A data processing method and system

Abstract

This application discloses a data processing method and system applied to a first terminal. The method includes: acquiring target data; determining the sensitivity level and data access conditions of the target data based on the target data; encrypting the target data using a symmetric key corresponding to the sensitivity level of the target data to obtain a first ciphertext; generating an attribute-based encryption request for the target data according to the data access conditions and sending the attribute-based encryption request to an edge node; receiving attribute-based encryption parameters sent by the edge node; encrypting the symmetric key using the attribute-based encryption parameters to obtain a second ciphertext; and sending the first and second ciphertexts to the edge node for storage. The first and second ciphertexts are used by the second terminal to acquire the target data when the data access conditions are met. This application can determine different symmetric keys according to the sensitivity level of the target data, and the attribute-based encryption parameters are calculated at the edge node, improving the efficiency of data processing.

Description

Technical Field

[0001] This application belongs to the field of information security, specifically relating to a data processing method and system. Background Technology

[0002] With the development of technologies such as the Internet of Things (IoT) and the Industrial Internet, edge computing, as a data processing architecture close to terminal devices, has been widely used due to its low latency and high bandwidth utilization. However, in edge computing environments, device resources are limited, nodes are distributed widely and are highly dynamic, making it difficult to directly adapt traditional attribute-based encryption (ABE) access control technologies.

[0003] In existing technologies, the ciphertext length and key length of the ABE algorithm are relatively fixed. Terminal devices need to independently generate the attribute-based encryption parameters and perform ABE encryption operations on the symmetric key. These operations involve highly complex bilinear pairing calculations, placing high demands on the CPU and memory resources of the terminal device. In resource-constrained IoT and edge computing scenarios, the limited computing power of terminal devices makes it difficult to efficiently complete encryption tasks, leading to decreased data interaction efficiency and increased response latency. Summary of the Invention

[0004] The purpose of this application is to provide a data processing method and system. To solve the above-mentioned technical problems, this application achieves this as follows: In a first aspect, embodiments of this application provide a data processing method applied to a first terminal, the first terminal being communicatively connected to an edge node, and the edge node being communicatively connected to a second terminal, the method comprising: Acquire target data, and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths; The target data is encrypted using the symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext; Generate an attribute-based encryption request for the target data based on the data access conditions, and send the attribute-based encryption request to the edge node; The edge node receives attribute base encryption parameters sent by the edge node; the attribute base encryption parameters are determined by the edge node based on the data access conditions and preset global parameters. The symmetric key is encrypted using the attribute base encryption parameters to obtain the second ciphertext; The first ciphertext and the second ciphertext are sent to the edge node for storage; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

[0005] Secondly, embodiments of this application provide a data processing method applied to an edge node, wherein the edge node is communicatively connected to a first terminal and a second terminal, the method comprising: Receive an attribute-based encryption request for target data sent by the first terminal; the attribute-based encryption request includes the data access conditions of the target data; The attribute base encryption parameters are determined based on the data access conditions and preset global parameters, and the attribute base encryption parameters are sent to the first terminal. The system receives and stores a first ciphertext and a second ciphertext sent by the first terminal; the first ciphertext is obtained by the first terminal encrypting the target data using a preset symmetric key, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

[0006] Thirdly, embodiments of this application provide a data processing method applied to an edge node, wherein the edge node is communicatively connected to a first terminal and a second terminal, the method comprising: Receive a data access request for target data sent by the second terminal; the data access request includes attribute information of the second terminal; If it is determined from the attribute information that the second terminal meets the data access conditions of the target data, then the attribute base decryption parameter corresponding to the attribute base encryption parameter is obtained from the attribute information; wherein, the data access conditions are determined by the first terminal based on the target data; the attribute base encryption parameter is determined based on preset global parameters and the data access conditions; The second ciphertext is transformed according to the attribute base decryption parameters to obtain the third ciphertext; wherein, the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters and stored in the edge node; The first ciphertext and the third ciphertext are sent to the second terminal; the second terminal is used to decrypt the third ciphertext according to the user's private key to obtain the symmetric key, and to decrypt the first ciphertext according to the symmetric key to obtain the target data; wherein, the user's private key is generated based on preset global parameters; the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

[0007] Fourthly, embodiments of this application provide a data processing method applied to a second terminal, the second terminal being communicatively connected to an edge node, and the edge node being communicatively connected to a first terminal, the method comprising: Send a data access request for the target data to the edge node; the data access request includes the attribute information of the second terminal; The edge node receives a first ciphertext and a third ciphertext sent by the edge node; the third ciphertext is obtained by the edge node after converting the second ciphertext according to the attribute base decryption parameter; wherein, the attribute base decryption parameter is obtained by the edge node according to the attribute information, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameter and stored in the edge node; The third ciphertext is decrypted using the user's private key from the second terminal to obtain the symmetric key; wherein the user's private key is generated based on preset global parameters; The first ciphertext is decrypted using the symmetric key to obtain the target data; wherein the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

[0008] Fifthly, embodiments of this application provide a data processing system, which includes a first terminal, a second terminal, and an edge node, wherein the edge node is communicatively connected to the first terminal and the second terminal, respectively. The first terminal is used to acquire target data and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths; The target data is encrypted using the symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext; The first terminal is used to generate an attribute-based encryption request for the target data according to the data access conditions, and send the attribute-based encryption request to the edge node; The edge node is used to receive the attribute base encryption request for the target data sent by the first terminal; The edge node is used to determine the attribute base encryption parameters according to the data access conditions and preset global parameters, and send the attribute base encryption parameters to the first terminal; The first terminal is used to receive attribute base encryption parameters sent by the edge node; The first terminal is used to encrypt the symmetric key using the attribute base encryption parameters to obtain the second ciphertext; The first terminal is used to send the first ciphertext and the second ciphertext to the edge node for storage; The edge node is used to receive and store the first and second ciphertexts sent by the first terminal. The second terminal is used to send a data access request for target data to the edge node; the data access request includes the attribute information of the second terminal; The edge node is used to receive data access requests for target data sent by the second terminal; The edge node is used to obtain the attribute base decryption parameter corresponding to the attribute base encryption parameter if it is determined from the attribute information that the second terminal meets the data access conditions of the target data; The edge nodes are used to transform the second ciphertext according to the attribute base decryption parameters to obtain the third ciphertext; The edge node is used to send the third ciphertext to the second terminal; The second terminal is used to receive the third ciphertext sent by the edge node; The second terminal is used to decrypt the third ciphertext according to the user's private key of the second terminal to obtain the symmetric key; wherein, the user's private key is generated based on the preset global parameters; The second terminal is used to decrypt the first ciphertext according to the symmetric key to obtain the target data.

[0009] The embodiments of this application have the following advantages: The process involves acquiring target data, determining its sensitivity level and access conditions, and using a symmetric key of different lengths for each sensitivity level. The target data is then encrypted using the symmetric key corresponding to its sensitivity level to obtain the first ciphertext. This application utilizes a symmetric key matched to the sensitivity level to encrypt the target data, and the computational overhead of symmetric encryption is significantly lower than that of attribute-based encryption.

[0010] Based on the data access conditions, an attribute-based encryption request for the target data is generated and sent to the edge node. In this application, the first terminal does not generate the parameters required for attribute-based encryption itself, but instead sends a request to generate the parameters to the edge node. The most complex parameter generation operation in attribute-based encryption is offloaded to the first terminal.

