experiment is to quantitatively verify the beneficial effects of single-ciphertext multi-moment joint coding in step S2 and edge-fog-cloud hierarchical aggregation in step S5 of Example 1 on the single-round uplink communication overhead of each terminal and the equivalent serial homomorphic addition operation overhead in the cloud.

[0102] This experimental example uses the methods of Examples 1, 2, and 3, and Comparative Examples 1 and 4. The uplink communication volume per terminal per round is estimated according to the ciphertext specifications given in the ISO / IEC 18033-6:2019 Homomorphic Encryption Information Technology Standard. The CKKS ciphertext size is calculated using the formula... The bytes calculated are approximately 1.71 MB. The Paillier ciphertext size is calculated as follows: The byte calculation yields approximately 0.5KB. The cloud-equivalent serial homomorphic addition count varies depending on the hierarchical aggregation scheme. Estimate (fog layer) After the addition is performed in parallel, the cloud layer is then processed serially. (secondary addition), for single-level schemes according to Cost estimates. The cost data for each option is shown in Table 2 below.

[0103] Table 2 shows the uplink communication volume per terminal per round and the equivalent number of serial homomorphic additions in the cloud for each scheme.

[0104] Experimental results are as follows Figure 2 As shown, (a) compares the uplink communication volume per terminal per round for each scheme, and (b) compares the equivalent serial homomorphic addition count in the cloud for each scheme. The horizontal axis in the figure represents the labels of the five schemes, and the vertical axis uses a logarithmic scale.

[0105] from Figure 2 As can be observed in (a), the uplink communication per terminal in Examples 1, 3, and 4 is 1.71 MB, while the uplink communication per terminal in Comparative Example 1 is 3.42 MB, exactly twice that of Example 1; in Example 2, because the Paillier ciphertext is significantly smaller than the CKKS ciphertext, the communication per terminal is only 0.5 KB. Figure 2 In (b), it can be observed that in Comparative Example 4... The equivalent number of serial additions in Example 3 is 9999, while in Example 1 it is 198, a difference of approximately 50 times; Example 3 in The value below is 631, while Comparative Example 4 would reach approximately 99999 at this scale, a difference of approximately 158 times; the number of times in Comparative Example 1 is twice that of Example 1.

[0106] Comparative Example 1 shows that each terminal sends two ciphertexts uplink because it will... and Separate encryption; in Example 1, each terminal only sends one ciphertext because step S2 merges the normalized value, the normalized squared value, and the count value into a single three-channel encoded vector. This single ciphertext carries multi-order moment information, verifying the beneficial effect of step S2 in the communication dimension. Comparative Example 4 shows the number of serial additions in the cloud. The number of terminals is linearly related; in Example 1, because step S5 divides the aggregation into two levels, fog layer and cloud layer, and the fog layer... Group aggregation operations can be executed in parallel, reducing the equivalent number of serial additions in the cloud to [number missing]. This significantly expands the scale of terminals that the cloud can support.

[0107] Experiment Example 3: Comparison of Single-Terminal Privacy Protection Strength under Collusion Attack Resistance; The purpose of this experiment is to quantitatively verify the independent anti-inference protection strength of the ring topology pseudo-random zero-sum mask mechanism in step S3 of Example 1 under an extreme threat model of collusion between the cloud and the key management center, plus collusion by some terminals.

[0108] This experimental example uses the methods of Examples 1, 2, and 3, and Comparative Examples 2 and 3. The pseudo-random number generator selected is AES-CTR-DRBG, conforming to the NISTSP800-90ARev.1 specification. The threat model is set according to Section 5.1.3 of the manual. The cloud server and the key management center collude to form attacker A3, and attach... A set of A4 conspirators is formed by randomly selected terminals. From 0 Inter-terminal scanning. Attackers target uncolluded terminals. Perform a single-ciphertext decryption attack and attempt to recover the normalized value. The metric is the attacker's... Estimated variance In a ring topology, only when The attacker can only learn about the seed when both the left and right neighbors join the conspiracy. and Calculate get And only subject to differential privacy protection; otherwise Unpredictable to attackers and with variance normalized to 1. The attacker's expected variance is calculated as follows: Calculation. The variance of the differential privacy component for each scheme is calculated as follows: Calculation, Example 1 is Example 2 is 1.04, Example 3 is ; In Comparative Example 2, the difference in the proportions of all collusion schemes remains constant after removing the ring mask. The variance of the localized differential privacy noise in Comparative Example 3, converted to the normalized space, is consistently 375.55. The attacker estimation variance data for each scheme are shown in the table below.

[0109] Table 3. Variance of attackers' estimates of normalized values ​​for each scheme under different collusion ratios.

[0110] Experimental results are as follows Figure 3 As shown in the figure. The horizontal axis represents the proportion of colluding terminals. The vertical axis represents the attacker's estimated variance of the normalized value, using a logarithmic scale.

[0111] from Figure 3 As can be observed, the curves for Examples 1, 2, and 3 all exhibit a clear high-level plateau followed by a steep decline. When the collusion ratio is less than 0.85, all three example curves are at a high level of approximately 1, with the attacker's estimated variance approaching the output variance of the pseudo-random number generator. When the collusion ratio further increases to above 0.95, the three example curves decline sharply, tending towards their respective differential privacy protection variance levels. The variance of the curve in Comparative Example 2 remains constant across all collusion ratios. Compared to Example 1, the curve showed a significant decrease in the collusion ratio range of less than 0.85. The curve for Comparative Example 3 had a constant lower bound of 375.55 across all collusion ratios, a significantly higher absolute value than the curve for Example 3.

[0112] The high plateau in the curve of the example is due to the zero-sum property of the ring topology in step S3. Each shared seed is used once by two adjacent terminals, and the attacker can only achieve this by controlling the ring topology simultaneously. Only the two neighbors on the left and right can calculate it. Therefore, the collusion ratio must be close to 1 for protection degradation to occur. The horizontal curve in Comparative Example 2 means that after removing step S3, the protection strength degrades to the level of single-layer differential privacy under all collusion ratios, which indirectly confirms that step S3 contributes additional resistance to inference independently of step S4. The high position of the curve in Comparative Example 3 reflects its attempt to obtain protection by increasing localized differential privacy noise, but as shown in Table 1 of Experimental Example 1, this will lead to a relative error in statistical accuracy exceeding 100%. In contrast, Example 1 obtains both high protection strength and high statistical accuracy by superimposing a pseudo-random zero-sum mask with a smaller differential privacy noise, demonstrating the complementary design mechanism of the two-layer protection of steps S3 and S4.

[0113] Experiment Example 4: Comparison of CKKS ciphertext noise budget consumption; The purpose of this experiment is to quantitatively verify the control effect of edge-fog-cloud layer aggregation in step S5 of Example 1 and the fog layer CKKS analog-to-digital switching enabled in Example 3 on ciphertext noise budget consumption.

[0114] This experimental example uses the methods of Examples 1 and 3, and Comparative Examples 1 and 4. The CKKS scheme parameters are selected using the polynomial ring dimension. Total bit width of the modular chain The CKKS encrypted noise uses a linear growth model, with each homomorphic addition introducing an independent variance. The Gaussian noise has a cumulative noise variance that is proportional to the number of homomorphic additions. For a single-level aggregation scheme, execution is performed serially in the cloud. The cumulative noise variance is proportional to the sum of the additions. For the layered polymerization scheme of Example 1, the fog layer accumulates in each group. Subsequent addition, cloud accumulation In the next addition, the fog layer and the cloud layer are in the same sequence. The cumulative noise variance is proportional to... In Example 3, fog layer analog-to-digital switching is further enabled. After one analog-to-digital switching, the noise budget of the aggregated encrypted text is released by about half, and the equivalent noise variance is proportional to... Compared to the double-ciphertext plus single-level aggregation scheme in Example 1, the accumulation on the single-ciphertext path... This addition doubles the amount of ciphertext, resulting in an equivalent noise budget consumption that is twice that of Comparative Example 4. (Number of terminals) exist arrive Between scans. The noise budget consumption ratio is normalized to that of Comparative Example 4. The time is just exhausted, i.e., ratio = 1.0, and decryption failure threshold. The noise budget consumption data for each scheme are shown in the table below.