[0011] The first terminal receives attribute base encryption parameters sent by the edge node. These parameters are determined by the edge node based on data access conditions and preset global parameters. In this application, the edge node undertakes all the generation and calculation of the attribute base encryption parameters, and the first terminal directly receives the calculated results. All the numerous bilinear pairing operations involved in attribute base encryption are completed at the edge node; the first terminal does not participate in these highly complex calculations.

[0012] The symmetric key is encrypted using attribute-based encryption parameters to obtain the second ciphertext. The first terminal performs attribute-based encryption only on the symmetric key, rather than on the entire target data. Since the size of the symmetric key is much smaller than the target data, the computational load on the first terminal is minimized.

[0013] The first and second ciphertexts are sent to the edge node for storage; these ciphertexts are used by the second terminal to retrieve the target data when data access conditions are met. This application stores the ciphertexts at the edge node, allowing the second terminal to retrieve data directly from the edge node, eliminating reliance on the first terminal being online. The first terminal can go offline after completing the upload, preventing long-term occupation of device resources and improving data retrieval efficiency. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0015] Figure 1 This is a flowchart illustrating the steps of a data processing method provided in an embodiment of this application; Figure 2 This is a flowchart of another data processing method provided in an embodiment of this application; Figure 3 This is a flowchart of another data processing method provided in an embodiment of this application; Figure 4 This is a flowchart of another data processing method provided in an embodiment of this application; Figure 5 This is a system architecture diagram of a data processing system provided in one embodiment of this application; Figure 6 This is a system architecture diagram of an edge node layer provided in one embodiment of this application; Figure 7 This is a system architecture diagram of a terminal device layer provided in one embodiment of this application; Figure 8 This is a system architecture diagram of a cloud center layer provided in one embodiment of this application. Detailed Implementation

[0016] In existing technologies, traditional ABE algorithms use fixed key and ciphertext lengths, and the encryption and decryption processes are computationally complex, leading to excessive load on edge and terminal devices. Access policy generation relies on manual configuration, making it difficult to adapt to dynamic changes in the edge environment, and policy conflict handling is inefficient. The synchronization of attribute information between cloud and edge nodes is crude, resulting in high network transmission overhead and poor system continuity during network outages. Terminal devices have limited computing power, making it difficult to independently complete highly complex encryption tasks, thus impacting data interaction efficiency.

[0017] Therefore, this application provides a data processing method and system that can solve the problems of high computational overhead and high resource consumption on edge devices and terminal devices in traditional ABE algorithms; difficulty in adapting access policy generation and updating to the dynamics of the edge environment and low efficiency in conflict handling; high overhead in cloud-edge attribute information synchronization and insufficient system continuity in the absence of network; and heavy encryption task burden on terminal devices, affecting the real-time performance of data interaction.

[0018] Reference Figure 1 The diagram shows a flowchart of the steps of a data processing method provided in an embodiment of this application.

[0019] In this embodiment, the data processing method can be applied to a first terminal. The first terminal is communicatively connected to an edge node, and the edge node is communicatively connected to a second terminal.

[0020] In this context, the first terminal refers to the source device that initiates data sharing. The first terminal needs to securely send the data it collects or stores to other devices. The data processing method can run on the first terminal and perform corresponding encryption operations.

[0021] An edge node is a server device deployed at the edge of the network, located between the terminal device and the cloud center. A communication connection refers to the network link established between the first terminal and the edge node, enabling data transmission between them. The first terminal sends data to the edge node and can also receive data from the edge node through this network link.

[0022] The second terminal refers to the target device receiving the data, which needs to obtain data from the first terminal. The second terminal also establishes a data transmission network link with the edge node via a communication connection. After the data is encrypted at the first terminal, it is forwarded through the edge node and finally reaches the second terminal, where it decrypts the received data to obtain the original data.

[0023] Optionally, the edge nodes also communicate with the cloud center.

[0024] The cloud center is a centralized computing cluster deployed in a remote data center, providing more powerful storage and computing resources than edge nodes. The cloud center is responsible for generating the global parameters required for system initialization, storing the attribute sets and access policy data reported by each edge node, and undertaking auxiliary encryption and decryption tasks when edge nodes are offline or have insufficient computing resources.

[0025] This method may specifically include the following steps: S101, acquire the target data, and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths.

[0026] In this embodiment, the first terminal can acquire target data that needs to be shared with other devices. The target data refers to the data content to be encrypted and transmitted that the first terminal has collected or stored.

[0027] In this embodiment, the first terminal can determine the sensitivity level and data access conditions of the target data based on the target data. The sensitivity level refers to a classification based on the importance of the data content and confidentiality requirements, used to determine the length of the symmetric key used for encryption.

[0028] Data access conditions can refer to the requirements set on the user's identity attributes for accessing the target data. Only when the attribute information meets the data access conditions can other terminals have the right to obtain the target data shared by the first terminal.

[0029] In specific implementations, sensitivity levels can include a first level and a second level, with the first level having higher sensitivity than the second level. If the sensitivity level is first, the symmetric key has a first length; if the sensitivity level is second, the symmetric key has a second length, with the first length being longer than the second length. The first terminal pre-configures a symmetric key of corresponding length for each sensitivity level, with higher sensitivity levels corresponding to longer symmetric key lengths and lower sensitivity levels corresponding to shorter symmetric key lengths.

[0030] S102, the target data is encrypted using the symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext.

[0031] In this embodiment, the first terminal can encrypt the target data using a symmetric key corresponding to the sensitivity level. Here, a symmetric key refers to a key used in encryption methods where the same key is used for both encryption and decryption. Symmetric encryption requires far less computation than attribute-based encryption, allowing the first terminal to quickly complete the encryption operation on the target data.

[0032] In this embodiment, the first terminal obtains the first ciphertext after encryption. The first ciphertext refers to the ciphertext data obtained by encrypting the target data using a symmetric key. The first ciphertext retains the entire content of the target data, but exists in ciphertext form and cannot be directly read by unauthorized devices.

[0033] S103, generate an attribute-based encryption request for the target data based on the data access conditions, and send the attribute-based encryption request to the edge node.

[0034] In this embodiment, the first terminal generates an attribute-based encryption request based on data access conditions. The attribute-based encryption request refers to a message sent by the first terminal to the edge node requesting the generation of attribute-based encryption parameters. This request carries data access conditions, informing the edge node which attributes-related encryption parameters need to be generated.

[0035] In this embodiment, the first terminal sends the generated attribute base encryption request to the edge node. The first terminal does not perform the generation and calculation of the attribute base encryption parameters itself; instead, it delegates the task of generating the parameters to the edge node. The first terminal only needs to send a request message and does not need to perform any calculation operations related to the generation of attribute base encryption parameters locally.

[0036] S104, Receive the attribute base encryption parameters sent by the edge node; the attribute base encryption parameters are determined by the edge node based on the data access conditions and preset global parameters.

[0037] In this embodiment, the first terminal receives attribute-based encryption parameters sent by the edge node. Attribute-based encryption parameters refer to parameter information generated by the edge node based on data access conditions and preset global parameters, used to perform attribute-based encryption on the symmetric key. The global parameters refer to the publicly disclosed system-level parameters in the attribute-based encryption mechanism, which are pre-configured by the cloud center and synchronized to the edge node.

[0038] In this embodiment, the calculation of the attribute base encryption parameters is completed entirely at the edge nodes. The first terminal only needs to receive the calculation results and does not need to participate in highly complex calculation processes such as bilinear pairing or exponential operations, thus freeing up the computing resources of the terminal device.