[0115] Table 4 shows the CKKS encrypted noise budget consumption ratio for each scheme under different numbers of terminals.

[0116] Experimental results are as follows Figure 4 As shown in the figure. The horizontal axis represents the number of terminal devices. The scale is logarithmic, with the vertical axis representing the CKKS ciphertext noise budget consumption ratio, also logarithmic, and the horizontal dashed line marking the decryption failure threshold of 1.0.

[0117] from Figure 4 It can be observed that the slope of the curve in Comparative Example 4 is 1. At point 1.0, the budget is exhausted and decryption fails; the slope of the curve in Comparative Example 1 is also 1, but the ordinate is about twice as high. The budget is exhausted at this point; the slopes of the curves in Examples 1 and 3 are both 0.5, even when... Example 1 consumes only about Example 3 consumes only about There is still a margin of more than one and a half orders of magnitude from the exhaustion threshold of 1.0; the curve of Example 3 is located about halfway below the curve of Example 1.

[0118] The slope of the curve in Comparative Example 4 is 1 because the ciphertext accumulates along a single path under single-level aggregation. Subhomomorphic additive noise, the cumulative amount is proportional to The slope of the curve in Example 1 decreased to 0.5 because step S5 divided the aggregation into two levels, fog and cloud, and the number of serial additions on the single encrypted path decreased. dropped to about The cumulative noise level of the ciphertext is increased by Down to This verifies the control principle of hierarchical aggregation in step S5 on the accumulation of ciphertext noise. The curve in Example 3 shifts down by about half compared to Example 1 because the fog layer analog-to-digital switching operation releases one layer of noise budget for the aggregated ciphertext, resetting the noise budget of the aggregated ciphertext entering the cloud layer to a lower level. These two mechanisms together ensure that... Greater than In ultra-large-scale terminal scenarios, this invention can still use the standard CKKS parameter set without exhausting the ciphertext noise budget, without increasing the size of the ciphertext parameters or frequent relinearization, which facilitates engineering deployment.

[0119] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A privacy-preserving aggregated statistical analysis method for encrypted data in the cloud, applied to a three-layer system of edge, fog, and cloud, including multiple terminal devices, multiple fog nodes, cloud servers, a key management center, and a query initiator, characterized in that... The method includes the following steps: S1: System initialization; The key management center generates a homomorphic encryption public key and a homomorphic encryption private key and distributes the homomorphic encryption public key; The cloud server arranges all the terminal devices into a logical ring and organizes adjacent terminal devices to negotiate and share a seed; The cloud server divides all the terminal devices into multiple terminal groups and assigns a fog node as a group aggregation node for each terminal group; S2: Three-channel joint encoding; Each terminal device performs normalization transformation and squaring operation on the raw data it collects, and uses the normalized value, the normalized squared value and a constant as the first channel value, the second channel value and the third channel value respectively to form a three-channel encoding vector; S3: Circular zero-sum mask application; Each terminal device, based on its shared seed with its left neighbor terminal device and its shared seed with its right neighbor terminal device, applies a pseudo-random mask to the first channel value and the second channel value of the three-channel encoding vector using a pseudo-random number generator, such that the sum of the pseudo-random masks of all terminal devices in the same channel is zero, thus obtaining a masked encoding vector; S4: Distributed differential privacy noise injection; Each terminal device independently samples a zero-mean Gaussian noise sample from the first channel value and the second channel value of the masked encoding vector and superimposes them onto the corresponding channel, so that the aggregated distribution of the zero-mean Gaussian noise samples injected by all terminal devices in the same channel satisfies the requirements of the centered differential privacy Gaussian mechanism, thus obtaining the noise-added encoding vector; S5: Layered aggregation of edge, fog, and cloud layers; each terminal device uses the homomorphic encryption public key to call a homomorphic encryption algorithm supporting ciphertext addition on the noise-added coding vector to obtain terminal ciphertext and upload it to its respective fog node; the fog node performs homomorphic addition on all terminal ciphertexts within its terminal group to obtain group aggregated ciphertext and uploads it to the cloud server; the cloud server performs homomorphic addition on all group aggregated ciphertexts to obtain global aggregated ciphertext and sends it to the key management center; S6: Decryption and Statistical Recovery; The key management center uses the homomorphic encryption private key to call the homomorphic decryption algorithm corresponding to the homomorphic encryption algorithm on the global aggregated ciphertext, extracts the normalized value summation term, the normalized square value summation term, and the terminal count term from the decryption result, calculates the mean estimate, variance estimate, and standard deviation estimate of the original data based on the moment statistics recovery relationship and inverse normalization transformation, and returns the obtained estimates to the query initiator.

2. The method according to claim 1, characterized in that... Step S1 specifically includes: S11: The key management center runs a homomorphic encryption key generation algorithm according to preset security level parameters to generate the homomorphic encryption public key and the homomorphic encryption private key; the key management center distributes the homomorphic encryption public key to all terminal devices, all fog nodes, and the cloud server through an authenticated communication channel; the homomorphic encryption private key is stored locally by the key management center. S12: The key management center publishes to all terminal devices the global lower bound a of the original data for this aggregation task, the global upper bound b of the original data, and the differential privacy budget. Sum of differential privacy violation probability Where a is the global lower bound of the original data; b is the global upper bound of the original data; Total budget for differential privacy; The probability of differential privacy violation is defined as follows: the global lower bound 'a' and the global upper bound 'b' of the original data are predetermined based on the business scenario to which the aggregation task belongs. S13: The cloud server sorts all N terminal devices according to the lexicographical order of their identifiers and forms the logical ring, such that the preceding terminal device of each terminal device is its left neighbor, and the following terminal device is its right neighbor. The left neighbor of the first terminal device is the Nth terminal device, and the right neighbor of the Nth terminal device is the first terminal device; where N is the total number of terminal devices. S14: Each pair of adjacent terminal devices negotiates a shared seed through a certified Diffie-Hellman key exchange protocol, and each terminal device locally stores the shared seed with its left neighbor terminal device and the shared seed with its right neighbor terminal device; S15: The cloud server divides all N terminal devices into M terminal groups, where M is the total number of terminal groups and M is equal to the square root of N rounded up; the cloud server assigns a fog node as a group aggregation node for each terminal group and broadcasts the terminal group number to which each terminal device belongs and the communication address of the corresponding fog node to all terminal devices and all fog nodes.

3. The method according to claim 2, characterized in that... Step S2 specifically includes: S21: Terminal device i collects raw data in the current aggregation round t. Where i is the terminal device number, ranging from 1 to N; t is the current aggregation round number; The raw data collected by terminal device i in the current aggregation round t; S22: Terminal device i processes the raw data according to the following formula. Perform a normalization transformation to obtain the normalized value. : ； In the formula, The normalized value for terminal device i; The raw data for terminal device i; The normalization center is denoted by , and its value is equal to the sum of the original data's global lower bound *a* and the original data's global upper bound *b* divided by 2; *r* is the normalization radius, and its value is equal to the difference between the original data's global upper bound *b* and the original data's global lower bound *a* divided by 2; - is the subtraction operator; / is the division operator. The obtained normalized value It falls within the closed interval [-1,1]; S23: Terminal device i returns the normalized value Performing a squaring operation yields a normalized square value; the normalized square value is... The square of, denoted as The normalized squared value It falls within the closed interval [0,1]; S24: Terminal device i will normalize the value The normalized squared value is used as the first channel value. Using the value 1 as the second channel value and 1 as the third channel value, the three-channel encoding vector of terminal device i is formed. ; The three-channel encoding vector of terminal device i.