[0039] S105, the symmetric key is encrypted using attribute base encryption parameters to obtain the second ciphertext.

[0040] In this embodiment, the first terminal encrypts the symmetric key using the received attribute-based encryption parameters to obtain the second ciphertext. The first terminal performs attribute-based encryption only on the symmetric key, not on the entire target data. The amount of data in the symmetric key is much smaller than the target data, thus minimizing the computational load of attribute-based encryption borne by the first terminal.

[0041] In the specific implementation, the first terminal uses the public key returned by the edge node to perform attribute-based encryption on the symmetric key, obtaining the second ciphertext. The second ciphertext protects the symmetric key itself, not the target data.

[0042] S106, the first ciphertext and the second ciphertext are sent to the edge node for storage; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

[0043] In this embodiment, the first terminal sends the first ciphertext and the second ciphertext to the edge node. The edge node stores the first ciphertext and the second ciphertext in its local storage space, serving as the data source for the second terminal to subsequently obtain the target data.

[0044] In this embodiment, the first ciphertext and the second ciphertext are used to allow the second terminal to obtain target data when data access conditions are met. When the attribute information of the second terminal meets the data access conditions, the second terminal can obtain the first ciphertext and the second ciphertext after transformation processing by the edge node from the edge node, and decrypt it to obtain the target data. After the first terminal completes the ciphertext upload, it does not need to remain online; the second terminal directly obtains data from the edge node, without depending on the online status of the first terminal.

[0045] In the specific implementation, the first terminal encrypts the target data using a symmetric key to obtain the first ciphertext, and then encrypts the symmetric key using attribute-based encryption parameters to obtain the second ciphertext. Integrity verification is then performed on both the first and second ciphertexts. This integrity verification verifies whether the first and second ciphertexts were intact during their generation and storage. After completing the integrity verification, the first terminal uploads the first and second ciphertexts to the edge node layer.

[0046] Optionally, the steps of determining the sensitivity level and data access conditions of the target data based on the target data include: S1101, Obtain the data type of the target data; S1102, Determine the sensitivity level of the target data based on the data type; S1103, if the sensitivity level is level one, then the symmetric key is of length one; S1104, if the sensitivity level is level 2, then the symmetric key is of the second length; wherein, the sensitivity of level 1 is higher than that of level 2, and the first length is greater than the second length; S1105, Determine the data access conditions for the target data based on the sensitivity level.

[0047] In this embodiment, the first terminal can obtain the data type of the target data. The data type refers to the category to which the target data belongs, used to determine the importance and confidentiality requirements of the target data. Different data types correspond to different sensitivity levels, and the data type can be identified from the metadata or content format of the target data.

[0048] In this embodiment, the first terminal determines the sensitivity level of the target data based on the data type of the target data. The first terminal can pre-configure the mapping relationship between data types and sensitivity levels, and classify the target data into the corresponding sensitivity level according to the mapping relationship.

[0049] In this embodiment, when the sensitivity level of the target data is level one, the first terminal encrypts the target data using a symmetric key of a first length. Level one corresponds to higher sensitivity, requiring a longer symmetric key to ensure data security.

[0050] In this embodiment, when the sensitivity level of the target data is level two, the first terminal encrypts the target data using a symmetric key of a second length. Level one sensitivity is higher than level two, therefore the first key length is greater than the second key length; high-sensitivity data uses a longer symmetric key, while low-sensitivity data uses a shorter symmetric key.

[0051] In a specific implementation, for example, if the sensitivity level is level one, a 1024-bit symmetric key can be used to encrypt the target data, with 1024 bits corresponding to the key length used for high-sensitivity data; if the sensitivity level is level two, a 512-bit symmetric key is used to encrypt the target data, with 512 bits corresponding to the key length used for low-sensitivity data, and 1024 bits being longer than 512 bits. For example, fault codes are high-sensitivity data and are encrypted with a 1024-bit symmetric key, while temperature data is low-sensitivity data and is encrypted with a 512-bit symmetric key.

[0052] In this embodiment, the first terminal determines the data access conditions for the target data based on the sensitivity level. Different sensitivity levels correspond to different data access conditions; higher sensitivity data is subject to stricter access conditions, while lower sensitivity data is subject to relatively more lenient access conditions.

[0053] This application solves the problem that the fixed key length in the traditional ABE scheme cannot adapt to different security requirements. It achieves the goal of ensuring the security of highly sensitive data while avoiding unnecessary waste of computing resources caused by using excessively long symmetric keys for low-sensitivity data, thus helping to reduce the encryption burden on terminal devices.

[0054] Optionally, the edge node communicates with the cloud center; the step of determining the data access conditions for the target data based on the sensitivity level includes: S1111, Receive the initial access policy sent by the edge node; the initial access policy is generated by the cloud center using a trained neural network model based on historical access log data, and is distributed to the edge node in a grayscale manner; S1112, Based on the sensitivity level, determine the data access conditions corresponding to the sensitivity level from the initial access policy.

[0055] In this embodiment, a trained neural network model is deployed in the cloud center. This model learns access behavior patterns based on historical access log data and generates an initial access policy. The initial access policy includes access condition configurations corresponding to data with different sensitivity levels and serves as a reference for the first terminal to determine data access conditions.

[0056] In its implementation, the neural network model is a deep learning model based on Long Short-Term Memory (LSTM) networks. It extracts a sequence of continuous access behaviors from the same user within a preset historical time window from historical access log data and outputs access policy rules corresponding to the user's current role attributes based on this sequence. Historical access log data records the access records of each terminal within a historical time period, including access time, visitor attributes, data type, and sensitivity level of the accessed data. The neural network model is jointly trained using supervised learning and reinforcement learning. Its input is the access feature vector of each terminal in the historical access log data, and its output is the access policy parameters. The loss function consists of two parts: policy fitting loss and policy conflict penalty term. The policy fitting loss measures the difference between the model output and the historical actual policy, while the policy conflict penalty term penalizes conflicting rules, guiding the model to generate internally consistent access policies.

[0057] In this embodiment, the initial access policy is distributed to edge nodes in a gray-scale manner. The gray-scale method refers to a policy distribution method where the new access policy is not immediately distributed to all edge nodes, but rather distributed gradually according to a preset proportion. The new policy is first distributed to a subset of edge nodes for verification. If the verification is successful, the distribution scope is expanded; if the verification fails, the policy reverts to the original policy.

[0058] In this embodiment, the first terminal receives an initial access policy sent by an edge node. After completing the grayscale verification, the edge node sends the initial access policy to the first terminal to provide the first terminal with a configuration reference for the access policy.

[0059] In this embodiment, the first terminal searches for data access conditions matching the sensitivity level of the target data from the received initial access policy. Different sensitivity levels correspond to different data access conditions, and the first terminal extracts the corresponding access conditions from the initial access policy based on the sensitivity level as the data access conditions for the target data.

[0060] This application addresses the problems of traditional solutions where access policies rely on manual configuration, making it difficult to adapt to dynamic changes in the edge environment and resulting in low efficiency in handling policy conflicts. It achieves intelligent generation and dynamic adaptation of access policies, improving the efficiency and consistency of policy configuration.

[0061] Reference Figure 2 The diagram shows a flowchart of another data processing method provided in an embodiment of this application.

[0062] In this embodiment, the data processing method can be applied to edge nodes, which are communicatively connected to a first terminal and a second terminal. The specific meanings of the first terminal, the second terminal, and the edge node can be found in the explanations of the foregoing embodiments, and will not be repeated here.