4. The method according to claim 3, characterized in that... Step S3 specifically includes: S31: For channel number k, terminal device i uses the shared seed with its right neighboring terminal device as the key of the pseudo-random number generator, and uses the concatenated byte string of the current aggregation round number t and channel number k as the input of the pseudo-random number generator, and calls the pseudo-random number generator to obtain a positive pseudo-random number. Where k is the channel number, which can be 1 or 2; The positive pseudo-random number for terminal device i in the k-th channel; S32: For the same channel number k, terminal device i uses the shared seed with its left neighboring terminal device as the key of the pseudo-random number generator, and the concatenated byte string of the current aggregation round number t and channel number k as the input of the pseudo-random number generator, and calls the pseudo-random number generator to obtain a reverse pseudo-random number. ; The reverse pseudo-random number for terminal device i in the k-th channel; S33: Terminal device i calculates the pseudo-random mask for the k-th channel using the following formula. : ； In the formula, Let i be the pseudo-random mask for the k-th channel of terminal device i; Let i be a positive pseudo-random number in the k-th channel of terminal device i; `-` represents the inverse pseudo-random number generated by terminal device `i` on the `k`th channel; `-` represents the subtraction operator. S34: Terminal device i takes channel number k as 1 and 2 respectively, and repeats S31 to S33 to obtain the first channel pseudo-random mask. Second channel pseudo-random mask Terminal device i will use the pseudo-random mask of the first channel. Superimposed on the three-channel encoding vector The first channel value, and the pseudo-random mask of the second channel. Superimposed on the three-channel encoding vector The second channel value, the three-channel encoding vector The third channel value remains unchanged, constituting the masked encoding vector of terminal device i. ; The masked encoding vector for terminal device i; After step S3 is completed, due to the ring topology of the logic ring, the forward pseudo-random number and the reverse pseudo-random number corresponding to each shared seed appear exactly once with opposite signs in the sum of the pseudo-random masks of all the terminal devices, thus canceling each other out. Therefore, the sum of the pseudo-random masks of all N terminal devices in the same channel is always zero.

5. The method according to claim 4, characterized in that... Step S4 specifically includes: S41: Determine the masked encoding vector Global sensitivity of the first two channels: Global sensitivity of the first channel The value is 2, which is the global sensitivity of the second channel. The value is 1; where The first channel's global sensitivity; This is the global sensitivity of the second channel; and stated The value is determined by the normalized value. The normalized square value falls within the closed interval [-1, 1]. This is derived from the condition falling within the closed interval [0,1]. S42: Calculate the differential privacy total budget Allocated to two channels, the first channel receives the privacy budget. Second Channel Privacy Budget The With the The sum equals the total differential privacy budget. ; Budget for first-pass privacy; Budget for second-channel privacy; S43: Calculate the standard deviation of the total noise after aggregation of the k-th channel using the following formula. : ； In the formula, The standard deviation of the total noise after aggregation of the k-th channel; The global sensitivity of the k-th channel; Differential privacy violation probability; The privacy budget for channel k; k is the channel number, which can be 1 or 2; × is the multiplication operator; This is the square root operator; ` / ` is the logarithmic operator with the natural constant as its base; ` / ` is the division operator. S44: Terminal device i independently samples a sample with a mean of zero and a variance equal to the specified value in the k-th channel. The square of the Gaussian noise samples divided by the total number of terminal devices N ;in Here, Gaussian noise is the sampled by terminal device i in the k-th channel; N is the total number of terminal devices; terminal device i independently and repeatedly samples the channel number k by taking 1 and 2 respectively to obtain the Gaussian noise sample of the first channel. Second channel Gaussian noise sample ; S45: Terminal device i will send the first channel Gaussian noise sample Superimposed on the masked encoding vector The first channel value, and the second channel Gaussian noise sample Superimposed on the masked encoding vector The second channel value, the masked encoding vector The third channel value remains unchanged, constituting the noise-encoded vector of terminal device i. ; The noise-encoded vector for terminal device i; After step S4 is completed, since the sum of independent zero-mean Gaussian distributions is still a zero-mean Gaussian distribution, it can be seen that when all N terminal devices participate in the aggregation, the aggregated sum of the Gaussian noise samples of all the terminal devices in the k-th channel follows a distribution with a mean of zero and a variance equal to the mean of the Gaussian noise sample. The squared Gaussian distribution satisfies the parameter ( , The differential privacy Gaussian mechanism requires...