[0063] This method may specifically include the following steps: S201, Receive an attribute-based encryption request for target data sent by the first terminal; the attribute-based encryption request contains data access conditions for the target data.

[0064] In this embodiment, the edge node receives an attribute-based encryption request sent by the first terminal. The attribute-based encryption request is a request message from the first terminal requesting the edge node's assistance in generating attribute-based encryption parameters. The attribute-based encryption request carries data access conditions for the target data, informing the edge node which attributes need to be associated with the encryption parameters.

[0065] S202, determine the attribute base encryption parameters based on the data access conditions and preset global parameters, and send the attribute base encryption parameters to the first terminal.

[0066] In this embodiment, the edge node determines the attribute base encryption parameters based on data access conditions and preset global parameters. The edge node determines the set of attributes to be used based on the data access conditions, and then performs the generation calculation of the attribute base encryption parameters in conjunction with the global parameters to obtain the attribute base encryption parameters.

[0067] In the specific implementation, after the first terminal offloads the task of generating attribute-based encryption parameters to the edge node layer, the lightweight attribute-based encryption algorithm module processes the offloaded encryption task through a hardware acceleration interface. The hardware acceleration interface includes a graphics processor acceleration unit. The lightweight attribute-based encryption algorithm module executes the bilinear pairing and exponential operations in the attribute-based encryption parameter generation process through the hardware acceleration interface and returns the processing results to the first terminal.

[0068] In this embodiment, the edge node sends the determined attribute base encryption parameters to the first terminal. The edge node undertakes all the calculation work for generating the attribute base encryption parameters, and the first terminal only needs to receive the calculation results, without needing to perform parameter generation-related calculation operations locally.

[0069] S203, receive and store the first ciphertext and the second ciphertext sent by the first terminal; the first ciphertext is obtained by the first terminal encrypting the target data using a preset symmetric key, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using attribute base encryption parameters; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

[0070] In this embodiment, the edge node receives a first ciphertext and a second ciphertext sent by the first terminal. The first ciphertext is ciphertext data obtained by the first terminal symmetrically encrypting the target data using a symmetric key corresponding to the sensitivity level. The second ciphertext is ciphertext data obtained by the first terminal encrypting the symmetric key using attribute-based encryption parameters returned by the edge node.

[0071] In this embodiment, the edge node stores the first ciphertext and the second ciphertext in its local storage space. The first ciphertext and the second ciphertext serve as the data source for the second terminal to subsequently obtain target data. When the attribute information of the second terminal meets the data access conditions, the second terminal can obtain the first ciphertext and the second ciphertext after transformation processing by the edge node from the edge node.

[0072] Reference Figure 3 The diagram shows a flowchart of another data processing method provided in an embodiment of this application.

[0073] In this embodiment, the data processing method can be applied to edge nodes, which are communicatively connected to a first terminal and a second terminal. The specific meanings of the first terminal, the second terminal, and the edge node can be found in the explanations of the foregoing embodiments, and will not be repeated here.

[0074] This method may specifically include the following steps: S301, Receive a data access request for target data sent by the second terminal; the data access request contains attribute information of the second terminal.

[0075] In this embodiment, the edge node receives a data access request sent by a second terminal. The data access request is a request message from the second terminal requesting to obtain target data. The data access request carries attribute information of the second terminal, which the edge node uses to determine whether the second terminal has permission to obtain the target data.

[0076] In the specific implementation, after the second terminal sends a data access request for the target data to the edge node layer, the access request processing module deployed in the edge node layer receives the data access request. The access request processing module prioritizes the received data access requests.

[0077] The access request processing module performs permission checks on the second terminal based on the locally adapted policy. The locally adapted policy refers to the policy obtained by adjusting the initial access policy issued by the cloud center layer based on the current device load at the edge node layer. The access request processing module adjusts the priority of data access requests based on the current device load at the edge node layer; the lower the device load, the higher the processing priority, and vice versa.

[0078] S302, if it is determined from the attribute information that the second terminal meets the data access conditions of the target data, then the attribute base decryption parameter corresponding to the attribute base encryption parameter is obtained from the attribute information; wherein, the data access conditions are determined by the first terminal based on the target data; the attribute base encryption parameter is determined based on the preset global parameters and the data access conditions.

[0079] In this embodiment, the edge node determines whether the second terminal meets the data access conditions for the target data based on attribute information. The edge node compares the attribute information of the second terminal with the data access conditions. If the attribute information of the second terminal meets the attribute range defined in the data access conditions, it confirms that the second terminal has the permission to obtain the target data.

[0080] In this embodiment, when the second terminal is confirmed to meet the data access conditions, the edge node obtains the attribute base decryption parameters corresponding to the attribute base encryption parameters based on the attribute information. The attribute base decryption parameters are parameter information used to convert the second ciphertext.

[0081] S303, the second ciphertext is transformed according to the attribute base decryption parameters to obtain the third ciphertext; wherein, the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters and stored in the edge node.

[0082] In this embodiment, the edge node transforms the second ciphertext according to the attribute base decryption parameters to obtain the third ciphertext. The third ciphertext refers to the ciphertext data obtained after transforming the second ciphertext, which can be decrypted by the user's private key of the second terminal.

[0083] The second ciphertext is the ciphertext data obtained by encrypting the symmetric key using attribute base encryption parameters by the first terminal. It cannot be directly decrypted by the second terminal and needs to be processed by the edge node.

[0084] S304, the first ciphertext and the third ciphertext are sent to the second terminal; the second terminal is used to decrypt the third ciphertext according to the user's private key to obtain the symmetric key, and to decrypt the first ciphertext according to the symmetric key to obtain the target data; wherein, the user's private key is generated based on preset global parameters; the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

[0085] In this embodiment, the edge node sends the first ciphertext and the third ciphertext to the second terminal. After receiving the first ciphertext and the third ciphertext, the second terminal decrypts the third ciphertext using its user private key to obtain the symmetric key.

[0086] The user's private key is generated based on preset global parameters and associated with the attribute information of the second terminal. After obtaining the symmetric key, the second terminal uses the symmetric key to decrypt the first ciphertext to obtain the target data.

[0087] In the specific implementation, after the access request processing module determines that the second terminal meets the data access conditions for the target data, the fast decryption acceleration module deployed at the edge node layer calls the pre-calculated hotspot attribute parameters. Hotspot attribute parameters refer to the attribute-based decryption parameters that the fast decryption acceleration module pre-calculates and caches based on frequently occurring attribute combinations. The fast decryption acceleration module decrypts the data by reassembling ciphertext fragments. Ciphertext fragment reassembly decryption means that the fast decryption acceleration module splits the second ciphertext stored at the edge node layer into multiple ciphertext fragments and caches them separately. During decryption, all fragments are retrieved from their respective storage locations and pieced back together to form the complete second ciphertext. Then, the second ciphertext is decrypted according to the attribute-based decryption parameters. The fast decryption acceleration module caches the decryption result locally and returns the decryption result to the second terminal.

[0088] In this embodiment, a data decryption access module is deployed at the terminal device layer. After the second terminal receives the decryption result returned by the edge node layer, the data decryption access module receives the decryption result and decrypts it to obtain the target data. The data decryption access module temporarily caches decryption permissions. Temporarily caching decryption permissions means that the data decryption access module caches the decryption permission credentials in local memory for a preset validity period. When accessing the same target data again within the validity period, the cached decryption permissions are used directly without needing to re-initiate a data access request to the edge node layer.

[0089] Optionally, the edge node communicates with the cloud center; the user's private key is generated in the following way: S3101, Receive attribute information sent by the second terminal; S3102, send attribute information to the cloud center; S3103, Receive the global key component sent by the cloud center; the global key component is generated by the cloud center based on attribute information and preset global parameters; S3104, Obtain the local attributes of the edge node, and generate a local key component based on the attribute information and the local attributes of the edge node; S3105 combines the global key component and the local key component into a user private key; S3106 sends the user's private key to the second terminal storage.

[0090] In this embodiment, the edge node receives attribute information sent by the second terminal. The attribute information of the second terminal is used to generate a user private key associated with the identity of the second terminal.

[0091] In this embodiment, the edge node sends the attribute information of the second terminal to the cloud center. The cloud center is a centralized computing cluster deployed in a remote data center, responsible for performing system initialization and global key component generation. The cloud center generates the global key component based on the received attribute information.

[0092] In this embodiment, the edge node receives a global key component sent by the cloud center. The global key component is a key component generated by the cloud center based on attribute information and preset global parameters, and is associated with the attribute information of the second terminal. The global key component is a component of the user's private key.

[0093] In this embodiment, the edge node acquires its own local attributes. Local attributes refer to the edge node's local identification or configuration information. The edge node generates a local key component based on the attribute information of the second terminal and the edge node's local attributes. The local key component is a key component related to the edge node itself and is used to combine with the global key component to form a complete user private key.

[0094] In this embodiment, the edge node combines the global key component and the local key component into a user private key. The user private key is a complete key associated with the identity attributes of the second terminal, used by the second terminal to decrypt the third ciphertext to obtain the symmetric key.

[0095] In this embodiment, the edge node sends the generated user private key to the second terminal. The second terminal receives the user private key and stores it locally for subsequent decryption of the third ciphertext to obtain the symmetric key.

[0096] In its implementation, the system parameter management module deployed at the cloud center layer generates quantum-resistant public parameters and a master key based on lattice-based cryptography. The system parameter management module distributes the master key across three cloud nodes to prevent single-point failures or key leaks from causing system-wide security collapse. The quantum-resistant public parameters are used to resist cryptanalysis attacks in a quantum computing environment, while the master key is used to derive global key components and user private keys.

[0097] The global attribute management module deployed in the cloud center layer defines cross-domain standard attributes, including user roles and device types, to ensure that the attribute information of terminal devices in different regions can be correctly identified and verified under the same access control framework.

[0098] The local attribute management module deployed at the edge node layer extends local attributes based on the cross-domain standard attributes defined by the global attribute management module. Local attributes include workshop number and equipment location. The local attribute management module performs lightweight encoding on the extended local attributes. Lightweight encoding means mapping the values ​​of local attributes to binary codes of a preset length to reduce the storage space and transmission overhead of attribute information.

[0099] This application solves the problems of excessive reliance on the cloud center in the user private key generation process and the inability to generate private keys when the network is interrupted in traditional solutions. It realizes a cloud-edge collaborative user private key generation method. During network interruption, edge nodes can still generate private keys for users based on local attributes, thereby improving the availability and continuity of the system.

[0100] Optionally, the attribute information includes user identifier and device identifier.

[0101] In this embodiment, the user identifier is information that uniquely identifies a user and is used to distinguish different users; the device identifier is information that uniquely identifies a terminal device and is used to distinguish different terminal devices. The edge node verifies the identity and device of the second terminal based on the user identifier and device identifier, ensuring that only legitimate users using legitimate devices can obtain the user's private key.

[0102] Before the step of receiving the global key component sent by the cloud center, the method further includes the following steps: S3111, Receive the confidence score sent by the cloud center; The confidence score is generated by the cloud center after verifying the user identity of the second terminal based on the user identifier in the attribute information, and verifying the device identity of the second terminal based on the device identifier in the attribute information. S3112, If the confidence score is greater than or equal to the preset threshold, then receive the global key component sent by the cloud center; S3113 If the confidence score is less than the preset threshold, a warning message is sent to the second terminal.

[0103] In this embodiment, the edge node receives a confidence score sent by the cloud center. The confidence score is a score obtained by the cloud center after quantifying the identity verification result of the second terminal. The cloud center verifies the legitimacy of the user's identity based on the user identifier in the attribute information, and verifies the legitimacy of the device's identity based on the device identifier in the attribute information, and generates a confidence score by combining the two verification results. The higher the confidence score, the more trustworthy the identity of the second terminal.

[0104] In this embodiment, the edge node determines whether the confidence score reaches a preset threshold. The preset threshold refers to a pre-set minimum confidence score requirement used to determine whether the second terminal is qualified to receive the global key component. When the confidence score is greater than or equal to the preset threshold, it indicates that both the user identity and device identity of the second terminal have been verified, and the edge node receives the global key component sent by the cloud center.

[0105] In this embodiment, when the confidence score is less than a preset threshold, it indicates that the user's or device's identity on the second terminal has failed verification. The edge node sends a warning message to the second terminal, which indicates that the user's current identity verification has failed and the global key component cannot be obtained.

[0106] In its implementation, edge nodes forward the attribute information of the second terminal to the cloud center layer. The cloud center layer deploys a user global attribute authentication module, which verifies the authenticity of the attribute information through multi-source cross-validation. Multi-source cross-validation includes comparing the user identifier against the user database and comparing the media access control address against device registration information. After the attribute information passes multi-source cross-validation, the user global attribute authentication module generates a confidence score based on the verification results. The confidence score quantifies the credibility of the attribute information. A confidence score between 70 and 80 indicates that the attribute information is credible; if abnormal attributes are found, the user global attribute authentication module issues a warning.

[0107] This application addresses the problems of traditional schemes lacking dual authentication of user and device identities and being vulnerable to key acquisition by unauthorized terminals. It implements dynamic access control based on confidence scores, thereby improving the security of key distribution.

[0108] Optionally, the method further includes the following steps: S3121, in response to an attribute change in the second terminal, obtain the attribute change information of the second terminal; S3122, Generate incremental synchronization data based on attribute change information; S3123 sends incremental synchronization data to the cloud center so that the cloud center can update the attribute information of the second terminal based on the incremental synchronization data.

[0109] In this embodiment, the edge node responds to an attribute change in the second terminal by acquiring attribute change information. An attribute change refers to a change in the attribute information of the second terminal, and the attribute change information records the specific details of the change.

[0110] In its implementation, an attribute update triggering module is deployed at the terminal device layer. This module monitors changes in terminal user attributes. It detects attribute changes when a terminal user's role changes, such as upgrading from operator to administrator. The module uses a lightweight transmission method to send update information to the edge node layer. This lightweight transmission method means that only changed attribute fields are sent, excluding unchanged attribute fields. The module also initiates a retransmission mechanism in case of transmission failure, re-transmitting the failed update information.

[0111] In this embodiment, the edge node generates incremental synchronization data based on attribute change information. Incremental synchronization data refers to data containing only the changed attribute portion, rather than data containing all attribute information of the second terminal.

[0112] In its implementation, a dynamic attribute synchronization module is deployed at the edge node layer. This module uses an incremental synchronization protocol to send attribute update information to the cloud center layer. The incremental synchronization protocol means that only changed attribute fields are sent to the cloud center layer, excluding unchanged attribute fields. The dynamic attribute synchronization module ensures attribute data consistency between the edge node layer and the cloud center layer through consistency checks. When the network is down, the dynamic attribute synchronization module caches attribute update information locally and automatically synchronizes it to the cloud center layer once the network is restored.