6. The method according to claim 5, characterized in that... Step S5 specifically includes: S51: Terminal device i uses the homomorphic encryption public key to add noise to the encoded vector. The homomorphic encryption algorithm is invoked to obtain the terminal ciphertext. ; The terminal ciphertext is the terminal ciphertext of terminal device i; terminal device i transmits the terminal ciphertext through a secure communication channel. Uploaded to its respective fog node; S52: After fog node j receives the terminal ciphertext uploaded by all terminal devices in its j-th terminal group, it sequentially performs the homomorphic addition operation on all the terminal ciphertexts in its j-th terminal group to obtain the j-th aggregated ciphertext. ; Let j be the aggregated ciphertext of the j-th group; j is the terminal group number, ranging from 1 to M; S53: Fog node j transmits the j-th group of aggregated ciphertext through the secure communication channel. Uploaded to the cloud server; S54: After receiving the group aggregated ciphertext uploaded by all M fog nodes, the cloud server performs the homomorphic addition operation on all M group aggregated ciphertexts in sequence to obtain the global aggregated ciphertext C; C is the global aggregated ciphertext; the cloud server sends the global aggregated ciphertext C to the key management center; After step S5 is completed, the total number of homomorphic addition operations performed by the fog node and the cloud server is approximately twice the square root of N, which keeps the ciphertext noise accumulation of the homomorphic encryption algorithm below the level of a single-level aggregation scheme.

7. The method according to claim 6, characterized in that... Step S6 specifically includes: S61: The key management center uses the homomorphic encryption private key to call the homomorphic decryption algorithm on the global aggregated ciphertext C to obtain a three-dimensional vector; the first component of the three-dimensional vector is used as the normalized summation term. The second component is used as a term in the summation of normalized squared values. The third component serves as the terminal counting term n; where The term is the summation of normalized values; is the normalized square summation term; n is the terminal count term, representing the actual number of terminal devices participating in this aggregation; S62: Calculate the estimated mean of the raw data using the following formula. : ； In the formula, This is an estimate of the mean of the original data; r is the normalization center; r is the normalization radius; is the normalized summation term; n is the terminal count term; S63: Calculate the variance estimate of the original data using the following formula. : ； In the formula, This is the estimate of the variance of the original data, i.e., the estimate of the standard deviation of the original data. The square of; The square of the normalized radius r; r is the normalized radius; The term is the summation of normalized squared values; n is the terminal count term. The term is the summation of normalized values; S64: Estimated variance of the original data Take the square root of the larger of the two values ​​and zero to obtain the estimated standard deviation of the original data. ; This is an estimate of the standard deviation of the original data; S65: The key management center estimates the mean value of the original data. The original data variance estimate The estimated standard deviation of the original data The terminal count item n is returned as an aggregated statistical result to the query initiator.

Images