[0113] In this embodiment, the edge node sends incremental synchronization data to the cloud center. The cloud center updates the attribute information of the second terminal stored locally based on the received incremental synchronization data.

[0114] In its implementation, the cloud center layer deploys a global attribute management module and an intelligent access policy engine module. The global attribute management module updates global attributes based on attribute change information. The intelligent access policy engine module generates new access policies based on the updated global attributes and automatically resolves policy conflicts, which refer to contradictory rules between the new access policy and existing access policies.

[0115] The intelligent access policy engine module uses a canary release approach to distribute new access policies to the edge node layer. The canary release approach means that a preset proportion of edge nodes are updated first, and a full update is performed only after no issues are found. The access request processing module at the edge node layer receives the new access policy and updates its local policy accordingly.

[0116] This application solves the problem of large network transmission overhead caused by the crude and full synchronization of attribute information between cloud and edge nodes in traditional solutions. It realizes a lightweight attribute synchronization method that only synchronizes the changed parts, thereby reducing network transmission overhead.

[0117] Reference Figure 4 The diagram shows a flowchart of another data processing method provided in an embodiment of this application.

[0118] In this embodiment, the data processing method can be applied to a second terminal, which is communicatively connected to an edge node, and the edge node is communicatively connected to a first terminal. The specific meanings of the first terminal, the second terminal, and the edge node can be found in the explanations of the foregoing embodiments, and will not be repeated here.

[0119] This method may specifically include the following steps: S401, send a data access request for the target data to the edge node; the data access request contains the attribute information of the second terminal.

[0120] In this embodiment, the second terminal sends a data access request to the edge node. The data access request is a request message from the second terminal requesting to obtain target data. The data access request carries attribute information of the second terminal, which the edge node uses to determine whether the second terminal meets the data access conditions for the target data.

[0121] In the specific implementation, an attribute information collection module is deployed at the terminal device layer. This module dynamically collects device fingerprints and user behavior attributes. The device fingerprint includes the MAC address (the physical address of the terminal device's network interface card) and hardware model, used to uniquely identify the terminal device's hardware identity. User behavior attributes include operation permissions and login time, used to record the permission level and login time of the currently logged-in user. The attribute information collection module optimizes energy consumption during the collection process. Optimizing energy consumption means that the attribute information collection module only triggers the collection operation when the device state changes, and immediately enters a low-power state after collection is complete. The attribute information collection module then sends the collected device fingerprint and user behavior attributes to the edge node layer.

[0122] S402, receive the first ciphertext and the third ciphertext sent by the edge node; the third ciphertext is obtained by the edge node after converting the second ciphertext according to the attribute base decryption parameter; wherein, the attribute base decryption parameter is obtained by the edge node according to the attribute information, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameter and stored in the edge node.

[0123] In this embodiment, the second terminal receives a first ciphertext and a third ciphertext sent by the edge node. The third ciphertext is obtained by the edge node using the attribute base decryption parameters obtained from the attribute information of the second terminal to convert the second ciphertext. The second ciphertext is ciphertext data obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters.

[0124] S403, decrypt the third ciphertext using the user's private key from the second terminal to obtain a symmetric key; wherein, the user's private key is generated based on preset global parameters.

[0125] In this embodiment, the second terminal uses its own user private key to decrypt the third ciphertext to obtain a symmetric key. The user private key is a key generated based on preset global parameters, associated with the attribute information of the second terminal, and used to decrypt the third ciphertext to obtain the symmetric key.

[0126] S404, decrypt the first ciphertext using the symmetric key to obtain the target data; wherein, the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

[0127] In this embodiment, the second terminal uses the symmetric key obtained from decryption to decrypt the first ciphertext, thereby obtaining the target data. The first ciphertext is the ciphertext data obtained by the first terminal encrypting the target data using the symmetric key.

[0128] In the specific implementation, a data decryption and access module is deployed at the terminal device layer. After the second terminal finishes accessing the target data, the data decryption and access module destroys the decryption results. Destroying the decryption results means that the data decryption and access module clears all cached decryption results, decryption permission credentials, and symmetric keys in local memory to prevent unauthorized access to the decryption results.

[0129] An embodiment of this application also provides a data processing system.

[0130] In this embodiment, the data processing system includes a first terminal, a second terminal, and edge nodes, with the edge nodes communicatively connected to both the first and second terminals. The specific meanings of the first terminal, the second terminal, and the edge nodes can be found in the explanations of the foregoing embodiments, and will not be repeated here.

[0131] S501, the first terminal is used to acquire target data and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths; S502, the target data is encrypted using a symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext; S503, the first terminal is used to generate an attribute-based encryption request for the target data according to the data access conditions, and send the attribute-based encryption request to the edge node; S504, the edge node is used to receive the attribute base encryption request for the target data sent by the first terminal; S505, the edge node is used to determine the attribute base encryption parameters according to the data access conditions and the preset global parameters, and send the attribute base encryption parameters to the first terminal; S506, the first terminal is used to receive attribute base encryption parameters sent by the edge node; S507, the first terminal is used to encrypt the symmetric key using attribute base encryption parameters to obtain the second ciphertext; S508, the first terminal is used to send the first ciphertext and the second ciphertext to the edge node for storage; S509, the edge node is used to receive and store the first ciphertext and the second ciphertext sent by the first terminal; S510, the second terminal is used to send a data access request for target data to the edge node; the data access request contains the attribute information of the second terminal; S511, the edge node is used to receive data access requests for target data sent by the second terminal; S512, the edge node is used to obtain the attribute base decryption parameter corresponding to the attribute base encryption parameter if it is determined from the attribute information that the second terminal meets the data access conditions of the target data; S513, edge nodes are used to transform the second ciphertext according to the attribute base decryption parameters to obtain the third ciphertext; S514, the edge node is used to send the third ciphertext to the second terminal; S515, the second terminal is used to receive the third ciphertext sent by the edge node; S516, the second terminal is used to decrypt the third ciphertext according to the user's private key of the second terminal to obtain a symmetric key; wherein, the user's private key is generated based on preset global parameters; S517, the second terminal is used to decrypt the first ciphertext according to the symmetric key to obtain the target data.

[0132] In this embodiment, the functions performed by the first terminal, the edge node, and the second terminal correspond to the steps in the aforementioned method embodiments. The functions performed by the first terminal can be referred to the relevant descriptions of the first terminal in steps S101 to S106. The functions performed by the edge node can be referred to the relevant descriptions of the edge node in steps S201 to S203 and S301 to S304. The functions performed by the second terminal can be referred to the relevant descriptions of the second terminal in steps S401 to S404. The specific implementation methods of attribute-based encryption request generation, attribute-based encryption parameter determination, ciphertext storage and conversion, user private key combination and distribution, and data access request and response involved in the interaction between each terminal and the edge node have been described in detail in the aforementioned method embodiments and will not be repeated here.

[0133] Reference Figure 5 The diagram shows a system architecture diagram of a data processing system provided in an embodiment of this application.

[0134] The data processing system provided in this application includes a cloud center layer, an edge node layer, and a terminal device layer. The cloud center layer is connected to both the edge node layer and the terminal device layer, and the edge node layer is connected to the terminal device layer.

[0135] The cloud center layer deploys an intelligent access policy engine module, a system parameter management module, and a global attribute management module. The intelligent access policy engine module generates an initial access policy based on historical access log data using a trained neural network model, and distributes it to the edge node layer in a canary release manner. The edge node layer feeds back policy execution feedback data to this module for policy iteration and optimization. The system parameter management module generates quantum-resistant parameters and a master key. The master key is distributed and stored across three cloud nodes. These parameters and the master key are sent to the edge node layer for key generation and attribute base encryption parameter calculation. The global attribute management module defines cross-regional standard attributes to ensure that attribute information from terminal devices in different regions is correctly identified and verified under the same access control framework. The global attribute management module receives attribute information reported by the terminal device layer and verifies the authenticity of the attribute information through multi-source cross-validation, which includes comparing user databases and device registration information. An alert is issued when attribute information is abnormal; when attribute information is genuine, a confidence score is generated based on the attribute information and sent to the edge node layer.

[0136] The edge node layer obtains a global key component based on a confidence score. This global key component is generated by the cloud center layer based on attribute information and preset global parameters. The edge node layer obtains local attributes, which are local attributes extended from the cross-domain standard attributes defined by the cloud center layer. The edge node layer generates a local key component based on the local attributes and attribute information reported by the terminal device layer. The global key component and the local key component are combined into a user private key, which is then sent to the terminal device layer through a secure channel.

[0137] The terminal device layer receives and stores the user's private key, receives the initial access policy issued by the intelligent access policy engine module in a gray-scale manner, and determines the data access conditions based on the initial access policy. The first terminal acquires the target data, determines the sensitivity level and data access conditions based on the target data, obtains the symmetric key corresponding to the sensitivity level, encrypts the target data using the symmetric key to obtain the first ciphertext, generates an attribute-based encryption request based on the data access conditions, and sends it to the edge node layer. The edge node layer determines the attribute-based encryption parameters based on the data access conditions and preset global parameters and sends them to the first terminal. The first terminal encrypts the symmetric key using the attribute-based encryption parameters to obtain the second ciphertext, and sends both the first and second ciphertexts to the edge node layer, which receives and stores them.

[0138] Reference Figure 6 The diagram illustrates a system architecture diagram of an edge node layer provided in an embodiment of this application.

[0139] The edge node layer includes a lightweight attribute-based encryption algorithm module, a local attribute management module, an access request processing module, a fast decryption acceleration module, and a dynamic attribute synchronization module.

[0140] The lightweight attribute-based encryption algorithm module receives the recomputation portion of the encryption task offloaded from the terminal device layer. This module includes a dynamic key length compression unit, a hardware feature adaptation unit, and a ciphertext fragment reassembly and decryption unit. The dynamic key length compression unit adjusts the key length based on the terminal device's resource availability and data security level. The hardware feature adaptation unit provides a hardware acceleration interface for processing the offloaded encryption task. The lightweight attribute-based encryption algorithm module returns the processing result to the terminal device layer.

[0141] The local attribute management module obtains local attributes from the edge node layer, extends the local attributes according to the cross-domain standard attributes defined by the cloud center layer, performs lightweight encoding on the extended local attributes, and maintains a dynamic mapping table between attributes and devices.

[0142] The access request processing module receives data access requests sent by the terminal device layer, prioritizes the data access requests, performs permission judgment based on the localized adapted policy and the current device load of the edge node layer, executes the policy issued by the cloud center layer after localized adaptation, and aggregates access logs and stores them locally.

[0143] When access is granted, the access request processing module passes the decryption execution flow to the fast decryption acceleration module. The fast decryption acceleration module pre-calculates hotspot attribute parameters and caches them locally. It then calls the cached hotspot attribute parameters and uses the ciphertext fragment reconstructing and decryption unit to reconstruct and decrypt the ciphertext data. The reconstructed and decrypted data is then sent back to the terminal device layer, where the decryption result is temporarily cached.

[0144] The dynamic attribute synchronization module receives attribute update information transmitted via the incremental synchronization protocol. Using the incremental synchronization protocol, it only sends the changed attribute fields to the cloud center layer. Consistency checks ensure that the attribute data between the edge node layer and the cloud center layer is consistent. In the case of network outage, the attribute update information is cached locally. After the network is restored, the cached attribute update information is automatically synchronized to the cloud center layer.

[0145] Reference Figure 7 The diagram illustrates a system architecture diagram of a terminal device layer provided in an embodiment of this application.

[0146] The terminal device layer includes an attribute information acquisition module, a data encryption and upload module, a data decryption and access module, and an attribute update triggering module.

[0147] The attribute information acquisition module dynamically collects device fingerprints and user behavior attributes. Device fingerprints include media access control address and hardware model, while user behavior attributes include operation permissions and login time. The attribute information acquisition module sends the collected device fingerprints and user behavior attributes to the edge node layer and optimizes the acquisition power consumption during the acquisition process.

[0148] The data encryption upload module acquires sensitive-level encrypted data, offloads the recalculation part of the encryption task to the edge node layer, receives the processing results returned by the edge node layer, performs integrity verification on the encrypted data, and uploads the integrity-verified encrypted data to the edge node layer.

[0149] The data decryption access module receives the decryption result returned by the edge node layer, temporarily caches the decryption permission, and directly uses the cached decryption permission when accessing the same data again within the validity period. The cached decryption permission is sent to the edge node layer through a lightweight transmission method. After the access is completed, the decryption result is destroyed and the information of the destruction of the decryption result is sent to the edge node layer.

[0150] The attribute update trigger module monitors changes in the attributes of end users. When the end user role changes, the module detects the attribute change and uses a lightweight transmission method to send only the changed attribute fields to the edge node layer. If the transmission fails, the module initiates a retransmission mechanism and sends the execution status of the retransmission mechanism to the edge node layer.

[0151] Reference Figure 8 The diagram illustrates a system architecture diagram of a cloud center layer provided in an embodiment of this application.

[0152] The cloud center layer includes an intelligent access policy engine module, a system parameter management module, a user global attribute authentication module, and a global attribute management module. All of these modules are connected to the edge node layer, while the user global attribute authentication module is connected to the terminal device layer.

[0153] The intelligent access policy engine module automatically generates access policies based on AI technology, automatically resolves policy conflicts, and distributes access policies to the edge node layer using a canary release approach. The edge node layer feeds back feedback data generated during policy execution to this module for subsequent iterative optimization of the policies.

[0154] The system parameter management module generates quantum-resistant system parameters and employs a distributed master key storage mechanism. The master key is distributed across three cloud nodes and then distributed to the edge node layer via a secure channel. The edge node layer uses these quantum-resistant system parameters and the master key in key generation and attribute basis encryption parameter calculation.

[0155] The global attribute management module standardizes the definition, lifecycle management and conflict arbitration of cross-domain attributes, and sends the defined cross-domain standard attributes to the edge node layer. The edge node layer extends local attributes based on the cross-domain standard attributes.

[0156] The user global attribute authentication module receives attribute information reported by the terminal device layer and verifies the authenticity of the attribute information through multi-source cross-verification. Multi-source cross-verification includes comparing the user database and device registration information. A confidence score is generated based on the verification results. An alert is issued when the attribute information is abnormal. The confidence score is sent to the edge node layer, and the edge node layer executes the subsequent key generation process based on the confidence score.

[0157] The above provides a detailed description of the data processing method and system. For those skilled in the art, there may be changes in the specific implementation methods and application scope based on the ideas of this application. The content of this specification should not be construed as a limitation of this application.

Claims

1. A data processing method, characterized in that, The method is applied to a first terminal, which is communicatively connected to an edge node, and the edge node is communicatively connected to a second terminal. The method includes: Acquire target data, and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths; The target data is encrypted using the symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext; Generate an attribute-based encryption request for the target data based on the data access conditions, and send the attribute-based encryption request to the edge node; The edge node receives attribute base encryption parameters sent by the edge node; the attribute base encryption parameters are determined by the edge node based on the data access conditions and preset global parameters. The symmetric key is encrypted using the attribute base encryption parameters to obtain the second ciphertext; The first ciphertext and the second ciphertext are sent to the edge node for storage; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

2. The method according to claim 1, characterized in that, The steps of determining the sensitivity level and data access conditions of the target data based on the target data include: Obtain the data type of the target data; Determine the sensitivity level of the target data based on the data type; If the sensitivity level is the first level, then the symmetric key has a first length; If the sensitivity level is the second level, then the symmetric key has a second length; wherein the sensitivity of the first level is higher than that of the second level, and the first length is greater than the second length; The data access conditions for the target data are determined based on the sensitivity level.

3. The method according to claim 2, characterized in that, The edge node is communicatively connected to the cloud center; the step of determining the data access conditions of the target data based on the sensitivity level includes: The cloud center receives the initial access policy sent by the edge node; the initial access policy is generated by the cloud center using a trained neural network model based on historical access log data and is distributed to the edge node in a grayscale manner. Based on the sensitivity level, data access conditions corresponding to the sensitivity level are determined from the initial access policy.

4. A data processing method, characterized in that, Applied to edge nodes, which are communicatively connected to a first terminal and a second terminal respectively, the method includes: Receive an attribute-based encryption request for target data sent by the first terminal; the attribute-based encryption request includes the data access conditions of the target data; The attribute base encryption parameters are determined based on the data access conditions and preset global parameters, and the attribute base encryption parameters are sent to the first terminal. The system receives and stores a first ciphertext and a second ciphertext sent by the first terminal; the first ciphertext is obtained by the first terminal encrypting the target data using a preset symmetric key, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters; the first ciphertext and the second ciphertext are used to allow the second terminal to obtain the target data when the data access conditions are met.

5. A data processing method, characterized in that, Applied to edge nodes, which are communicatively connected to a first terminal and a second terminal respectively, the method includes: Receive a data access request for target data sent by the second terminal; the data access request includes attribute information of the second terminal; If it is determined from the attribute information that the second terminal meets the data access conditions of the target data, then the attribute base decryption parameter corresponding to the attribute base encryption parameter is obtained from the attribute information; wherein, the data access conditions are determined by the first terminal based on the target data; the attribute base encryption parameter is determined based on preset global parameters and the data access conditions; The second ciphertext is transformed according to the attribute base decryption parameters to obtain the third ciphertext; wherein, the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameters and stored in the edge node; The first ciphertext and the third ciphertext are sent to the second terminal; the second terminal is used to decrypt the third ciphertext according to the user's private key to obtain the symmetric key, and to decrypt the first ciphertext according to the symmetric key to obtain the target data; wherein, the user's private key is generated based on preset global parameters; the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

6. The method according to claim 5, characterized in that, The edge node is communicatively connected to the cloud center; the user's private key is generated in the following way: Receive the attribute information sent by the second terminal; Send the attribute information to the cloud center; Receive the global key component sent by the cloud center; the global key component is generated by the cloud center based on the attribute information and preset global parameters; Obtain the local attributes of the edge node, and generate a local key component based on the attribute information and the local attributes of the edge node; The global key component and the local key component are combined to form the user's private key; The user's private key is sent to the second terminal for storage.

7. The method according to claim 6, characterized in that, The attribute information includes a user identifier and a device identifier; prior to the step of receiving the global key component sent by the cloud center, the following steps are included: The system receives a confidence score sent by the cloud center; the confidence score is generated by the cloud center after verifying the user identity of the second terminal based on the user identifier in the attribute information and verifying the device identity of the second terminal based on the device identifier in the attribute information. If the confidence score is greater than or equal to a preset threshold, then the global key component sent by the cloud center is received; If the confidence score is less than the preset threshold, a warning message is sent to the second terminal.

8. The method according to claim 5, characterized in that, The method further includes: In response to an attribute change in the second terminal, obtain the attribute change information of the second terminal; Incremental synchronization data is generated based on the attribute change information; The incremental synchronization data is sent to the cloud center so that the cloud center updates the attribute information of the second terminal based on the incremental synchronization data.

9. A data processing method, characterized in that, Applied to a second terminal, the second terminal being communicatively connected to an edge node, and the edge node being communicatively connected to a first terminal, the method includes: Send a data access request for the target data to the edge node; the data access request includes the attribute information of the second terminal; The edge node receives a first ciphertext and a third ciphertext sent by the edge node; the third ciphertext is obtained by the edge node after converting the second ciphertext according to the attribute base decryption parameter; wherein, the attribute base decryption parameter is obtained by the edge node according to the attribute information, and the second ciphertext is obtained by the first terminal encrypting the symmetric key using the attribute base encryption parameter and stored in the edge node; The third ciphertext is decrypted using the user's private key from the second terminal to obtain the symmetric key; wherein the user's private key is generated based on preset global parameters; The first ciphertext is decrypted using the symmetric key to obtain the target data; wherein the first ciphertext is obtained by the first terminal encrypting the target data using the symmetric key and stored in the edge node.

10. A data processing system, characterized in that, The data processing system includes a first terminal, a second terminal, and an edge node, wherein the edge node is communicatively connected to the first terminal and the second terminal, respectively. The first terminal is used to acquire target data and determine the sensitivity level and data access conditions of the target data based on the target data; wherein, different sensitivity levels are preset with symmetric keys of different lengths; The target data is encrypted using the symmetric key corresponding to the sensitivity level of the target data to obtain the first ciphertext; The first terminal is used to generate an attribute-based encryption request for the target data according to the data access conditions, and send the attribute-based encryption request to the edge node; The edge node is used to receive the attribute base encryption request for the target data sent by the first terminal; The edge node is used to determine the attribute base encryption parameters according to the data access conditions and preset global parameters, and send the attribute base encryption parameters to the first terminal; The first terminal is used to receive attribute base encryption parameters sent by the edge node; The first terminal is used to encrypt the symmetric key using the attribute base encryption parameters to obtain the second ciphertext; The first terminal is used to send the first ciphertext and the second ciphertext to the edge node for storage; The edge node is used to receive and store the first and second ciphertexts sent by the first terminal. The second terminal is used to send a data access request for target data to the edge node; the data access request includes the attribute information of the second terminal; The edge node is used to receive data access requests for target data sent by the second terminal; The edge node is used to obtain the attribute base decryption parameter corresponding to the attribute base encryption parameter if it is determined from the attribute information that the second terminal meets the data access conditions of the target data; The edge nodes are used to transform the second ciphertext according to the attribute base decryption parameters to obtain the third ciphertext; The edge node is used to send the third ciphertext to the second terminal; The second terminal is used to receive the third ciphertext sent by the edge node; The second terminal is used to decrypt the third ciphertext according to the user's private key of the second terminal to obtain the symmetric key; wherein, the user's private key is generated based on the preset global parameters; The second terminal is used to decrypt the first ciphertext according to the symmetric key to obtain the target data.

Images